topic Re: VPN Parameters through API misleading in API / CLI Discussion

VPN Parameters through API misleading

Arne_Boettger — Mon, 13 Jan 2025 13:09:36 GMT

Hello,

we have a script running over our SmartCenters via API inventorizing all VPN communities to make sure we don't use any outdated or insecure methods.

Today, I found a VPN community supposedly using weak parameters. But a closer look showed this was not the case. I could reproduce it with R82 in Demo mode.

The details:

The Community uses suite-b-gcm-256 which is defined as AES-GCM-256, SHA-384, EC Diffie-Hellman Group 20.

The API returns this correctly, but also returns the values from the"Custom encryption Suite".

I would have expected that the values returned are actually the ones in use, and would really like to see the behaviour changed to that if I choose a predefined encryption suite, all other fields are changed to the values defined by this encryption suite.

Am I wrong with this wish? Please find below a screenshot and an excerpt from the API response:

VPN Community Test in SmartConsole

- uid: "b3d0fe99-b042-47f8-a72f-b3b85068d80d"
  name: "Test"
  type: "vpn-community-star"
  encryption-suite: "suite-b-gcm-256"
  ike-phase-1: 
    encryption-algorithm: "aes-256"
    diffie-hellman-group: "group-15"
    data-integrity: "sha384"
  ike-phase-2: 
    encryption-algorithm: "aes-gcm-128"
    ike-p2-use-pfs: false
    ike-p2-pfs-dh-grp: "group-15"
        ike-p2-rekey-time: 3600
    data-integrity: "sha384"

Re: VPN Parameters through API misleading

the_rock — Mon, 13 Jan 2025 13:56:45 GMT

You are 100% correct. I just tested in my lab and got same results.

Andy

Re: VPN Parameters through API misleading

Hugo_vd_Kooij — Mon, 13 Jan 2025 15:15:53 GMT

But if I read the API and the screenshot output correctly the results in themselves are consistent in that both Smart Console and the API show the exact same details.

So the issue has been there for a long time. As I recall the settings weren't consistent for like ... ages with the Suite and the individual settings not matching in Smartconsole.

Re: VPN Parameters through API misleading

PhoneBoy — Mon, 13 Jan 2025 22:02:58 GMT

The API call is showing what the configuration in SmartConsole is, but the "encryption suite" setting is what matters here.
Agree this is confusing.
Tagging @Omer_Kleinstern