Which IPsec transform set provides the strongest protection?
A. crypto ipsec transform-set 1 esp-3des esp-sha-hmac
B. crypto ipsec transform-set 2 esp-3des esp-md5-hmac
C. crypto ipsec transform-set 3 esp-aes 256 esp-sha-hmac
D. crypto ipsec transform-set 4 esp-aes esp-md5-hmac
E. crypto ipsec transform-set 5 esp-des esp-sha-hmac
F. crypto ipsec transform-set 6 esp-des esp-md5-hmac
Explanation/Reference:
Explanation:
http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/ security_manager/4.1/user/guide/vpipsec.html
Table 22-2 IKEv2 Proposal Dialog Box
Name The name of the policy object. A maximum of 128 characters is allowed. Description A description of the policy object. A maximum of 1024 characters is allowed. Priority The priority value of the IKE proposal. The priority value determines the order of the IKE proposals compared by the two negotiating peers when attempting to find a common security association (SA). If the remote IPsec peer does not support the parameters selected in your first priority policy, the device tries to use the parameters defined in the policy with the next lowest priority number. Valid values range from 1 to 65535. The lower the number, the higher the priority. If you leave this field blank,
Security Manager assigns the lowest unassigned value starting with 1, then 5, then continuing in increments of 5.
Get Latest & Actual 640-554 Exam’s Question and Answers from Passleader.
http://www.passleader.com
Encryption Algorithm
The encryption algorithm used to establish the Phase 1 SA for protecting Phase 2 negotiations. Click Select and select all of the algorithms that you want to allow in the VPN:
AES–Encrypts according to the Advanced Encryption Standard using 128-bit keys. AES-192–Encrypts according to the Advanced Encryption Standard using 192-bit keys. AES-256–Encrypts according to the Advanced Encryption Standard using 256-bit keys. AES–Encrypts according to the Data
Encryption Standard using 56-bit keys. DES–Encrypts three times using 56-bit keys. 3DES is more secure than DES, but requires more processing for encryption and decryption. It is less secure than AES. A 3DES license is required to use this option.
Null–No encryption algorithm.
Integrity (Hash) Algorithm
The integrity portion of the hash algorithm used in the IKE proposal. The hash algorithm creates a message digest, which is used to ensure message integrity. Click Select and select all of the algorithms that you want to allow in the VPN:
SHA (Secure Hash Algorithm)–Produces a 160-bit digest. SHA is more resistant to brute-force attacks than MD5.
MD5 (Message Digest 5)–Produces a 128-bit digest. MD5 uses less processing time than SHA. Prf Algorithm The pseudo-random function (PRF) portion of the hash algorithm used in the IKE proposal. In IKEv1, the Integrity and PRF algorithms are not separated, but in IKEv2, you can specify different algorithms for these elements. Click Select and select all of the algorithms that you want to allow in the VPN:
SHA (Secure Hash Algorithm)–Produces a 160-bit digest. SHA is more resistant to brute-force attacks than MD5.
MD5 (Message Digest 5)–Produces a 128-bit digest. MD5 uses less processing time than SHA.
Modulus Group
The Diffie-Hellman group to use for deriving a shared secret between the two IPsec peers without transmitting it to each other. A larger modulus provides higher security but requires more processing time. The two peers must have a matching modulus group. Click Select and select all of the groups that you want to allow in the
VPN:
–Diffie-Hellman Group 1 (768-bit modulus).
–Diffie-Hellman Group 2 (1024-bit modulus). This is the minimum recommended setting. ?–Diffie- Hellman Group 5 (1536-bit modulus, considered good protection for 128-bit keys).
Select this option if you are using AES encryption.
Lifetime
The lifetime of the security association (SA), in seconds. When the lifetime is exceeded, the SA expires and must be renegotiated between the two peers. As a general rule, the shorter the lifetime (up to a point), the more secure your IKE negotiations will be. However, with longer lifetimes, future IPsec security associations can be set up more quickly than with shorter lifetimes. You can specify a value from 120 to 2147483647 seconds. The default is 86400. Category The category assigned to the object. Categories help you organize and identify rules and objects. See Using Category Objects, page 6-9.
