close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

proposal (Security IPsec)

date_range 05-Dec-24

arrow_backward

arrow_forward

Syntax

content_copy zoom_out_map
proposal proposal-name {
    authentication-algorithm (hmac-md5-96 | hmac-sha-256-128 | hmac-sha-256-96 | hmac-sha-384 | hmac-sha-512 | hmac-sha1-96);
    description description;
    encryption-algorithm (3des-cbc | aes-128-cbc | aes-128-gcm | aes-192-cbc | aes-192-gcm | aes-256-cbc | aes-256-gcm | chacha20-poly1305 | des-cbc);
    extended-sequence-number;
    lifetime-kilobytes kilobytes; 
    lifetime-seconds seconds;
    protocol (ah | esp);
}

Hierarchy Level

content_copy zoom_out_map
[edit security ipsec]

Description

Define an IPsec proposal. An IPsec proposal lists protocols and algorithms (security services) to be negotiated with the remote IPsec peer.

Options

proposal-name	Name of the IPsec proposal.
authentication-algorithm	Configure the IPsec authentication algorithm. Authentication algorithm is the hash algorithm that authenticates packet data. It can be one of six algorithms: Values: The hash algorithm to authenticate data can be one of the following: `hmac-md5-96`—Produces a 128-bit digest. `hmac-sha-256-128`—Provides data origin authentication and integrity protection. This version of the hmac-sha-256 authenticator produces a 256-bit digest and specifies truncation to 128 bits. `hmac-sha1-96`—Hash algorithm that authenticates packet data. It produces a 160-bit digest. Only 96 bits are used for authentication. `hmac-sha-512`—Produces a 512-bit digest. `hmac-sha-384`—Produces a 384-bit digest. `hmac-sha-256-96`—HMAC-SHA-256-96 authentication algorithm (non-RFC compliant)
description	Text description of IPsec proposal
encryption-algorithm	Define encryption algorithm. The device deletes existing IPsec SAs when you update the `encryption-algorithm` configuration in the IPsec proposal. Values: `3des-cbc`—Encryption algorithm with block size of 8 bytes (64 bits) and key size of 192 bits. `aes-128-cbc`—Advanced Encryption Standard (AES) 128-bit encryption algorithm. `aes-128-gcm`—AES Galois/Counter Mode (GCM) 128-bit encryption algorithm. For an IKE proposal, AES 128-bit authenticated encryption algorithm is supported with IKEv2 only. When this option is used, `aes-128-gcm` should be configured at the [`edit security ipsec proposal proposal-name`] hierarchy level, and the `authentication-algorithm` option should not be configured at the [`edit security ike proposal proposal-name`] hierarchy level. When `aes-128-gcm`, `aes-192-gcm`, or `aes-256-gcm` encryption algorithms are configured in the IPsec proposal, it is not mandatory to configure AES-GCM encryption algorithm in the corresponding IKE proposal. `aes-192-cbc`—AES 192-bit encryption algorithm. `aes-192-gcm`—AES GCM 192-bit encryption algorithm. `aes-256-cbc`—AES 256-bit encryption algorithm. `aes-256-gcm`—AES GCM 256-bit encryption algorithm. For an IKE proposal, AES 256-bit authenticated encryption algorithm is supported with IKEv2 only. When this option is used, `aes-256-gcm` should be configured at the [`edit security ipsec proposal proposal-name`] hierarchy level, and the `authentication-algorithm` option should not be configured at the [`edit security ike proposal proposal-name`] hierarchy level. `chacha20-poly1305`—ChaCha20-Poly1305 authenticated encryption algorithm. You can use the algorithm for data path security with Encapsulating Security Payload (ESP) for IPsec VPN. You can configure the algorithm in: PowerMode IPsec (PMI) mode on SRX1600, SRX2300, SRX4300, SRX4600, SRX5400, SRX5600, and SRX5800 Firewalls. PMI and non-PMI modes on vSRX 3.0. You can use the algorithm for IPsec when the VPN monitoring feature is not configured at `[edit security ipsec vpn vpn-name vpn-monitor]`. Note that you cannot use the algorithm on SRX1500 Firewalls. `des-cbc`—Encryption algorithm with block size of 8 bytes (64 bits) and key size 48 bits.
extended-sequence-number	Use the `extended-sequence-number` option to enable ESN support. ESN allows IPsec to use 64-bit sequence numbers for the sequence number. If ESN is not enabled, 32-bit sequence number will be used by default. Ensure ESN is not enabled when anti-replay is disabled.
lifetime-kilobytes	Specify the lifetime (in kilobytes) of an IPsec security association (SA). If this statement is not configured, the number of kilobytes used for the SA lifetime is unlimited. Range: 64000 through 4,294,967,294 kilobytes
lifetime-seconds	Lifetime in seconds. Range: 180 through 86400 Default: 3600 seconds
protocol	Define the IPsec protocol for a manual or dynamic security association (SA). Values: ah—Authentication header esp—Encapsulated Security Payload header

Required Privilege Level

security—To view this statement in the configuration.

security-control—To add this statement to the configuration.

Release Information

Statement introduced before Junos OS Release 7.4.

extended-sequence-number option introduced in Junos OS Release 19.4R1.

Starting in Junos OS Release 20.2R1, we’ve changed the help text description as NOT RECOMMENDED for the CLI options hmac-md5-96, hmac-sha1-96, 3des-cbc, and des-cbc for devices running iked process with junos-ike package installed.

hmac-sha-512 and hmac-sha-384 options introduced in Junos OS Release 19.1R1 on SRX5000 line of devices with SRX5K-SPC3 card.

Support for aes-128-gcm, aes-192-gcm, and aes-256-gcm options added in Junos OS Release 15.1X49-D70 for vSRX Virtual Firewall.

Support for aes-128-gcm, aes-192-gcm, and aes-256-gcm options added in Junos OS Release 12.1X45-D10.

Support for the hmac-sha-256-128 added to SRX5400, SRX5600, and SRX5800 devices in Junos OS Release 12.1X46-D20.

Support for the lifetime-kilobytes option with IPsec VPN running iked process added in Junos OS Release 23.4R1.

Support for the chacha20-poly1305 option added to SRX1600, SRX2300, SRX4300, SRX4600, SRX5400, SRX5600, SRX5800, and vSRX 3.0 in Junos OS Release 24.2R1.

arrow_backward PREVIOUS proposal (Security IKE Dynamic SA)

NEXT arrow_forward proposal (Services IKE)

Junos CLI Reference

ON THIS PAGE

proposal (Security IPsec)

Syntax

Hierarchy Level

Description

Options

Required Privilege Level

Release Information

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Junos CLI Reference

ON THIS PAGE

proposal (Security IPsec)

Syntax

Hierarchy Level

Description

Options

Required Privilege Level

Release Information

Related Documentation

Stay in touch