proposal (Security IPsec)

Name of the IPsec proposal.

Configure the IPsec authentication algorithm. Authentication algorithm is the hash algorithm that authenticates packet data. It can be one of six algorithms:

• Values:

  The hash algorithm to authenticate data can be one of the following:

  • hmac-md5-96—Produces a 128-bit digest.

  • hmac-sha-256-128—Provides data origin authentication and integrity protection. This version of the hmac-sha-256 authenticator produces a 256-bit digest and specifies truncation to 128 bits.

  • hmac-sha1-96—Hash algorithm that authenticates packet data. It produces a 160-bit digest. Only 96 bits are used for authentication.

  • hmac-sha-512—Produces a 512-bit digest.

  • hmac-sha-384—Produces a 384-bit digest.

  • hmac-sha-256-96—HMAC-SHA-256-96 authentication algorithm (non-RFC compliant)

Text description of IPsec proposal

Define encryption algorithm. The device deletes existing IPsec SAs when you update the encryption-algorithm configuration in the IPsec proposal.

• Values:

  • 3des-cbc—Encryption algorithm with block size of 8 bytes (64 bits) and key size of 192 bits.

  • aes-128-cbc—Advanced Encryption Standard (AES) 128-bit encryption algorithm.

  • aes-128-gcm—AES Galois/Counter Mode (GCM) 128-bit encryption algorithm.

    For an IKE proposal, AES 128-bit authenticated encryption algorithm is supported with IKEv2 only. When this option is used, aes-128-gcm should be configured at the [edit security ipsec proposal proposal-name] hierarchy level, and the authentication-algorithm option should not be configured at the [edit security ike proposal proposal-name] hierarchy level.

    When aes-128-gcm, aes-192-gcm, or aes-256-gcm encryption algorithms are configured in the IPsec proposal, it is not mandatory to configure AES-GCM encryption algorithm in the corresponding IKE proposal.

  • aes-192-cbc—AES 192-bit encryption algorithm.

  • aes-192-gcm—AES GCM 192-bit encryption algorithm.

  • aes-256-cbc—AES 256-bit encryption algorithm.

  • aes-256-gcm—AES GCM 256-bit encryption algorithm.

    For an IKE proposal, AES 256-bit authenticated encryption algorithm is supported with IKEv2 only. When this option is used, aes-256-gcm should be configured at the [edit security ipsec proposal proposal-name] hierarchy level, and the authentication-algorithm option should not be configured at the [edit security ike proposal proposal-name] hierarchy level.

  • chacha20-poly1305—ChaCha20-Poly1305 authenticated encryption algorithm.

    You can use the algorithm for data path security with Encapsulating Security Payload (ESP) for IPsec VPN. You can configure the algorithm in:

    • PowerMode IPsec (PMI) mode on SRX1600, SRX2300, SRX4300, SRX4600, SRX5400, SRX5600, and SRX5800 Firewalls.

    • PMI and non-PMI modes on vSRX 3.0.

    You can use the algorithm for IPsec when the VPN monitoring feature is not configured at [edit security ipsec vpn vpn-name vpn-monitor].

    Note that you cannot use the algorithm on SRX1500 Firewalls.

  • des-cbc—Encryption algorithm with block size of 8 bytes (64 bits) and key size 48 bits.

Use the extended-sequence-number option to enable ESN support. ESN allows IPsec to use 64-bit sequence numbers for the sequence number. If ESN is not enabled, 32-bit sequence number will be used by default. Ensure ESN is not enabled when anti-replay is disabled.

Specify the lifetime (in kilobytes) of an IPsec security association (SA). If this statement is not configured, the number of kilobytes used for the SA lifetime is unlimited.

• Range: 64000 through 4,294,967,294 kilobytes

Lifetime in seconds.

• Range: 180 through 86400

• Default: 3600 seconds

Define the IPsec protocol for a manual or dynamic security association (SA).

• Values:

  • ah—Authentication header

  • esp—Encapsulated Security Payload header