Enable the Perfect Forward Secrecy option.In the left pane, select Advanced > Crypto Maps.Remain in the IPsec Site-to-Site Connection Profile dialog and proceed to Step 3.Tip: The PSK must be at least eight characters and cannot use special characters. Enter the Pre-shared Key, which is the string used to secure the encrypted tunnel between the router andВ the Web Security Service.For Trans-Proxy deployments, refer to About Trans-Proxy (Explicit Proxy Over IPsec) for options.For stand-alone deployments, select any.The Protected Networks: Remote Network setting depends on the Access Method:.For the Protected Networks: Local Network option, select inside-network.For the Interfaceoption, select outside.The Connection Name (selected by default) automatically fills Select the Peer IP Address: Static option and enter the regional Web Security Service primary IP addressДЇor this location (refer to your planning sheet).Configure the IPsec site-to-site connection profile.The device displays the Add IPsec Site-to-Site In the Connection Profiles area, click Add.Step 1-Create a site-to-site connection profile. Verify the list has one interface is required for the outside (Web Security Service) connection and as many availableВ interfaces for inside routes (see planning sheet).

Select the Configuration > Interfaces > Switch Ports tab.This procedure assumes that the Cisco ASA device is already configured with the inside interface or group object withВ multiple inside interfaces and an outside interface that will communicate with the Web Security Service. Prerequisite-Verify that the router is ready for configuration. The screenshots in the following procedure might not reflect thisВ advisory. If the current setting is lessВ than four hours, you can leave that value. Note : Symantec has seen outages occur if the Phase 2 TimeoutВ value is set to longer than four (4) hours. The best practice is to set the rekey at the specified lifetime interval instead of for lifebytes.After successful testing, you thenВ add production subnets. You can create a designated host or subnet that tests the IPsec connectivity to the WebВ Security Service without interrupting the production traffic.Do not send Auth Connector traffic to the Web Security Service.The device must have an external routable IP address.Depending on your geographical location, you must createВ at least two VPN gateways. The most basic concept for this method is configure the router with a site-to-site VPNВ connection and configure the device policy rules to send web-based traffic to the Web SecurityВ Service and ignore everything else.There are few examples mentioned in below links including CISCO ASA. Selectors for all IP protocols, all ports, between the two networks, using IPv4 subnetsД®nsure that algorithm and Phase1 & Phase 2 settings are correct on both the sides.SA lifetime of 3600 seconds (one hour) with no kbytes rekeying.The IKE Phase 2 parameters supported by NSX Edge are: IKE Phase 2 negotiates an IPSec tunnel by creating keying material for the IPSec tunnel to use (either by using the IKE phase one keys as a base or by performing a new key exchange). SA lifetime of 28800 seconds (eight hours) with no kbytes rekeying.The Phase 1 parameters used by NSX Edge are: Phase 1 sets up mutual authentication of the peers, negotiates cryptographic parameters, and creates session keys. Below mentioned are the algorithm that is supported

Ipsecuritas cisco asa