Example VPN configuration 2: create a VPN Profile element

(Optional)

• IKEv1 — Internet Key Exchange version 1.
• IKEv2 — Internet Key Exchange version 2.

We recommend that you limit the selection if possible, preferably using only one. If you select several options, multiple proposals are sent in IKE negotiations.

• AES-128 — Advanced Encryption Standard cipher algorithm with a 128-bit key size.
• AES-256 — Advanced Encryption Standard algorithm with a 256-bit key size.
• DES — Data Encryption Standard algorithm. Do not select this option unless you are required to do so. DES is no longer considered secure because it is relatively easy to break DES encryption with modern computers.
• Blowfish — Blowfish cipher algorithm.
• 3DES — Triple DES algorithm. Applies the DES cipher algorithm three times to each data block. This option has a high overhead compared to other protocols with a comparable level of security. It is not a good choice when high throughput is required.

• SHA-1 — The SHA-1 hash function.
• SHA-2 — The SHA-2 hash function. Define the minimum length according to the security requirements for the VPN.
• MD5 — The MD5 message-digest algorithm.

• 1 (768 bits) — Diffie-Hellman key exchange with a 768-bit modulus.
• 2 (1024 bits) — Diffie-Hellman key exchange with a 1024-bit modulus.
• 5 (1536 bits) — Diffie-Hellman key exchange with a 1536-bit modulus.
• 14 (2048 bits) — Diffie-Hellman key exchange with a 2048-bit modulus.
• 15 (3072 bits) — Diffie-Hellman key exchange with a 3072-bit modulus.
• 16 (4096 bits) — Diffie-Hellman key exchange with a 4096-bit modulus.
• 17 (6144 bits) — Diffie-Hellman key exchange with a 6144-bit modulus.
• 18 (8192 bits) — Diffie-Hellman key exchange with a 8192-bit modulus.
• 19 (ECP 256 bits) — Diffie-Hellman key exchange with 256-bit elliptic curve.
• 20 (ECP 384 bits) — Diffie-Hellman key exchange with 384-bit elliptic curve.
• 21 (ECP 521 bits) — Diffie-Hellman key exchange with 521-bit elliptic curve.

• Pre-Shared Key — Requires that you periodically change the pre-shared keys for each tunnel in the VPN elements to be secure.
• RSA Signatures — Requires that each Gateway has a valid certificate.
• DSS Signatures — Requires that each Gateway has a valid certificate.
• ECDSA Signatures — Requires that each Gateway has a valid certificate.

The time limit after which IKE SA negotiations are done again in a continuously used VPN. This setting also defines the authentication timeout for the Forcepoint VPN Client.

Change this setting only if you have a specific reason to do so. The SA lifetime must match the settings of the external gateway device.

This setting affects tunnels that carry traffic continuously. Tunnels that are not used are closed after a short delay regardless of the lifetime set. Renegotiations improve security, but might require heavy processing. The default lifetime is 1440 minutes.

• Main — Main negotiation mode (recommended) protects the identity information of the Gateways so that malicious parties cannot gain information about the Gateway's identity by launching IKE negotiations with the gateway.
• Aggressive — Aggressive negotiation mode skips some steps that are included in the main mode, resulting in quicker negotiations. For security reasons, we recommend that you do not use the aggressive negotiation mode if you use pre-shared keys for authentication.

  Select Aggressive mode for VPNs that involve a gateway with a dynamic IP address. In this case, we recommend that you use certificates for authentication rather than pre-shared keys.

• ESP — (Recommended) Encapsulating Security Payload. The communications are encrypted.
• AH — Authentication Header. Usually, AH alone is not a valid option. The AH setting disables encryption for the VPN, fully exposing all traffic that uses the VPN to anyone who intercepts it in transit. You can use AH to authenticate and check the integrity of communications without encrypting them.

• AES-128 — Advanced Encryption Standard cipher algorithm with a 128-bit key size.
• AES-256 — Advanced Encryption Standard algorithm with a 256-bit key size.
• AES-GCM-128 — Advanced Encryption Standard Galois/Counter Mode encryption algorithm with a 128-bit key size. Recommended for high-speed networks.
• AES-GCM-256 — Advanced Encryption Standard Galois/Counter Mode encryption algorithm with a 256-bit key size. Recommended for high-speed networks.
• DES — Data Encryption Standard algorithm. Do not select this option unless you are required to do so. DES is no longer considered secure because it is relatively easy to break DES encryption with modern computers.
• Blowfish — Blowfish cipher algorithm.
• 3DES — Triple DES algorithm. Applies the DES cipher algorithm three times to each data block. This option has a high overhead compared to other protocols with a comparable level of security. It is not a good choice when high throughput is required.
• Null — Do not select this option unless you want to disable encryption. This option fully exposes all traffic that uses the VPN to anyone who intercepts it in transit. You can use Null encryption to authenticate and check the integrity of communications without encrypting them.

• SHA-1 — The SHA-1 hash function.
• SHA-2 — The SHA-2 hash function. Define the minimum length according to the security requirements for the VPN.
• AES-XCBC-MAC — The AES-XCBC-MAC Message Authentication Code hash function.
• MD5 — The MD5 message-digest algorithm.

• Deflate — Compresses the data. This compression requires processing and memory resources, which increases latency. Latency might also increase for non-VPN traffic. Do not select this option if the resource utilization is high. Gateways at both ends of each tunnel involved must support the option.
• None — (Recommended for most environments) Sends the data without compressing it. Provides better performance when bandwidth congestion for VPN traffic is not a constant issue or if there is significant processor load.

(Optional)

Limits after which IPsec SA negotiations are done again in a continuously used VPN. Reaching either the time or data amount limits triggers new IPsec SA negotiations, which must happen at regular intervals to guarantee security.

This setting affects tunnels that carry traffic continuously. Tunnels that are not used are closed after a short delay regardless of the lifetime set here. IPsec SA negotiations are lighter on the processor than IKE SA negotiations, but still require some processing. Too frequent renegotiations can reduce performance down to unacceptable levels.

The default is 480 minutes with no limit on the amount of transferred data.

• SA per Net — Creates an SA for each network from which connections are made through the VPN. This setting reduces the overhead when there are many hosts making connections through the VPN.
• SA per Host — Creates an SA for each host that makes connections through the VPN. This setting might provide more even load balancing in clusters than the per net setting, but increases the overhead, because per host usually requires more SAs to be negotiated.

(Optional)

(Optional)

It is usually recommended to leave the anti-replay window enabled. However, if QoS is applied to ESP/AH traffic, some of the ESP packets (for the same SA) might be delayed due to the classification and arrive at the destination so late that the anti-replay window has moved too far. This behavior causes the packets to be dropped. In this case, it might be necessary to disable the anti-replay window.

(Optional)

If a VPN Profile that contains VPN client settings is used in a route-based VPN, the VPN Client settings are ignored.

Enables certificate-based authentication.

This option is always used for the Gateway certificates for the Gateways involved in mobile VPNs, and if certificate authentication is used, also for the client. Certificate authentication does not need separate activation. However, you must configure the issuing authority separately as trusted and you must create certificates for the VPN clients in a manual process.

• RSA Signatures — Requires that each Gateway has a valid certificate.
• DSS Signatures — Requires that each Gateway has a valid certificate.
• ECDSA Signatures — Requires that each Gateway has a valid certificate.

(Optional)

(Forcepoint VPN Client only)

(Optional)

(Certificate authentication only)

(Optional)

The Forcepoint VPN Client does not support this method.

• SA per Net — Creates a security association (SA) for each network from which connections are made through the VPN. This setting reduces the overhead when there are many hosts making connections through the VPN.
• Allow SA to Any Network — (Valid only for third-party IPsec VPN Clients) Select this option together with SA per Net to support both the Forcepoint VPN Client and any third-party VPN clients that only support SAs negotiated per Host.
• SA per Host — Creates an SA for each host that makes connections through the VPN. This setting might provide more even load balancing in clusters than the per net setting, but increases the overhead, because per host usually requires more SAs to be negotiated.