Diffe-hellman groups

2 replies
1267 views
Translate All

I'm wondering what encryption, authentication, and DH groups you typically use in this space for Phase 1 and Phase 2 of IPsec. Do you use just one group, two, or three?

I use AES-256 - SHA-256, DH 14 and 27. How does it look on your side?

Of course, on each device, I have a whitelist for my hub in the local-in policy, but I'm referring specifically to the IPsec configuration itself

FortiGate

owen911

Visitor III

Hi !
i think there are no right or wrong answer.
It will depend on the environment, equipment's and usage.
Higher encryption strength = More CPU usage = Lower throughput
Larger DH groups = Slower VPN tunnel establishment.

Translate

Toshi_Esumi

SuperUser

For PCI-DSS, anything below AES256-SHA256 are not considered as safe. DH14 is 2048-bit modular exponential (MODP), which we avoid. So we use DH19 256-bit elliptic curve modulo a prime (ECP), lowest of elliptic curve types.
If you know/have control of both sides of the tunnel, you don't have to announce multiple capabilities. Only in case of dialup, random devices would dial in, you might need to set multiple so that the device can find a matching capability.

Toshi

Translate

Sign up

Login with SSO

Login to the community

Login with SSO