Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

proposal (Security IPsec)

Syntax

Hierarchy Level

Description

Define an IPsec proposal. An IPsec proposal lists protocols and algorithms (security services) to be negotiated with the remote IPsec peer.

Options

proposal-name

Name of the IPsec proposal.

authentication-algorithm

Configure the IPsec authentication algorithm. Authentication algorithm is the hash algorithm that authenticates packet data. It can be one of six algorithms:

  • Values:

    The hash algorithm to authenticate data can be one of the following:

    • hmac-md5-96—Produces a 128-bit digest.

    • hmac-sha-256-128—Provides data origin authentication and integrity protection. This version of the hmac-sha-256 authenticator produces a 256-bit digest and specifies truncation to 128 bits.

    • hmac-sha1-96—Hash algorithm that authenticates packet data. It produces a 160-bit digest. Only 96 bits are used for authentication.

    • hmac-sha-512—Produces a 512-bit digest.

    • hmac-sha-384—Produces a 384-bit digest.

    • hmac-sha-256-96—HMAC-SHA-256-96 authentication algorithm (non-RFC compliant)

description

Text description of IPsec proposal

encryption-algorithm

Define encryption algorithm. The device deletes existing IPsec SAs when you update the encryption-algorithm configuration in the IPsec proposal.

  • Values:

    • 3des-cbc—Encryption algorithm with block size of 8 bytes (64 bits) and key size of 192 bits.

    • aes-128-cbc—Advanced Encryption Standard (AES) 128-bit encryption algorithm.

    • aes-128-gcm—AES Galois/Counter Mode (GCM) 128-bit encryption algorithm.

      For an IKE proposal, AES 128-bit authenticated encryption algorithm is supported with IKEv2 only. When this option is used, aes-128-gcm should be configured at the [edit security ipsec proposal proposal-name] hierarchy level, and the authentication-algorithm option should not be configured at the [edit security ike proposal proposal-name] hierarchy level.

      When aes-128-gcm, aes-192-gcm, or aes-256-gcm encryption algorithms are configured in the IPsec proposal, it is not mandatory to configure AES-GCM encryption algorithm in the corresponding IKE proposal.

    • aes-192-cbc—AES 192-bit encryption algorithm.

    • aes-192-gcm—AES GCM 192-bit encryption algorithm.

    • aes-256-cbc—AES 256-bit encryption algorithm.

    • aes-256-gcm—AES GCM 256-bit encryption algorithm.

      For an IKE proposal, AES 256-bit authenticated encryption algorithm is supported with IKEv2 only. When this option is used, aes-256-gcm should be configured at the [edit security ipsec proposal proposal-name] hierarchy level, and the authentication-algorithm option should not be configured at the [edit security ike proposal proposal-name] hierarchy level.

    • des-cbc—Encryption algorithm with block size of 8 bytes (64 bits) and key size 48 bits.

extended-sequence-number

Use the extended-sequence-number option to enable ESN support. ESN allows IPsec to use 64-bit sequence numbers for the sequence number. If ESN is not enabled, 32-bit sequence number will be used by default. Ensure ESN is not enabled when anti-replay is disabled.

lifetime-kilobytes

Specify the lifetime (in kilobytes) of an IPsec security association (SA). If this statement is not configured, the number of kilobytes used for the SA lifetime is unlimited.

  • Range: 64 through 4,294,967,294 kilobytes

lifetime-seconds

Lifetime in seconds.

  • Range: 180 through 86400

  • Default: 3600 seconds

protocol

Define the IPsec protocol for a manual or dynamic security association (SA).

  • Values:

    • ah—Authentication header

    • esp—Encapsulated Security Payload header

Required Privilege Level

security—To view this statement in the configuration.

security-control—To add this statement to the configuration.

Release Information

Statement introduced before Junos OS Release 7.4.

extended-sequence-number option introduced in Junos OS Release 19.4R1.

Starting in Junos OS Release 20.2R1, we’ve changed the help text description as NOT RECOMMENDED for the CLI options hmac-md5-96, hmac-sha1-96, 3des-cbc, and des-cbc for devices running iked process with junos-ike package installed.

hmac-sha-512 and hmac-sha-384 options introduced in Junos OS Release 19.1R1 on SRX5000 line of devices with SRX5K-SPC3 card.

Support for aes-128-gcm, aes-192-gcm, and aes-256-gcm options added in Junos OS Release 15.1X49-D70 for vSRX Virtual Firewall.

Support for aes-128-gcm, aes-192-gcm, and aes-256-gcm options added in Junos OS Release 12.1X45-D10.

Support for hmac-sha-256-128 added to SRX5400, SRX5600, and SRX5800 devices in Junos OS Release 12.1X46-D20.

Support for lifetime-kilobytes option with IPsec VPN running iked process is added in Junos OS Release 23.4R1.