topic Re: Improving IPSEC Encryption settings in General Topics

Improving IPSEC Encryption settings

CP-NDA — Wed, 26 Mar 2025 12:41:08 GMT

Hi,

I have a few questions about the existing encryption settings in R81.20.

We still have some communities using AES256 or AES128 and SHA1. We would like to improve security and are considering moving to:

Suite-B-GCM-256 default settings:

AES-GCM-256
SHA-384
EC DH Group 20

Suite-B-GCM-128 default settings:

AES-GCM-128
SHA-256
EC DH Group 19

I read but it's not clear to me.

sk73980 - Relative speeds of algorithms for IPsec and SSL

Solved: R80.x Performance Tuning Tip - AES-NI - Page 2 - Check Point CheckMates

Do both suites of protocols support AES-NI?

Also, are the same protocols used in Phase 1 and Phase 2 when using the pre-defined suites?

Do you have any other suggestions or recommendations?

Thank you,

Nicolas

Re: Improving IPSEC Encryption settings

PhoneBoy — Wed, 26 Mar 2025 18:22:11 GMT

As far as I know, they should be covered in AES-NI and even handled in SecureXL.

Re: Improving IPSEC Encryption settings

Timothy_Hall — Thu, 27 Mar 2025 02:48:47 GMT

Assuming the processor architecture of your appliance supports AES-NI, yes you want to use the GCM variants of AES for IPSec Phase 2. Use of the AES-GCM variants is supported both by SecureXL (in the fastpath) and the Firewall Worker cores (Medium & slowpath). Here are the relevant pages from my Gateway Performance Optimization course explaining this:

Re: Improving IPSEC Encryption settings

CP-NDA — Thu, 27 Mar 2025 07:58:27 GMT

Thank you

Really clear !