SonicOS 7.1 IPSec VPN

Configuring IKEv2 Settings

IKEv2 Settings affect IKE notifications and allow you to configure dynamic client support.

  • Send IKEv2 Cookie Notify – Sends cookies to IKEv2 peers as an authentication tool.
  • Send IKEv2 Invalid SPI Notify – Sends an invalid Security Parameter Index (SPI) notification to IKEv2 peers when an active IKE security association (SA) exists. This option is selected by default.
  • IKEv2 Dynamic Client ProposalSonicOS provides IKEv2 Dynamic Client Support, which provides a way to configure the Internet Key Exchange (IKE) attributes rather than using the default settings.

    Clicking Configure launches the Configure IKEv2 Dynamic Client Proposal dialog.

    SonicOS supports these IKE Proposal settings:

    • DH Group: Group 1, Group 2 (default), Group 5, Group 14, and the following five Diffie-Hellman groups that are included in Suite B cryptography:
      • 256-bit Random ECP Group
      • 384-bit Random ECP Group
      • 521-bit Random ECP Group
      • 192-bit Random ECP Group
      • 224-bit Random ECP Group
    • Encryption DES, 3DES (default), AES-128, AES-192, AES-256
    • Authentication– MD5, SHA1 (default), SHA256, SHA384, or SHA512

    If a VPN Policy with IKEv2 exchange mode and a 0.0.0.0 IPSec gateway is defined, however, you cannot configure these IKE Proposal settings on an individual policy basis.

    The VPN policy on the remote gateway must also be configured with the same settings.

Was This Article Helpful?

Help us to improve our support portal

Techdocs Article Helpful form

  • Hidden
  • Hidden

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.
  • Hidden
  • Hidden