Consider the following configuration on a Cisco ASA:
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
What is the purpose of this command?
- to define the ISAKMP parameters that are used to establish the tunnel
- to define the encryption and integrity algorithms that are used to build the IPsec tunnel
- to define what traffic is allowed through and protected by the tunnel
- to define only the allowed encryption algorithms
Explanation: The transform set is negotiated during Phase 2 of the IPsec VPN connection process. The purpose of the transform set is to define what encryption and authentication schemes can be used. The device doing the VPN initiation offers the acceptable transform sets in order of preference, in this case, ESP authentication using DES for encryption or ESP authentication using SHA-HMAC authentication and integrity for the data payload. Remember that ESP provides confidentiality with encryption and integrity with authentication. The ESP-DES-SHA is the name of the transform set. The parameters that follow (esp-des and esp-sha-hmac) are the specific types of encryption or authentication that is supported by the ASA for the VPN tunnel that uses this transform set.
Exam with this question: CCNA Security Chapter 8 Exam Answers
Exam with this question: CCNA Security Certification Practice Exam Answers
Exam with this question: Modules 18 - 19: VPNs Group Exam Answers
Please login or Register to submit your answer