• Object Name.

• Description.

• DNS Server. You can edit, add, or remove DNS servers from this list.

• Domain Search Name.

• Retries.

• Timeout.

The Enrollment step is set to Terminal.

A PKCS#12, or PFX, file holds a server certificate, intermediate certificates, and a private key in one encrypted file. Enter the Passphrase value for decryption.

In the Revocation tab, you can configure the following:

• Enable Certificate Revocation Lists (CRL) — Check to enable CRL checking.

  By default the Use CRL distribution point from the certificate check box is selected to obtain the revocation lists distribution URL from the certificate.

  Cache Refresh Time (in minutes) — Enter the number of minutes between cache refreshes. The default is 60 minutes. The range is 1-1440 minutes. To avoid having to retrieve the same CRL from a CA repeatedly, the ASA can store retrieved CRLs locally, which is called CRL caching. The CRL cache capacity varies by platform and is cumulative across all contexts. If an attempt to cache a newly retrieved CRL would exceed its storage limits, the ASA removes the least recently used CRL until more space becomes available.

• Enable Online Certificate Status Protocol (OCSP) — Check to enable OCSP checking.

  OCSP Server URL—The URL of the OCSP server checking for revocation if you require OCSP checks. This URL must start with http://.

  Disable Nonce Extension — Enable the check box which cryptographically binds requests with responses to avoid replay attacks. This process works by matching the extension in the request to that in the response, ensuring that they are the same. Uncheck the Disable Nonce Extension check box if the OCSP server you are using sends pregenerated responses that do not include this matching nonce extension.

  Evaluation Priority — Specify whether to evaluate the revocation status of a certificate first in CRL or OSCP.

• Consider the certificate valid if revocation information cannot be reached— Select this check box to consider the certificate to be a valid certificate if revocation information is unreachable.

  For more information on revocation check, see the "Digital Certificates" chapter in the "Basic Settings" book of the Cisco ASA Series General Operations ASDM Configuration, X.Y document.

Click the Others tab:

• Use CA Certificate for the Validation of — Specify the type of connections that can be validated by this CA.

  • IPSec Client — Validates certificate presented by remote SSL servers.

  • SSL Client — Validates certificates presented by incoming SSL connections.

  • SSL Server — Validates certificates presented by incoming IPSec connections.

• Use Identity Certificate for — Specify how the enrolled ID certificate can be used.

  • SSL & IPSec — Use for authenticating SSL & IPSec connections

  • Code Signer — Code signer certificates are special certificates whose associated private keys are used to create digital signatures. The certificates used to sign code are obtained from a CA, with the signed code itself revealing the certificate origin.

• Other Options:

  • Enable CA flag in basic constraints extension — Select this option if this certificate should be able to sign other certificates. The basic constraints extension identifies whether the subject of the certificate is a Certificate Authority (CA), in which case the certificate can be used to sign other certificates. The CA flag is part of this extension.

  • Accept certificates issued by this CA — Select this option to indicate that the ASA should accept certificates from the specified CA.

  • Ignore IPSec Key Usage — Select this option if you do not want to validate values in the key usage and extended key usage extensions of IPsec remote client certificates. You can suppress key usage checking on IPsec client certificates. By default, this option is not enabled.

The name is used in the configuration as an object name only; it does not become part of the certificate itself.

The Certificates Content step appears. Read Self-Signed and CSR Certificate Generation Based on Certificate Contents to understand the CN and SANS content in the Self-Signed certificate that is being generated.

• Country (C)— Select the country code from the drop-down list.

• State or Province (ST)—The state or province to include in the certificate.

• Locality or City (L)—The locality to include in the certificate, such as the name of the city.

• Organization (O)—The organization or company name to include in the certificate.

• Organizational Unit (Department) (OU)—The name of the organization unit (for example, a department name) to include in the certificate.

• Common Name (CN)—The X.500 common name to include in the certificate. This could be the name of the device, web site, or another text string. This element is usually required for successful connections. For example, you must include a CN in the internal certificate used for remote access VPN.

• Email Address (EA)— The e-mail address associated with the identity certificate.

• IP Address— The ASA IP address on the network in four-part dotted-decimal notation.

• Device's FQDN— An unambiguous domain name, to indicate the position of the node in the DNS tree hierarchy.

• Include Device's Serial Number— Select the check box if you want to add the ASA serial number to the certificate parameters.

In the Revocation tab, you can configure the following:

• Enable Certificate Revocation Lists (CRL) — Check to enable CRL checking.

  By default the Use CRL distribution point from the certificate check box is selected to obtain the revocation lists distribution URL from the certificate.

  Cache Refresh Time (in minutes) — Enter the number of minutes between cache refreshes. The default is 60 minutes. The range is 1 to 1440 minutes. To avoid having to retrieve the same CRL from a CA repeatedly, the ASA can store retrieved CRLs locally, which is called CRL caching. The CRL cache capacity varies by platform and is cumulative across all contexts. If an attempt to cache a newly retrieved CRL would exceed its storage limits, the ASA removes the least recently used CRL until more space becomes available.

• Enable Online Certificate Status Protocol (OCSP) — Check to enable OCSP checking.

  OCSP Server URL — The URL of the OCSP server checking for revocation if you require OCSP checks. This URL must start with http://.

  Disable Nonce Extension — Enable the check box which cryptographically binds requests with responses to avoid replay attacks. This process works by matching the extension in the request to that in the response, ensuring that they are the same. Uncheck the Disable Nonce Extension check box if the OCSP server you are using sends pregenerated responses that do not include this matching nonce extension.

  Evaluation Priority — Specify whether to evaluate the revocation status of a certificate first in CRL or OSCP.

• Consider the certificate valid if revocation information cannot be reached — Select this check box to consider the certificate to be a valid certificate if revocation information is unreachable.

  For more information on revocation check, see the "Digital Certificates" chapter in the "Basic Settings" book of the Cisco ASA Series General Operations ASDM Configuration, X.Y document.

Click the Others tab:

• Use CA Certificate for the Validation of — Specify the type of connections that can be validated by this CA.

  • IPSec Client — Validates certificate presented by remote SSL servers.

  • SSL Client — Validates certificates presented by incoming SSL connections.

  • SSL Server — Validates certificates presented by incoming IPSec connections.

• Use Identity Certificate for — Specify how the enrolled ID certificate can be used.

  • SSL & IPSec — Use for authenticating SSL & IPSec connections

  • Code Signer — Code signer certificates are special certificates whose associated private keys are used to create digital signatures. The certificates used to sign code are obtained from a CA, with the signed code itself revealing the certificate origin.

• Other Options:

  • Enable CA flag in basic constraints extension — Select this option if this certificate should be able to sign other certificates. The basic constraints extension identifies whether the subject of the certificate is a Certificate Authority (CA), in which case the certificate can be used to sign other certificates. The CA flag is part of this extension. The presence of these items in a certificate i

  • Accept certificates issued by this CA — Select this option to indicate that the ASA should accept certificates from the specified CA.

  • Ignore IPSec Key Usage — Select this option if you do not want to validate values in the key usage and extended key usage extensions of IPsec remote client certificates. You can suppress key usage checking on IPsec client certificates. By default, this option is not enabled.

The name is used in the configuration as an object name only; it does not become part of the certificate itself.

The Certificates Content step appears. Read Self-Signed and CSR Certificate Generation Based on Certificate Contents to understand the CN and SANS content in the Signed certificate that is being generated.

• Country (C)— Select the country code from the drop-down list.

• State or Province (ST)—The state or province to include in the certificate.

• Locality or City (L)—The locality to include in the certificate, such as the name of the city.

• Organization (O)—The organization or company name to include in the certificate.

• Organizational Unit (Department) (OU)—The name of the organization unit (for example, a department name) to include in the certificate.

• Common Name (CN)—The X.500 common name to include in the certificate. This could be the name of the device, web site, or another text string. This element is usually required for successful connections. For example, you must include a CN in the internal certificate used for remote access VPN.

• Email Address (EA)— The e-mail address associated with the identity certificate.

• IP Address— The ASA IP address on the network in four-part dotted-decimal notation.

• Subject Alternative Name (SAN)— This field will be part of Certificate Subject DN as 'unstructuredName' as well. We recommend you use this field if the certificate is used for multiple domains or IP addresses.

  • Use Device Host Name: Host name of the device is used.

  • Custom: Device's FQDN— An unambiguous domain name, to indicate the position of the node in the DNS tree hierarchy.

    Note	We recommend the values specified in CN and Custom FQDN are the same.

• Include Device's Serial Number— Select the check box if you want to include the serial number of ASA in the certificate. The CA uses the serial number to either authenticate certificates or to later associate a certificate with a particular device. If you are in doubt, include the serial number, as it is useful for debugging purposes.

In the Revocation tab, you can configure the following:

• Enable Certificate Revocation Lists (CRL) — Check to enable CRL checking.

  By default, the Use CRL distribution point from the certificate check box is selected to obtain the revocation lists distribution URL from the certificate.

  Cache Refresh Time (in minutes) — Enter the number of minutes between cache refreshes. The default is 60 minutes. The range is 1 to 1440 minutes. To avoid having to retrieve the same CRL from a CA repeatedly, the ASA can store retrieved CRLs locally, which is called CRL caching. The CRL cache capacity varies by platform and is cumulative across all contexts. If an attempt to cache a newly retrieved CRL would exceed its storage limits, the ASA removes the least recently used CRL until more space becomes available.

• Enable Online Certificate Status Protocol (OCSP) — Check to enable OCSP checking.

  OCSP Server URL—The URL of the OCSP server checking for revocation if you require OCSP checks. This URL must start with http://.

  Disable Nonce Extension — Enable the check box which cryptographically binds requests with responses to avoid replay attacks. This process works by matching the extension in the request to that in the response, ensuring that they are the same. Uncheck the Disable Nonce Extension check box if the OCSP server you are using sends pregenerated responses that do not include this matching nonce extension.

  Evaluation Priority — Specify whether to evaluate the revocation status of a certificate first in CRL or OSCP.

• Consider the certificate valid if revocation information cannot be reached— Select this check box to consider the certificate to be a valid certificate if revocation information is unreachable.

  For more information on revocation check, see the "Digital Certificates" chapter in the "Basic Settings" book of the Cisco ASA Series General Operations ASDM Configuration, X.Y document.

Click the Others tab:

• Use CA Certificate for the Validation of — Specify the type of connections that can be validated by this CA.

  • IPSec Client — Validates certificate presented by remote SSL servers.

  • SSL Client — Validates certificates presented by incoming SSL connections.

  • SSL Server — Validates certificates presented by incoming IPSec connections.

• Use Identity Certificate for — Specify how the enrolled ID certificate can be used.

  • SSL & IPSec — Use for authenticating SSL & IPSec connections

  • Code Signer — Code signer certificates are special certificates whose associated private keys are used to create digital signatures. The certificates used to sign code are obtained from a CA, with the signed code itself revealing the certificate origin.

• Other Options:

  • Enable CA flag in basic constraints extension — Select this option if this certificate should be able to sign other certificates. The basic constraints extension identifies whether the subject of the certificate is a Certificate Authority (CA), in which case the certificate can be used to sign other certificates. The CA flag is part of this extension. The presence of these items in a certificate i

  • Accept certificates issued by this CA — Select this option to indicate that the ASA should accept certificates from the specified CA.

  • Ignore IPSec Key Usage — Select this option if you do not want to validate values in the key usage and extended key usage extensions of IPsec remote client certificates. You can suppress key usage checking on IPsec client certificates. By default, this option is not enabled.

This creates a trustpoint certificate object.

The name is used in the configuration as an object name only; it does not become part of the certificate itself.

The certificate must follow these guidelines:

• The name of the server in the certificate must match the server Hostname / IP Address. For example, if you use 10.10.10.250 as the IP address but ad.example.com in the certificate, the connection fails.

• The certificate must be an X509 certificate in PEM or DER format.

• The certificate you paste must include the BEGIN CERTIFICATE and END CERTIFICATE lines. For example:

  -----BEGIN CERTIFICATE-----
  MIIFgTCCA2mgAwIBAgIJANvdcLnabFGYMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNV
  BAYTAlVTMQswCQYDVQQIDAJUWDEPMA0GA1UEBwwGYXVzdGluMRQwEgYDVQQKDAsx
  OTIuMTY4LjEuMTEUMBIGA1UEAwwLMTkyLjE2OC4xLjEwHhcNMTYxMDI3MjIzNDE3
  WhcNMTcxMDI3MjIzNDE3WjBXMQswCQYDVQQGEwJVUzELMAkGA1UECAwCVFgxDzAN
  BgNVBAcMBmF1c3RpbjEUMBIGA1UECgwLMTkyLjE2OC4xLjExFDASBgNVBAMMCzE5
  Mi4xNjguMS4xMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5NceYwtP
  ES6Ve+S9z7WLKGX5JlF58AvH82GPkOQdrixn3FZeWLQapTpJZt/vgtAI2FZIK31h
  (...20 lines removed...)
  hbr6HOgKlOwXbRvOdksTzTEzVUqbgxt5Lwupg3b2ebQhWJz4BZvMsZX9etveEXDh
  PY184V3yeSeYjbSCF5rP71fObG9Iu6+u4EfHp/NQv9s9dN5PMffXKieqpuN20Ojv
  2b1sfOydf4GMUKLBUMkhQnip6+3W
  -----END CERTIFICATE-----

In the Revocation tab, you can configure the following:

• Enable Certificate Revocation Lists (CRL) — Check to enable CRL checking.

  By default, the Use CRL distribution point from the certificate check box is selected to obtain the revocation lists distribution URL from the certificate.

  Cache Refresh Time (in minutes) — Enter the number of minutes between cache refreshes. The default is 60 minutes. The range is 1 to 1440 minutes. To avoid having to retrieve the same CRL from a CA repeatedly, the ASA can store retrieved CRLs locally, which is called CRL caching. The CRL cache capacity varies by platform and is cumulative across all contexts. If an attempt to cache a newly retrieved CRL would exceed its storage limits, the ASA removes the least recently used CRL until more space becomes available.

• Enable Online Certificate Status Protocol (OCSP) — Check to enable OCSP checking.

  OCSP Server URL—The URL of the OCSP server checking for revocation if you require OCSP checks. This URL must start with http://.

  Disable Nonce Extension — Enable the check box which cryptographically binds requests with responses to avoid replay attacks. This process works by matching the extension in the request to that in the response, ensuring that they are the same. Uncheck the Disable Nonce Extension check box if the OCSP server you are using sends pregenerated responses that do not include this matching nonce extension.

  Evaluation Priority — Specify whether to evaluate the revocation status of a certificate first in CRL or OSCP.

• Consider the certificate valid if revocation information cannot be reached— Select this check box to consider the certificate to be a valid certificate if revocation information is unreachable.

  For more information on revocation check, see the "Digital Certificates" chapter in the "Basic Settings" book of the Cisco ASA Series General Operations ASDM Configuration, X.Y document.

Click the Others tab:

• Use CA Certificate for the Validation of — Specify the type of connections that can be validated by this CA.

  • IPSec Client — Validates certificate presented by remote SSL servers.

  • SSL Client — Validates certificates presented by incoming SSL connections.

  • SSL Server — Validates certificates presented by incoming IPSec connections.

• Other Options:

  • Enable CA flag in basic constraints extension — Select this option if you want to validate if the subject of the certificate is a CA using the basic constraints extension.

  • Accept certificates issued by this CA — Select this option to indicate that the ASA should accept certificates from the specified CA.

  • Accept certificates issued by the subordinates CAs of this CA — Select this option to indicate that the ASA should accept certificates from the subordinate CA.

  • Ignore IPSec Key Usage — Select this option if you do not want to validate values in the key usage and extended key usage extensions of IPsec remote client certificates. You can suppress key usage checking on IPsec client certificates. By default, this option is not enabled.

This creates a trustpoint certificate object.

• Click , and select FTD > IKEv1 IPsec Proposal to create the new object.

• On the object page, select the IPsec proposal you want to edit and click Edit in the Actions pane at the right.

• Tunnel mode encapsulates the entire IP packet. The IPSec header is added between the original IP header and a new IP header. This is the default. Use tunnel mode when the firewall is protecting traffic to and from hosts positioned behind the firewall. Tunnel mode is the normal way regular IPSec is implemented between two firewalls (or other security gateways) that are connected over an untrusted network, such as the Internet.

• Transport mode encapsulates only the upper-layer protocols of an IP packet. The IPSec header is inserted between the IP header and the upper-layer protocol header (such as TCP). Transport mode requires that both the source and destination hosts support IPSec, and can only be used when the destination peer of the tunnel is the final destination of the IP packet. Transport mode is generally used only when protecting a Layer 2 or Layer 3 tunneling protocol such as GRE, L2TP, and DLSW.

• Click and select FTD > IKEv2 IPsec Proposal to create the new object.

• In the object page, select the IPsec proposal you want to edit and click Edit in the Actions pane at the right.

• Encryption—The Encapsulating Security Protocol (ESP) encryption algorithm for this proposal. Select all the algorithms that you want to allow. The system negotiates with the peer, starting from the strongest to the weakest algorithm until a match is agreed upon. For an explanation of the options, see Encryption and Hash Algorithms Used in VPN.

• Integrity Hash—The hash or integrity algorithm to use for authentication. Select all the algorithms that you want to allow. The system negotiates with the peer, starting from the strongest to the weakest algorithm until a match is agreed upon.

• Click and select FTD > IKEv1 Policy to create a new IKEv1 policy.

• In the object page, select the IKEv1 policy you want to edit and click Edit in the Actions pane at the right.

• Priority: The relative priority of the IKE policy, from 1 to 65,535. The priority determines the order of the IKE policy compared by the two negotiating peers when attempting to find a common security association (SA). If the remote IPsec peer does not support the parameters selected in your highest priority policy, it tries to use the parameters defined in the next lowest priority. The lower the number, the higher the priority.

• Encryption: The encryption algorithm used to establish the Phase 1 security association (SA) for protecting Phase 2 negotiations. For an explanation of the options, see Deciding Which Encryption Algorithm to Use.

• Diffie-Hellman Group: The Diffie-Hellman group to use for deriving a shared secret between the two IPsec peers without transmitting it to each other. A larger modulus provides higher security but requires more processing time. The two peers must have a matching modulus group. For an explanation of the options, see Deciding Which Encryption Algorithm to Use.

• Lifetime: The lifetime of the security association (SA), in seconds, from 120 to 2147483647 or blank. When the lifetime is exceeded, the SA expires and must be renegotiated between the two peers. As a general rule, the shorter the lifetime (up to a point), the more secure your IKE negotiations will be. However, with longer lifetimes, future IPsec security associations can be set up more quickly than with shorter lifetimes. The default is 86400. To specify an unlimited lifetime, enter no value (leave the field blank).

• Authentication: The method of authentication to use between the two peers. For more information, see Deciding Which Encryption Algorithm to Use.

  • Preshared Key: Use the preshared key that is defined on each device. These keys allow for a secret key to be shared between two peers and to be used by IKE during the authentication phase. If the peer is not configured with the same preshared key, the IKE SA cannot be established.

  • Certificate: Use the device identity certificates for the peers to identify each other. You must obtain these certificates by enrolling each peer in a Certificate Authority. You must also upload the trusted CA root and intermediate CA certificates used to sign the identity certificates in each peer. The peers can be enrolled in the same or a different CA. You cannot use self-signed certificates for either peer.

• Hash: The hash algorithm for creating a message digest, which is used to ensure message integrity. For an explanation of the options, see Deciding Which Encryption Algorithm to Use.

• Click and select FTD > IKEv2 Policy to create a new IKEv2 policy.

• In the object page, select the IKEv2 policy you want to edit and click Edit in the Actions pane at the right.

• Priority: The relative priority of the IKE policy, from 1 to 65,535. The priority determines the order of the IKE policy compared by the two negotiating peers when attempting to find a common security association (SA). If the remote IPsec peer does not support the parameters selected in your highest priority policy, it tries to use the parameters defined in the next lowest priority. The lower the number, the higher the priority.

• State: Whether the IKE policy is enabled or disabled. Click the toggle to change the state. Only enabled policies are used during IKE negotiations.

• Encryption: The encryption algorithm used to establish the Phase 1 security association (SA) for protecting Phase 2 negotiations. Select all algorithms that you want to allow, although you cannot include both mixed-mode (AES-GCM) and normal mode options in the same policy. (Normal mode requires that you select an integrity hash, whereas mixed-mode prohibits a separate integrity hash selection.) The system negotiates with the peer, starting from the strongest to the weakest algorithm until a match is agreed upon. For an explanation of the options, see Deciding which encryption algorithm to use.

• Diffie-Hellman Group: The Diffie-Hellman group to use for deriving a shared secret between the two IPsec peers without transmitting it to each other. A larger modulus provides higher security but requires more processing time. The two peers must have a matching modulus group. Select all the algorithms that you want to allow. The system negotiates with the peer, starting from the strongest to the weakest group until a match is agreed upon.

• Integrity Hash: The integrity portion of the hash algorithm for creating a message digest, which is used to ensure message integrity. Select all the algorithms that you want to allow. The system negotiates with the peer, starting from the strongest to the weakest algorithm until a match is agreed upon. The integrity hash is not used with the AES-GCM encryption options. For an explanation of the options, see Encryption and Hash Algorithms Used in VPN.

• Pseudo-Random Function (PRF) Hash: The pseudo-random function (PRF) portion of the hash algorithm, which is used as the algorithm to derive keying material and hashing operations required for the IKEv2 tunnel encryption. In IKEv1, the Integrity and PRF algorithms are not separated, but in IKEv2, you can specify different algorithms for these elements. Select all the algorithms that you want to allow. The system negotiates with the peer, starting from the strongest to the weakest algorithm until a match is agreed upon. For an explanation of the options, see Encryption and Hash Algorithms Used in VPN.

• Lifetime: The lifetime of the security association (SA), in seconds, from 120 to 2147483647 or blank. When the lifetime is exceeded, the SA expires and must be renegotiated between the two peers. As a general rule, the shorter the lifetime (up to a point), the more secure your IKE negotiations will be. However, with longer lifetimes, future IPsec security associations can be set up more quickly than with shorter lifetimes. The default is 86400. To specify an unlimited lifetime, enter no value (leave the field blank).

• Routed : Routed interfaces are the normal interfaces used for through traffic that can apply security policies.

• Passive: Passive interfaces operate as packet sniffers and do not affect the traffic flow through the device.

• If you know the name of the object, you can search for it in the Objects page:

  • Filter the list by security zone.

  • Enter the name of the object in the search field.

  • Select the object.

• If you know the object is associated with a device, you can search for it starting on the Security Devices page.

  • In the left pane, click Security Devices.

  • Click the Devices tab.

  • Click the apporpriate tab.

  • Use the device filter and search bar to locate your device.

  • Select the device.

  • In the Management pane at the right, click Objects.

  • Use the object filter and search bar to locate the object you are looking for.

Note	If the security zone object you created is not associated with a rule in a policy for your device, it is considered "unassociated" and you will not see it among the search results for a device.

• For TCP, UDP, and TCP-UDP service types, enter a source port, destination port, or both:

  • The source port identifier allows you to match traffic originating from a particular numbered port. In the source port identifier, select an operator: equal to, range, less than, greater than, or not equal to and provide the appropriate port number or range.

  • The destination port identifier allows you to match traffic arriving at a particular numbered port. In the destination port identifier, select an operator: equal to, range, less than, greater than, or not equal to and provide the appropriate port number or range.

• For Protocol service types, enter a protocol number between 0-255, or a well-known name, such as ip, tcp, udp, gre, and so forth.

• TCP, UDP

  • Select eq and then enter either a port number or a protocol name. For example, you could enter 80 as a port number or HTTP as the protocol name.

  • You can also select range and then enter a range of port numbers, for example, 1 65535 (to cover all ports).

• ICMP, IPv6-ICMP-Select the ICMP Type. Select Any for the type to apply to all ICMP messages. For information on the types and codes, see the following pages:

  • ICMP-http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xml

  • ICMPv6-http://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xml

• Other-Select the desired protocol.