VPN Profile Properties dialog box

Use this dialog box to define the properties of a VPN Profile.

Option	Definition
General tab
Name	The name of the element.
Comment (Optional)	A comment for your own reference.
Overview section	A preview of the selections made on the other tabs is shown.

Option	Definition
IKE SA tab
Versions	Select the IKEv2 as version. IKEv2 — Internet Key Exchange version 2.
Cipher Algorithms	Select the encryption method: For Common Criteria evaluated configuration: AES-GCM-256: Advanced Encryption Standard (AES) and Galois/Counter Mode (GCM) encryption algorithm with a 256-bit key size. Recommended for high-speed networks. AES-CBC-256: Advanced Encryption Standard (AES) and Cipher Blocking Chaining (CBC) encryption algorithm with a 256-bit key size. AES-CBC-128: Advanced Encryption Standard (AES) and Cipher Blocking Chaining (CBC) encryption algorithm with a 128-bit key size. Note: When AES-CBC-128 is selected, the Security Engine also supports AES-CBC-192 when acting as the responder in the negotiation. For Commercial Solutions for Classified configuration: AES-GCM-256: Advanced Encryption Standard (AES) and Galois/Counter Mode (GCM) encryption algorithm with a 256-bit key size. Recommended for high-speed networks. AES-CBC-256: Advanced Encryption Standard (AES) and Cipher Blocking Chaining (CBC) encryption algorithm with a 256-bit key size.
Integrity / Pseudorandom Function Algorithms	Used for integrity checking and key derivation. Select SHA-2 with 256, 384 or 512 bit minimum length to enable SHA-256, SHA-384, or SHA-512 for IKE. SHA-2 — The SHA-2 set of hash function includes SHA-256, SHA-384, and SHA-512.
Key Exchange Methods	Select one or more groups for key exchange. For Common Criteria evaluated configuration: 21 (ECP 521 bits) — Diffie-Hellman key exchange with 521-bit elliptic curve. 20 (ECP 384 bits) — Diffie-Hellman key exchange with 384-bit elliptic curve. 19 (ECP 256 bits) — Diffie-Hellman key exchange with 256-bit elliptic curve. 18 (8192 bits) — Diffie-Hellman key exchange with a 8192 bit modulus. 17 (6144 bits) — Diffie-Hellman key exchange with a 6144 bit modulus. 16 (4096 bits) — Diffie-Hellman key exchange with a 4096-bit modulus. 15 (3072 bits) — Diffie-Hellman key exchange with a 3072-bit modulus. 14 (2048 bits) — Diffie-Hellman key exchange with a 2048-bit modulus. For Commercial Solutions for Classified configuration: 20 (ECP 384 bits) — Diffie-Hellman key exchange with 384-bit elliptic curve. 19 (ECP 256 bits) — Diffie-Hellman key exchange with 256-bit elliptic curve. 16 (4096 bits) — Diffie-Hellman key exchange with a 4096-bit modulus. 15 (3072 bits) — Diffie-Hellman key exchange with a 3072-bit modulus.
Authentication Method	The method that gateways in the VPN use to authenticate to each other. Note: Select RSA Signatures or ECDSA Signatures as Authentication Method to use X.509 certificates for peer authentication. For Common Criteria evaluated configuration: ECDSA Signatures — Requires that each Gateway has a valid certificate. Pre-Shared Key — Requires that you periodically change the pre-shared keys for each tunnel in the VPN elements to be secure. RSA Signatures — Requires that each Gateway has a valid certificate. For Commercial Solutions for Classified configuration: RSA Signatures — Requires that each Gateway has a valid certificate. ECDSA Signatures — Requires that each Gateway has a valid certificate. The authentication method you select here is used for site-to-site tunnels. Mobile VPNs have separate settings on the IPsec Client tab.
IKEv2 PPK	Select one of the following options for Post-quantum Pre-Shared Key (PPK): Not in use — PPK is not enabled. Enabled — PPK is enabled to use with IKEv2 protocol for the tunnel but is not mandatory. For example, if we want to establish a tunnel between Gateway A and Gateway B. Gateway A has PPK enabled and configured but Gateway B does not support PPK feature or PPK is not configured. Then the tunnel can still be established without the PPK. Mandatory — PPK is enabled and is mandatory to use with IKEv2 protocol for the tunnel to be established. For example, if we want to establish a tunnel between Gateway A and Gateway B. Gateway A has PPK enabled and configured but Gateway B does not support PPK feature or PPK is not configured. Then the tunnel cannot be established without the PPK configured on both gateways. Note: For Commercial Solutions for Classified configuration only the Mandatory option is allowed. A single PPK element is defined for the gateway-to-gateway tunnel, and the element is auto-generated if both are internal gateways.
SA Lifetime in Minutes	The time limit after which IKE SA negotiations are done again in a continuously used tunnel. This setting also defines the authentication timeout for the Forcepoint VPN Client. Change this setting only if you have a specific reason to do so. The SA lifetime must match the settings of the external gateway device. This setting affects tunnels that carry traffic continuously. Tunnels that are not used are closed after a short delay regardless of the lifetime set. Re-negotiations improve security, but might require heavy processing. The default lifetime is 1440 minutes.
Always Keep Tunnels Established	When selected, the Security Engine keeps the IPsec tunnels established even when no traffic is sent through the tunnel. When the value for the SA Lifetime in Minutes option (for IKE SA) or the value for the IPsec Tunnel Lifetime (for IPsec SA) option is exceeded, the tunnel is automatically renegotiated even if there is no traffic in the tunnel.

Option	Definition
IPsec SA tab
IPsec Type	Select one or more options to define integrity checking and data origin authentication for IP datagrams. Note: Select ESP as the IPsec Type. ESP — (Recommended) Encapsulating Security Payload. The communications are encrypted.
Cipher Algorithms	Select the tunnel encryption method. For Common Criteria evaluated configuration: AES-GCM-256: Advanced Encryption Standard (AES) and Galois/Counter Mode (GCM) encryption algorithm with a 256-bit key size. Recommended for high-speed networks. AES-GCM-128: Advanced Encryption Standard (AES) and Galois/Counter Mode (GCM) encryption algorithm with a 128-bit key size. Recommended for high-speed networks. Note: When AES-GCM-128 is selected, the Security Engine also supports AES-GCM-192 when acting as the responder in the negotiation. AES-256: Advanced Encryption Standard (AES) and Cipher Blocking Chaining (CBC) encryption algorithm with a 256-bit key size. AES-128: Advanced Encryption Standard (AES) and Cipher Blocking Chaining (CBC) encryption algorithm with a 128-bit key size. Note: When AES-128 is selected, the Security Engine also supports AES-192 when acting as the responder in the negotiation. For Commercial Solutions for Classified configuration: AES-GCM-256: Advanced Encryption Standard (AES) and Galois/Counter Mode (GCM) encryption algorithm with a 256-bit key size. Recommended for high-speed networks. AES-256: Advanced Encryption Standard (AES) and Cipher Blocking Chaining (CBC) encryption algorithm with a 256-bit key size.
Integrity Algorithms	Select the cryptographic method: For Common Criteria evaluated configuration, SHA-1 or SHA-2 with a minimum length of 256 bit is supported. For Commercial Solutions for Classified configuration, SHA-2 with a minimum length of 384 bit is supported.
Compression Algorithm	Options for compressing the data in the tunnel to reduce the bandwidth use on congested links. None — (Recommended for most environments) Sends the data without compressing it. Provides better performance when bandwidth congestion for tunneled traffic is not a constant issue or if there is significant processor load. Deflate — Compresses the data. This compression requires processing and memory resources, which increases latency. Latency might also increase for non-tunneled traffic. Do not select this option if the resource utilization is high. Gateways at both ends of each tunnel involved must support the option.
IPsec Tunnel Lifetime (Optional)	Limits after which IPsec SA negotiations are done again in a continuously used tunnel. Reaching either the time or data amount limits triggers new IPsec SA negotiations, which must happen at regular intervals to guarantee security. This setting affects tunnels that carry traffic continuously. Tunnels that are not used are closed after a short delay regardless of the lifetime set here. IPsec SA negotiations are lighter on the processor than IKE SA negotiations, but still require some processing. Too frequent renegotiations can reduce performance down to unacceptable levels. Note: There is a separate setting for the SA Lifetime on the IKE SA tab. The SA Lifetime must be longer than the IPsec Tunnel Lifetime. The default is 480 minutes with no limit on the amount of transferred data. The lowest limit that can be configured for the amount of data is 40000 KB.
Use PFS (Optional)	Enables the Perfect Forward Secrecy (PFS) feature. Note: When the PFS feature is enabled. By default, the Same as in IKE option is selected for the PFS Key Exchange Method.
PFS Key Exchange Method	Select the default value Same as in IKE. Note: By default, the Same as in IKE option is selected. This means the option enforces selection of the same Diffie-Hellman group for PFS that was selected for the IKE SA key exchange. If an option other than the Same as in IKE option is selected, an error message that states "Explicit PFS Key Exchange Method selection will be deprecated in a future version. Change selection to ‘Same as in IKE’ in Profile configuration." is displayed during the policy upload. When you use this option, the gateways calculate new values for key negotiations when renegotiating the SAs instead of deriving the values from previously negotiated keying material. This setting increases security if a key is compromised.
Disable Anti Replay Window (Optional)	The anti-replay window feature provides protection against attacks in which packets are replayed. When enabled, the gateway keeps track of the sequence numbers of the arriving packets, and discards any packet whose number matches the number of a packet that has already arrived. It is usually recommended to leave the anti-replay window enabled. However, if QoS is applied to ESP/AH traffic, some of the ESP packets (for the same SA) might be delayed due to the classification and arrive at the destination so late that the anti-replay window has moved too far. This behavior causes the packets to be dropped. In this case, it might be necessary to disable the anti-replay window.
Disable Path MTU Discovery (Optional)	Prevents the gateway from sending ICMP "Fragmentation needed" messages to the originator when the packet size (including the headers added for IPsec) exceeds the Ethernet-standard 1500 bytes. If this option is selected, packets might be fragmented for transport across the tunnel and reassembled at the receiving gateway. Selecting the option might be necessary if ICMP messages do not reach the other gateway or the other gateway does not react to them correctly.

Option	Definition
IPsec Client tab If a VPN Profile that contains IPsec client settings is used in a route-based tunnel, the IPsec Client settings are ignored.
Authentication Method	Enables certificate-based authentication. This option is always used for the Gateway certificates for the Gateways involved in mobile VPNs, and if certificate authentication is used, also for the client. Certificate authentication does not need separate activation. However, you must configure the issuing authority separately as trusted and you must create certificates for the VPN clients in a manual process. Note: Select RSA Signatures or ECDSA Signatures as Authentication Method in IKE Authentication to use X.509 certificates for client and gateway authentication. RSA Signatures — Requires that each Gateway has a valid certificate. ECDSA Signatures — Requires that each Gateway has a valid certificate.
Allow Hybrid / EAP Authentication (Optional) (Forcepoint VPN Client only)	Allows users of the Forcepoint VPN Client to authenticate by filling in a user name and password or a similar authentication scheme provided by an external authentication server. The gateway still authenticates itself to the VPN clients using a certificate.
Allow CN Authentication (Optional) (Certificate authentication only)	Allows using the common name (CN) of the certificates for authentication. The CN is checked against a value entered in User elements.
Allow Pre-Shared Key Authentication with IKEv1 (Optional)	Select this option if you have third-party VPN clients that use a pre-shared key for authenticating the VPN clients and the gateway. The pre-shared key is defined in the properties of User elements that have Pre-Shared Key Method as an authentication method. The Forcepoint VPN Client does not support this method. CAUTION: The pre-shared key option requires aggressive mode IKE negotiations in the mobile VPN. In aggressive mode, user information is not protected, so we recommend that you take precautions, such as not using the same user name for the users as they have when they access other services in your internal network.
IPsec Security Association Granularity for Tunnel Mode	Defines the level at which security associations (SA) are created in Tunnel Mode. The Forcepoint VPN Client supports only SA per Net. SA per Net — Creates a security association (SA) for each network from which connections are made through the tunnel. This setting reduces the overhead when there are many hosts making connections through the tunnel. Allow SA to Any Network — (Valid only for third-party IPsec VPN Clients) Select this option together with SA per Net to support both the Forcepoint VPN Client and any third-party VPN clients that only support SAs negotiated per Host. SA per Host — Creates an SA for each host that makes connections through the tunnel. This setting might provide more even load balancing in clusters than the per net setting, but increases the overhead, because per host usually requires more SAs to be negotiated. Note: SA per Host is valid only for 3rd Party IPsec VPN Clients.

Option	Definition
Certificate Authorities tab
Trust only selected	The gateway trusts only the certificate authorities that you select in the table. You can also restrict trusted CAs in VPN Gateway and External VPN Gateway elements. If you restrict trusted CAs in both the gateway and the VPN Profile, make sure that any two gateways that form a VPN tunnel trust the same CA after all defined restrictions are applied.