Cisco ASA <--> Fortigate Psec - Best possible cryptography?

[kallbrandt]

Hello,

After fiddling with quite a few tunnels between Fortigates and ASAs, I have noticed that the ASAs only seem to accept/propose 3DES/SHA1 themselves for encryption/authentication. Is this due to that people doesn't patch their ASAs, and their firmware is archaic, or is it a setup error or an incompability with Fortigate?

I don't have an ASA in my lab unfortunatly... Will try to get one.

I have seen the same behavior at several customers - You get the IPsec settings from the IT department at the other end, and it contains a string of different encryption/authentication cryptos for you to setup in the Fortigate, but in reality, only 3DES/SHA1 is used, and a diagnose debug application ike -1 tells you that the ASA doesn't respond to, or offer anything else then 3DES/SHA1. Same goes for the phase 2 negotiations.

This hasn't been any issue with any other firewall brand I've setup tunnels to. Like Palo Alto, Watchguard, pfSense, Sophos etc. All of them can at least do AES256/SHA256.

 If it's possible to get anything better running between an ASA and a Fortigate, I would love to know about it. IT department at other end usually responds with silence, or tells me Fortigate sucks when I ask why this is the case...

[Antonio_Milanese · Accepted solution]

Hello Richie

kallbrandt wrote:

After fiddling with quite a few tunnels between Fortigates and ASAs, I have noticed that the ASAs only seem to accept/propose 3DES/SHA1 themselves for encryption/authentication. Is this due to that people doesn't patch their ASAs, and their firmware is archaic, or is it a setup error or an incompability with Fortigate?

With older ASA(not -X models) Cisco used to charge you for any crypto capability above DES (oh yes they are greedy) and so if you buy a base model (K8 image) then you have to pay for "strong encryption" license or buy a SEC bundle (K9 image) model. Nowadays with X Models 3DES/AES "strong" license it's enabled even on base images and if you have a smartnet account you can obtain a "free" license for older models with K8 images. IIRC for SHA2 or above you should have at least 8.2.x firmware to support those hash algorithms.. Anyway since 3DES it's negotiated you have the SE license enabled, just show ver/show activation to get a confirmation, therefore if the tunnel does not come up at least with AES/SHA1 proposals there is something wrong on the config. Best regards, Antonio

[Antonio_Milanese · Accepted solution]

Hello Richie

kallbrandt wrote:

After fiddling with quite a few tunnels between Fortigates and ASAs, I have noticed that the ASAs only seem to accept/propose 3DES/SHA1 themselves for encryption/authentication. Is this due to that people doesn't patch their ASAs, and their firmware is archaic, or is it a setup error or an incompability with Fortigate?

With older ASA(not -X models) Cisco used to charge you for any crypto capability above DES (oh yes they are greedy) and so if you buy a base model (K8 image) then you have to pay for "strong encryption" license or buy a SEC bundle (K9 image) model. Nowadays with X Models 3DES/AES "strong" license it's enabled even on base images and if you have a smartnet account you can obtain a "free" license for older models with K8 images. IIRC for SHA2 or above you should have at least 8.2.x firmware to support those hash algorithms.. Anyway since 3DES it's negotiated you have the SE license enabled, just show ver/show activation to get a confirmation, therefore if the tunnel does not come up at least with AES/SHA1 proposals there is something wrong on the config. Best regards, Antonio

[emnoc]

Is this due to that people doesn't patch their ASAs, and their firmware is archaic, or is it a setup error or an incompability with Fortigate?  

Not sure what/where you got that from. I have ipsec2 tunnesl sing AES128-256 awith sha1 in 9.2.x  code or newier.

I being  the latest codes allows sha2 384 ( aka 192bits ) or better and even ECC.

Ken

[kallbrandt]

Well, I got that from me and my collegues own experience - We still haven't seen anything better then 3DES/SHA1 from an ASA, even though other side claims to have configured it. ASA is dead silent to all proposals, and only propose 3DES/SHA1 itself. And we're talking about a lot of ASAs, all handled by different companies. All of them are pretty reluctant to share both their ipsec config and their firmware version, they just tells us the Fortigate on our is broken... We handle something like 30 IPsec tunnels to different ASAs, in different countries. They all behave the same. Makes you wonder, doesn't it...

But It seems I can get ahold of a 5520 actually. It seems to me that the only plausable way forward is to test how it works myself so that we can suggest/demand a setup that we know is functional...

:)

[emnoc · Accepted solution]

Unless you have some older hardware, export-restricted and|or  pre 8.4 code I would say either , it's not cfg correctly or have the right IKEv1 policy and|or  transform-sets, or the person doing the work; "just do not known howto"

Here's one of my blog post  , that I put together  awhile back for  ciscoASA --2----FGT

http://socpuppet.blogspot...inet-fortigate-to.html

Clearly in this example we are running AES.  This was done on a simple  ASA5505 and for that time was probably 8.4 or maybe 9.1.7 code.

Ken

[kallbrandt]

Yeah, I think it's actually all of the above - Old hardware, pre 8.4 code, wrong config, and dorks...

:)