proposal (Security IKE)

Name of the IKE proposal. The proposal name can be up to 32 alphanumeric characters long.

Configure the Internet Key Exchange (IKE) authentication hash algorithm that authenticates packet data. It can be one of the following algorithms:

• md5—Produces a 128-bit digest.

• sha-256—Produces a 256-bit digest.

• sha-384—Produces a 384-bit digest.

• In Power Mode IPSec mode and in normal mode—

  • sha1—Produces a 160-bit digest.

  • sha-512—Produces a 512-bit digest.

The device deletes existing IPsec SAs when you update the authentication-algorithm configuration either in the IKE proposal or IPsec proposal.

Specify the method the device uses to authenticate the source of Internet Key Exchange (IKE) messages. The pre-shared-keys option refers to a preshared key, which is a key for encryption and decryption that both participants must have before beginning tunnel negotiations. The other options refer to types of digital signatures, which are certificates that confirm the identity of the certificate holder. The device deletes existing IPsec SAs when you update the authentication-method configuration in the IKE proposal.

• certificates—You can establish the IKEv2 and IPsec SA tunnels irrespective of the type of certificate used on initiator and responder. The authentication-method certificates option cannot be used with IKEv1.

• digital-signature—Specify digital signature as an authentication method for IKEv2. Note that you cannot use the option with IKEv1.

• dsa-signatures—Specify that the Digital Signature Algorithm (DSA) is used.

• ecdsa-signatures-256—Specify that the Elliptic Curve DSA (ECDSA) using the 256-bit elliptic curve secp256r1, as specified in the Federal Information Processing Standard (FIPS) Digital Signature Standard (DSS) 186-3, is used.

• ecdsa-signatures-384—Specify that the ECDSA using the 384-bit elliptic curve secp384r1, as specified in the FIPS DSS 186-3, is used.

• pre-shared-keys—Specify that a preshared key, which is a secret key shared between the two peers, is used during authentication to identify the peers to each other. The same key must be configured for each peer. This is the default method.

• rsa-signatures—Specify that a public key algorithm, which supports encryption and digital signatures, is used.

• ecdsa-signatures-521—Specify that the ECDSA using the 521-bit elliptic curve secp521r1 is used.

Text the description of IKE proposal.

Specify the IKE Diffie-Hellman group.

Configure an encryption algorithm for an IKE proposal.

Specify the lifetime (in seconds) of an IKE security association (SA). When the SA expires, it is replaced by a new SA and security parameter index (SPI) or terminated.

• Range: 180 through 86,400 seconds

• Default: 28,800 seconds

(Optional) Specify the digital signature hash algorithms for IKEv2. Note that you cannot use the option with IKEv1.