topic Re: Site to Site VPN configuration in Firewall and Security Management

Site to Site VPN configuration

Steve_Pearson — Tue, 17 Oct 2023 14:08:23 GMT

Hi everyone,

I was just wondering was the general feeling was about the phase 1/2 encryption protocols between a Checkpoint appliance and a third party device (Sonicwall, Draytec etc) in todays world?

I'm just looking at one now and these are the requested settings, which to me look a little outdated:

Phase 1

DH Group 2

3DES encryption

SHA1 integrity

Renegotiate IKE every 28800 seconds

Phase 2

3DES encryption

SHA1 integrity

Renegotiate IPsec every 3600 seconds

Thanks,

Steve

Re: Site to Site VPN configuration

Machine_Head — Tue, 17 Oct 2023 14:22:20 GMT

Hi Steve,

Those settings are indeed not recommended.

3des is less secure and less efficient than AES suites.

You could use anything from AES-256 + Sha2 and up.

Enable PFS in phase 2 only if extreme security is needed

Re: Site to Site VPN configuration

CaseyB — Tue, 17 Oct 2023 14:37:56 GMT

3DES is a no go for today's standards and SHA-1 is being phased out. I have been using the following for site-to-site VPNs with 3rd parties:

IKEv2

Phase1: AES-256 / SHA256 - Group 19 / 1440 minutes

Phase2: AES-GCM-256 / 3600 seconds

It would be nice to be able to use GCM in Phase1, but that option is not available currently. Ideally you want a minimum key size of 256 for everything. I would be curious to see what others recommend as well for encryption.