0
$\begingroup$

I am developing internal standards for IPsec VPN setup on SonicWall firewalls, and I have been learning about IKEv2. When IKEv2 "mode" is selected, the UI disables the DH Group, Encryption, and Authentication fields, and I can't find what values are used, anywhere in the documentation. Does IKEv2 have some mechanism by which it negotiates those fields to the "highest common denominator"? If not, I'll just call tech support on Monday.

$\endgroup$
0
$\begingroup$

Does IKEv2 have some mechanism by which it negotiates those fields to the "highest common denominator"?

Well, IKEv2 allows the initiator to list what DH Groups, Encryption algorithms and Authentication algorithms (among others), and in what combinations; the responder then selects from that list what will be used. It's actually pretty flexible (except for DH group; that's a bit kludgy, as the initiator has to select a 'main one', and if the responder doesn't like it, it needs to list what DH group it really wants, and we take another round trip with that group).

Now, the initiator lists things in preference order (e.g. the encryption algorithm it would prefer is listed first), and the responder is supposed to respect that order. There's no built in logic within the IKE protocol itself that says, for example, AES-GCM is better (or worse) then ChaCha20; that's something for the initiator to decide.

When IKEv2 "mode" is selected, the UI disables the DH Group, Encryption, and Authentication fields, and I can't find what values are used, anywhere in the documentation.

This is definitely something that ought to be both changeable and documented; if would appear unlikely that you could come up with a single policy that would make everyone happy.

$\endgroup$
0
$\begingroup$

Are you using 6.2? If so, take a look at How to setup Site to Site VPN with IKE2 Dynamic Client Proposal in SonicOS 6.2 and above

Note: The menu "DH Group", "Encryption" and "Authentication" will be gray-out since "IPsec Primary Gateway Name or Address" in General tab is filled in "0.0.0.0" or leaved blank. And they will be configured in step 3.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.