policy (Security IPsec)

Name of the IPsec policy.

Enter descriptive text for an IPsec policy.

Specify Perfect Forward Secrecy (PFS) as the method that the device uses to generate the encryption key. PFS generates each new encryption key independently from the previous key. The device deletes existing IPsec SAs when you update the perfect-forward-secrecy configuration in the IPsec policy.

• Values:

  • group1—768-bit Modular Exponential (MODP) algorithm.

  • group2—1024-bit MODP algorithm.

  • group5—1536-bit MODP algorithm.

  • group14—2048-bit MODP group.

  • group15—3072-bit MODP algorithm.

  • group16—4096-bit MODP algorithm.

  • group19—256-bit random Elliptic Curve Groups modulo a Prime (ECP groups) algorithm.

  • group20—384-bit random ECP groups algorithm.

  • group21—521-bit random ECP groups algorithm.

  • group24—2048-bit MODP Group with 256-bit prime order subgroup.

Define a set of default IPsec proposals.

• Values:

  • basic—IPsec basic proposal set. esp-des-sha and esp-des-md5.

    • Encapsulating Security Payload (ESP) protocol

    • Encryption algorithm—DES-CBC encryption algorithm

    • Authentication algorithm—SHA1 or MD5 authentication algorithm

  • compatible—IPsec compatible proposal set. esp-3des-sha, esp-3des-md5, esp-des-sha, and esp-des-md5.

    • ESP protocol

    • Encryption algorithm—3DES-CBC or DES-CBC encryption algorithm

    • Authentication algorithm—SHA1 or MD5 authentication algorithm

  • prime-128—Provides the following proposal set:

    • Encapsulating Security Payload (ESP) protocol

    • Encryption algorithm—Advanced Encryption Standard Galois/Counter mode (AES-GCM)128-bit

    • Authentication algorithm—None (AES-GCM provides both encryption and authentication)

    This option is not supported on Group VPNv2.

  • prime-256—Provides the following proposal set:

    • ESP protocol

    • Encryption algorithm—AES-GCM 256-bit

    • Authentication algorithm—None (AES-GCM provides both encryption and authentication)

    This option is not supported on Group VPNv2.

  • standard—esp-3des-sha and esp-aes128-sha

    • ESP protocol

    • Encryption algorithm—3DES-CBC or AES-CBC 128-bit encryption algorithm

    • Authentication algorithm—SHA1 authentication algorithm

  • suiteb-gcm-128—Provides the following proposal set:

    • ESP protocol

    • Encryption algorithm—AES-GCM 128-bit

    • Authentication algorithm—None (AES-GCM provides both encryption and authentication)

    This option is not supported on Group VPNv2.

  • suiteb-gcm-256—Provides the following proposal set:

    • ESP protocol

    • Encryption algorithm—AES-GCM 256-bit

    • Authentication algorithm—None (AES-GCM provides both encryption and authentication)

    This option is not supported on Group VPNv2.

Specify up to four Phase 2 proposals for an IPsec policy. If you include multiple proposals, use the same Diffie-Hellman group in all of the proposals.

Proposals are evaluated in the order they appear on the list, from top down, so specify the highest priority first, followed by the next highest priority, and so on.