There are several configuration options for VPNs that affect both the security and speed of the tunnel. Prior to version 12.1.0 the defaults are a setting called "ANY" which allows the Ecessa device to negotiate the settings from all of the available options.
In versions 12.1.0 and newer the defaults are specific options instead of using "ANY".
The reason for this change is that "ANY" often results in packet fragmentation during the initial VPN establishment, which can prevent it from connecting, and may result in an unexpected security level depending on what options are negotiated.
The following table shows what two Ecessa devices using "ANY" would negotiate compared to the defaults in 12.1.0.
|
Option |
12.0.2 |
12.1.0 |
|---|---|---|
|
Phase 1 Encryption |
AES128 (CBC) |
AES256 (CBC) |
|
Phase 1 Authentication |
ESP SHA1 |
ESP SHA2 256 |
|
IKE Group |
Group 5 |
Group 14 |
|
Phase 2 Encryption |
AES128 (CBC) |
AES256 (CBC) |
|
Phase 2 Authentication |
ESP SHA1 |
ESP SHA2 256 |
0 Comments