The IPSec crypto profile is invoked in IKE
Phase 2. It specifies how the data is secured within the
tunnel when Auto Key IKE is used to automatically generate keys
for the IKE SAs.
Create a new IPSec profile.
Select NetworkNetwork ProfilesIPSec Crypto and select Add.
Enter a Name for the new profile.
Select the IPSec Protocol—ESP
or AH—that you want to apply to secure the data as it traverses
across the tunnel.
As a best practice, select ESP
(Encapsulating Security payload) over AH (Authentication Header)
because ESP offers both confidentiality and authentication for the
connection whereas AH offers only authentication.
Click Add and select the Authentication and Encryption algorithms
for ESP, and Authentication algorithms for
AH, so that the IKE peers can negotiate the keys for the secure
transfer of data across the tunnel.
If you are not certain of what the IKE peers support, add
multiple algorithms in the order of most-to-least secure as follows;
the peers negotiate the strongest supported algorithm to establish
the tunnel:
Encryption—aes-256-gcm, aes-256-cbc, aes-192-cbc, aes-128-gcm, aes-128-ccm (the
VM-Series firewall doesn’t support this option), aes-128-cbc, 3des, des.
As a best practice, choose the strongest authentication
and encryption algorithms the peer can support. For the authentication
algorithm, use SHA-256 or higher (SHA-384 or higher preferred for
long-lived transactions). Do not use SHA-1, MD5 or none. For the
encryption algorithm, use AES; DES and 3DES are weak and vulnerable.
Authentication—sha512, sha384, sha256, sha1, md5.
Select the DH Group to use for the IPSec SA negotiations
in IKE phase 2.
From DH Group, select the key strength
you want to use: group1, group2, group5, group14, group19,
or group20. For highest security, choose
the group with the highest number.
If you don’t want to renew
the key that the firewall creates during IKE phase 1, select no-pfs (no
perfect forward secrecy); the firewall reuses the current key for
the IPSec security association (SA) negotiations.
Specify the duration of the key—time and volume of traffic.
Using a combination of time and traffic volume allows you
to ensure safety of data.
Select the Lifetime or
time period for which the key is valid in seconds, minutes, hours,
or days (range is 3 minutes to 365 days). When the specified time
expires, the firewall will renegotiate a new set of keys.
Select
the Lifesize or volume of data after which
the keys must be renegotiated.
Commit your IPSec profile.
Click OK and click Commit.
Attach the IPSec Profile to an IPSec tunnel configuration.
