Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member


I have strange problem with vpn client 3.5.2 when connecting to PIX 6.0

when I use pre-share auth I can use DES encription. When I configure client to use MS certificate DES policy is not sent via IKE but only 3DES and PIX does not find a match. MS guys say that there certificate services have nothing to do with it and that client certificate does not contain any info about encryption level. Is there any way to solve it rather then updating PIX to use 3DES. DES would be more then enough for me.

New Member

Re: DES vs 3DES

Please check whether you have any IKE proposals defined for DES/MD5 or SHA / Digital Certificate combination in PIX.

If you post the relevant configuration, it would be easy to provide a correct response.

New Member

Re: DES vs 3DES

Sure I have. Config is here. Could it be because of "ca identity abcd " is pointing to local address? I think it is needed only to PIX not to vpn client. IKE is suddenly interupted during negotiation. Detailed debug info can be viewed at

I can't post it right here because it is too big.

sysopt connection permit-ipsec

no sysopt route dnat

crypto ipsec transform-set myset esp-des esp-md5-hmac

crypto dynamic-map dymap 10 set transform-set myset

crypto map mymap 10 ipsec-isakmp dynamic dymap

crypto map mymap client configuration address initiate

crypto map mymap interface outside

isakmp enable outside

isakmp policy 10 authentication rsa-sig

isakmp policy 10 encryption des

isakmp policy 10 hash md5

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption des

isakmp policy 20 hash md5

isakmp policy 20 group 2

isakmp policy 20 lifetime 86400

vpngroup vpn3 address-pool ippool

vpngroup vpn3 dns-server

vpngroup vpn3 default-domain

vpngroup vpn3 split-tunnel aclipsec

vpngroup vpn3 idle-time 1800

vpngroup vpn3 password ********

ca identity abcd

ca configure abcd ra 1 20 crloptional

Re: DES vs 3DES


I also had the problem. It seems, that when you use Digital Certificates

w/ your client, the client do not offer any DES proposal. On my own, I only used

the client w/ pre-shared and solved (my ) the problem.

But, as you now, it does not scale well.