Define Cryptographic Profiles
A cryptographic profile specifies the ciphers used for authentication and/or encryption between two IKE peers, and the lifetime of the key. The time period between each renegotiation is known as the lifetime; when the specified time expires, the firewall renegotiates a new set of keys.
For securing communication across the VPN tunnel, the firewall requires IKE and IPSec cryptographic profiles for completing IKE phase 1 and phase 2 negotiations, respectively. The firewall includes a default IKE crypto profile and a default IPSec crypto profile that are ready for use.
Define IKE Crypto Profiles
The IKE crypto profile is used to set up the encryption and authentication algorithms used for the key exchange process in IKE Phase 1, and lifetime of the keys, which specifies how long the keys are valid. To invoke the profile, you must attach it to the IKE Gateway configuration.
All IKE gateways configured on the same interface or local IP address must use the same crypto profile.
Define an IKE Crypto Profile
Create a new IKE profile. Select Network > Network Profiles > IKE Crypto and select Add. Enter a Name for the new profile.
Specify the DH Group (Diffie–Hellman group) for key exchange, and the Authentication and Encryption algorithms. Click Add in the corresponding sections (DH Group, Authentication, and Encryption) and select from the drop-downs. If you are not certain of what the VPN peers support, add multiple groups or algorithms in the order of most-to-least secure as follows; the peers negotiate the strongest supported group or algorithm to establish the tunnel: DH Group— group20, group19, group14, group5, group2, and group1. Authentication— sha512, sha384, sha256, sha1, md5. Encryption— aes-256-cbc, aes-192-cbc, aes-128-cbc, 3des, des. DES is available to provide backward compatibility with legacy devices that do not support stronger encryption, but as a best practice always use a stronger encryption algorithm, such as 3DES or AES if the peer can support it.
Specify the duration for which the key is valid and the re-authentication interval. For details, see SA Key Lifetime and Re-Authentication Interval. In the Key Lifetime fields, specify the period (in seconds, minutes, hours, or days) for which the key is valid. (Range is 3 minutes to 365 days; default is 8 hours.) When the key expires, the firewall renegotiates a new key. A lifetime is the period between each renegotiation. For the IKEv2 Authentication Multiple, specify a value (range is 0-50) that is multiplied by the Key Lifetime to determine the authentication count. The default value of 0 disables the re-authentication feature.
Save your IKE Crypto profile. Click OK and click Commit.
Attach the IKE Crypto profile to the IKE Gateway configuration. See Configure advanced options for the gateway.
Define IPSec Crypto Profiles
The IPSec crypto profile is invoked in IKE Phase 2. It specifies how the data is secured within the tunnel when Auto Key IKE is used to automatically generate keys for the IKE SAs.
Define the IPSec Crypto Profile
Create a new IPSec profile. Select Network > Network Profiles > IPSec Crypto and select Add. Enter a Name for the new profile. Select the IPSec Protocol —ESP or AH—that you want to apply to secure the data as it traverses across the tunnel. Click Add and select the Authentication and Encryption algorithms for ESP, and Authentication algorithms for AH, so that the IKE peers can negotiate the keys for the secure transfer of data across the tunnel. If you are not certain of what the IKE peers support, add multiple algorithms in the order of most-to-least secure as follows; the peers negotiate the strongest supported algorithm to establish the tunnel: Encryption— aes-256-gcm, aes-256-cbc, aes-192-cbc, aes-128-gcm, aes-128-ccm (the VM-Series firewall doesn’t support this option), aes-128-cbc, 3des, des. DES is available to provide backward compatibility with legacy devices that do not support stronger encryption, but as a best practice always use a stronger encryption algorithm, such as 3DES or AES if the peer can support it. Authentication— sha512, sha384, sha256, sha1, md5.
Select the DH Group to use for the IPSec SA negotiations in IKE phase 2. Select the key strength that you want to use from the DH Group drop-down. If you are not certain of what the VPN peers support, add multiple groups in the order of most-to-least secure as follows; the peers negotiate the strongest supported group to establish the tunnel: group20, group19, group14, group5, group2, and group1. Select no-pfs if you do not want to renew the key that was created at phase 1; the current key is reused for the IPSEC SA negotiations.
Specify the duration of the key—time and volume of traffic. Using a combination of time and traffic volume allows you to ensure safety of data. Select the Lifetime or time period for which the key is valid in seconds, minutes, hours, or days (range is 3 minutes to 365 days). When the specified time expires, the firewall will renegotiate a new set of keys. Select the Lifesize or volume of data after which the keys must be renegotiated.
Save your IPSec profile. Click OK and click Commit.
Attach the IPSec Profile to an IPSec tunnel configuration. See Set up key exchange.

Related Documentation