Many sub-strategies and transform sets for peer 1 tunnel?

Recently acquired a heavy ASA company, with network administrators.  They seem to stand for some things to ASA I don't understand quite below.

This is one site talked, and there's only 1 tunnel on this subject on the hub. This tunnel appealed to the transformation of named sets ""ESP-3DES-SHA "&"ESP-3DES-MD5." " That said, why have they configured transform sets for AES 256, AES 192, AES and if they ask only 3DES transformation sets in the card encryption?  The sub-strategies down from the extract of seem to have something to do with it, but if that were the case, wouldn't you call all transformation configured in the encryption card sets to perform fully all sub-strategies set in this config, because each set of sub-policy puts the encryption to a different type / method?

Excerpt from the configuration:

Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit

card crypto outside_map 1 match address outside_cryptomap
card crypto outside_map 1 set of peer XX.XXX.XXX. XX
card crypto outside_map 1 set ikev1 transform-set ESP-3DES-MD5 SHA-ESP-3DES

outside_map interface card crypto outside

IKEv1 crypto policy 10
authentication crack
aes-256 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 20
authentication rsa - sig
aes-256 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 30
preshared authentication
aes-256 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 40
authentication crack
aes-192 encryption
sha hash
Group 2
life 86400

IKEv1 crypto policy 50
authentication rsa - sig
aes-192 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 60
preshared authentication
aes-192 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 70
authentication crack
aes encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 80
authentication rsa - sig
aes encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 90

preshared authentication
aes encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 100
authentication crack
3des encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 110
authentication rsa - sig
3des encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 120
preshared authentication
3des encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 130
authentication crack
the Encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 140
authentication rsa - sig
the Encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 150
preshared authentication
the Encryption
sha hash
Group 2
life 86400

Only the transform-set called card encryption will be used. Policies will be judged by priority until a correspondent of the hub is found. Ideally, it would be first.

You're right for the use case you describe only a single defined and political transformation is necessary. Multiples are often the legacy of the settings by default and, sometimes, an attempt to standardize with each set of transformation and the policy on the ASAs so that no matter where they end up connect to the necessary building blocks are in the config. However, it causes a lot of unused lines.

Tags: Cisco Security

Similar Questions

Maybe you are looking for

  • iPhone 4 is disabled

    Hello Sir I need your help to unlock my iphone (4) I got the massage from IPhone is disabled Concerning Samer my phone i ic number series: 579ce23808

  • Satellite M50 does not supply power to the top

    Hello My laptop Satellite M50 does not supply power to the top. The laptop itself is working fine, but I can't use it as the battery is discharged. I checked the cable ca and it seems ok. The laptop has a fuse internal which I need to check? If this

  • Saving printer ePrintCenter

    Hi, I just bought a HP printer which is web enabled printing, but every time I try to record to ePrintCenter, obtain the following error page: "AppEcbError: ECB request failed: error: code = description '900' ='[SF_ERR_202]: System exception: com.sna

  • Need to update for the OCR for HP c5180 software

    The OCR software that came with my HP c5180 all-in-one no longer works under Mountain Lion.  Is there a version update available?

  • I'm on windows vista, the review said that I have a file that uses disk space

    I 'm on windows vista the healthcheck says I have a file using disk space, the file name is windows.old, if I just delete this, then it will hurt my laptop, I looked at the file and there are thousands of articles, my laptop is slow, what I'm doing.