Diffe-hellman groups

[pravin7646]

I'm wondering what encryption, authentication, and DH groups you typically use in this space for Phase 1 and Phase 2 of IPsec. Do you use just one group, two, or three?

I use AES-256 - SHA-256, DH 14 and 27. How does it look on your side?

Of course, on each device, I have a whitelist for my hub in the local-in policy, but I'm referring specifically to the IPsec configuration itself

[owen911]

Hi !
i think there are no right or wrong answer.
It will depend on the environment, equipment's and usage.
Higher encryption strength = More CPU usage = Lower throughput
Larger DH groups = Slower VPN tunnel establishment.

[Toshi_Esumi]

For PCI-DSS, anything below AES256-SHA256 are not considered as safe. DH14 is 2048-bit modular exponential (MODP), which we avoid. So we use DH19 256-bit elliptic curve modulo a prime (ECP), lowest of elliptic curve types.
If you know/have control of both sides of the tunnel, you don't have to announce multiple capabilities. Only in case of dialup, random devices would dial in, you might need to set multiple so that the device can find a matching capability.

Toshi