End-of-Life (EoL)

Define IPSec Crypto Profiles

The IPSec crypto profile is invoked in IKE Phase 2. It specifies how the data is secured within the tunnel when Auto Key IKE is used to automatically generate keys for the IKE SAs.
  1. Create a new IPSec profile.
    1. Select
      Network
      Network Profiles
      IPSec Crypto
      and select
      Add
      .
    2. Enter a
      Name
      for the new profile.
    3. Select the
      IPSec Protocol
      —ESP or AH—that you want to apply to secure the data as it traverses across the tunnel.
    4. Click
      Add
      and select the
      Authentication
      and
      Encryption
      algorithms for ESP, and
      Authentication
      algorithms for AH, so that the IKE peers can negotiate the keys for the secure transfer of data across the tunnel.
      If you are not certain of what the IKE peers support, add multiple algorithms in the order of most-to-least secure as follows; the peers negotiate the strongest supported algorithm to establish the tunnel:
      • Encryption—
        aes-256-gcm
        ,
        aes-256-cbc
        ,
        aes-192-cbc
        ,
        aes-128-gcm
        ,
        aes-128-ccm
        (the VM-Series firewall doesn’t support this option),
        aes-128-cbc
        ,
        3des
        ,
        des
        .
      DES is available to provide backward compatibility with legacy devices that do not support stronger encryption, but as a best practice always use a stronger encryption algorithm, such as 3DES or AES if the peer can support it.
      • Authentication—
        sha512
        ,
        sha384
        ,
        sha256
        ,
        sha1
        ,
        md5
        .
  2. Select the DH Group to use for the IPSec SA negotiations in IKE phase 2.
    Select the key strength that you want to use from the
    DH Group
    drop-down:
    group1
    ,
    group2
    ,
    group5
    ,
    group14
    ,
    group19
    , or
    group20
    . For highest security, choose the group with the highest number.
    If you don’t want to renew the key that the firewall creates during IKE phase 1, select
    no-pfs
    (no perfect forward secrecy); the firewall reuses the current key for the IPSec security association (SA) negotiations.
  3. Specify the duration of the key—time and volume of traffic.
    Using a combination of time and traffic volume allows you to ensure safety of data.
    Select the
    Lifetime
    or time period for which the key is valid in seconds, minutes, hours, or days (range is 3 minutes to 365 days). When the specified time expires, the firewall will renegotiate a new set of keys.
    Select the
    Lifesize
    or volume of data after which the keys must be renegotiated.
  4. Save your IPSec profile.
    Click
    OK
    and click
    Commit
    .
  5. Attach the IPSec Profile to an IPSec tunnel configuration.
    See 5

Recommended For You