Cisco Cisco Firepower Management Center 4000

Specify a numerical value and select a time unit for the maximum SA renegotiation interval. You 
can specify a minimum of 5 minutes and a maximum of 24 hours.

Specify the number of packets that can be transmitted over an IPsec SA before it expires. You can 
use any integer between 0 and 18446744073709551615.

Specify the number of bytes that can be transmitted over an IPsec SA before it expires. You can use 
any integer between 0 and 18446744073709551615.

Select the check box to specify that the system uses the authentication header security protocol for 
the data to be protected. Clear the check box to use encryption service payload (ESP) protocol. See 

 for guidance on when to use each protocol.

Admin/Network Admin

Select 

.

The VPN page appears.

Click 

.

The Create New VPN Deployment pop-up window appears.

Click the 

 tab.

Configure the advanced settings, as described earlier in this section.

Next to 

, click the add icon (

).

The Add IKE Algorithm Proposal pop-up window appears.

Select 

, 

, and Diffie-Hellman (

) group authentication messages for both phases.

Click 

.

The IKE algorithm proposal is added.

Click 

.

Your changes are saved and the VPN page appears.

Note that you must apply the deployment for it to take effect; see 

VPN

Series 3

After configuring or making any changes to a VPN deployment, you must apply the deployment to one 
or more devices to implement the settings you designated for the deployment.