Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

proposal (Security IPsec)

 

Syntax

Hierarchy Level

Release Information

Statement modified in Junos OS Release 8.5.

hmac-sha-512 and hmac-sha-384 options introduced in Junos OS Release 19.1R1 on SRX5000 line of devices with SRX5K-SPC3 card.

Support for hmac-sha-256-128 added to SRX5400, SRX5600, and SRX5800 devices in Junos OS Release 12.1X46-D20.

Junos OS Release 19.3R1 supports options hmac-sha1-96 and hmac-sha-256-128 on SRX4100, SRX4200, and vSRX in Power-Mode IPsec mode to improve IPsec performance, along with the existing support in normal mode.

Support for aes-128-gcm, aes-192-gcm, and aes-256-gcm options added in Junos OS Release 12.1X45-D10.

Support for aes-128-gcm, aes-192-gcm, and aes-256-gcm options added in Junos OS Release 15.1X49-D70 for vSRX.

Junos OS Release 19.3R1 supports options aes-128-cbc, aes-192-cbc, and aes-256-cbc on SRX4100, SRX4200, and vSRX in Power Mode IPsec mode to improve IPsec performance, along with the existing support in normal mode.

Starting in Junos OS Release 20.2R1, we’ve changed the help text description as NOT RECOMMENDED for the CLI options hmac-md5-96, hmac-sha1-96, 3des-cbc, and des-cbc.

Description

Define an IPsec proposal. An IPsec proposal lists protocols and algorithms (security services) to be negotiated with the remote IPsec peer.

Options

proposal-nameName of the IPsec proposal.
authentication-algorithmDefine authentication algorithm.

Values:

The hash algorithm to authenticate data can be one of the following:

  • hmac-md5-96—Produces a 128-bit digest.

  • hmac-sha-256-128—Provides data origin authentication and integrity protection. This version of the hmac-sha-256 authenticator produces a 256-bit digest and specifies truncation to 128 bits.

  • hmac-sha1-96—Hash algorithm that authenticates packet data. It produces a 160-bit digest. Only 96 bits are used for authentication.

  • hmac-sha-512—Produces a 512-bit digest.

  • hmac-sha-384—Produces a 384-bit digest.

descriptionEnter the description of IPsec proposal.
encryption-algorithmDefine encryption algorithm. The device deletes existing IPsec SAs when you update the encryption-algorithm configuration in the IPsec proposal.

Values:

  • 3des-cbc—Encryption algorithm with block size of 8 bytes (64 bits) and key size of 192 bits.

  • aes-128-cbc—Advanced Encryption Standard (AES) 128-bit encryption algorithm.

  • aes-128-gcm—AES Galois/Counter Mode (GCM) 128-bit encryption algorithm.

    For an IKE proposal, AES 128-bit authenticated encryption algorithm is supported with IKEv2 only. When this option is used, aes-128-gcm should be configured at the [edit security ipsec proposal proposal-name] hierarchy level, and the authentication-algorithm option should not be configured at the [edit security ike proposal proposal-name] hierarchy level.

    Note

    When aes-128-gcm or aes-256-gcm encryption algorithms are configured in the IPsec proposal, it is not mandatory to configure AES-GCM encryption algorithm in the corresponding IKE proposal.

  • aes-192-cbc—AES 192-bit encryption algorithm.

  • aes-192-gcm—AES GCM 192-bit encryption algorithm. This option is for IPsec proposals only.

  • aes-256-cbc—AES 256-bit encryption algorithm.

  • aes-256-gcm—AES GCM 256-bit encryption algorithm.

    For an IKE proposal, AES 256-bit authenticated encryption algorithm is supported with IKEv2 only. When this option is used, aes-256-gcm should be configured at the [edit security ipsec proposal proposal-name] hierarchy level, and the authentication-algorithm option should not be configured at the [edit security ike proposal proposal-name] hierarchy level.

  • des-cbc—Encryption algorithm with block size of 8 bytes (64 bits) and key size 48 bits.

lifetime-kilobytesSpecify the lifetime (in kilobytes) of an IPsec security association (SA). If this statement is not configured, the number of kilobytes used for the SA lifetime is unlimited.

Range: 64 through 1,048,576 kilobytes

lifetime-secondsSpecify the lifetime (in seconds) of an IPsec security association (SA). When the SA expires, it is replaced by a new SA and security parameter index (SPI) or terminated.

Range: 180 through 86,400 seconds

Default: 3600 seconds

protocolDefine the IPsec protocol for a manual or dynamic security association (SA).

Values:

  • ah—Authentication Header protocol.

  • esp—Encapsulating Security Payload (ESP) protocol.

Required Privilege Level

security—To view this statement in the configuration.

security-control—To add this statement to the configuration.

Related Documentation