Configuring an IPsec transform set

About IPsec transform set

An IPsec transform set, part of an IPsec policy, defines the security parameters for IPsec SA negotiation, including the security protocol, encryption algorithms, and authentication algorithms.

Restrictions and guidelines

Changes to an IPsec transform set affect only SAs negotiated after the changes. To apply the changes to existing SAs, execute the reset ipsec sa command to clear the SAs so that they can be set up by using the updated parameters.

In FIPS mode, you must specify both the ESP encryption algorithm and the ESP authentication algorithm for an IPsec transform set that uses the ESP security protocol.

When you set the packet encapsulation mode (tunnel or transport) for an IPsec transform set, follow these guidelines:

When you configure the Perfect Forward Secrecy (PFS) feature in an IPsec transform set, follow these guidelines:

You can specify multiple authentication or encryption algorithms for the same security protocol. The algorithm specified earlier has a higher priority.

Some algorithms are available only for IKEv2. See Table 27.

Table 27: Algorithms available only for IKEv2

Type

Algorithms

Encryption algorithm

aes-ctr-128

aes-ctr-192

aes-ctr-256

camellia-cbc-128

camellia-cbc-192

camellia-cbc-256

gmac-128

gmac-192

gmac-256

gcm-128

gcm-192

gcm-256

Authentication algorithm

aes-xcbc-mac

PFS algorithm

dh-group19

dh-group20

Procedure

  1. Enter system view.

    system-view

  2. Create an IPsec transform set and enter its view.

    ipsec transform-set transform-set-name

  3. Specify the security protocol for the IPsec transform set.

    protocol { ah | ah-esp | esp }

    By default, the ESP security protocol is used.

  4. Specify the encryption algorithms for ESP. Skip this step if the protocol ah command is configured.

    In non-FIPS mode:

    esp encryption-algorithm { 3des-cbc | aes-cbc-128 | aes-cbc-192 | aes-cbc-256 | aes-ctr-128 | aes-ctr-192 | aes-ctr-256 | camellia-cbc-128 | camellia-cbc-192 | camellia-cbc-256 | des-cbc | gmac-128 | gmac-192 | gmac-256 | gcm-128 | gcm-192 | gcm-256 | null } *

    By default, no encryption algorithm is specified for ESP.

    In FIPS mode:

    esp encryption-algorithm { aes-cbc-128 | aes-cbc-192 | aes-cbc-256 | aes-ctr-128 | aes-ctr-192 | aes-ctr-256 | gmac-128 | gmac-192 | gmac-256 | gcm-128 | gcm-192 | gcm-256 } *

    By default, no encryption algorithm is specified for ESP.

  5. Specify the authentication algorithms for ESP. Skip this step if the protocol ah command is configured.

    In non-FIPS mode:

    esp authentication-algorithm { aes-xcbc-mac | md5 | sha1 | sha256 | sha384 | sha512 } *

    By default, no authentication algorithm is specified for ESP.

    The aes-xcbc-mac algorithm is available only for IKEv2.

    In FIPS mode:

    esp authentication-algorithm { sha1 | sha256 | sha384 | sha512 } *

    By default, no authentication algorithm is specified for ESP.

  6. Specify the authentication algorithms for AH. Skip this step if the protocol esp command is configured.

    In non-FIPS mode:

    ah authentication-algorithm { aes-xcbc-mac | md5 | sha1 | sha256 | sha384 | sha512 } *

    By default, no authentication algorithm is specified for AH.

    The aes-xcbc-mac algorithm is available only for IKEv2.

    In FIPS mode:

    ah authentication-algorithm { sha1 | sha256 | sha384 | sha512 } *

    By default, no authentication algorithm is specified for AH.

  7. Specify the packet encapsulation mode.

    encapsulation-mode { transport | tunnel }

    By default, the security protocol encapsulates IP packets in tunnel mode.

  8. (Optional.) Enable the PFS feature.

    In non-FIPS mode:

    pfs { dh-group1 | dh-group2 | dh-group5 | dh-group14 | dh-group24 | dh-group19 | dh-group20 }

    In FIPS mode:

    pfs { dh-group14 | dh-group19 | dh-group20 }

    By default, the PFS feature is disabled.

    For more information about PFS, see "Configuring IKE."

  9. (Optional.) Enable the Extended Sequence Number (ESN) feature.

    esn enable [ both ]

    By default, the ESN feature is disabled.