VPN Parameters through API misleading

[Arne_Boettger]

Hello,

we have a script running over our SmartCenters via API inventorizing all VPN communities to make sure we don't use any outdated or insecure methods.

Today, I found a VPN community supposedly using weak parameters. But a closer look showed this was not the case. I could reproduce it with R82 in Demo mode.

The details:

The Community uses suite-b-gcm-256 which is defined as AES-GCM-256, SHA-384, EC Diffie-Hellman Group 20.

The API returns this correctly, but also returns the values from the"Custom encryption Suite".

I would have expected that the values returned are actually the ones in use, and would really like to see the behaviour changed to that if I choose a predefined encryption suite, all other fields are changed to the values defined by this encryption suite.

Am I wrong with this wish? Please find below a screenshot and an excerpt from the API response:

VPN Community Test in SmartConsole

- uid: "b3d0fe99-b042-47f8-a72f-b3b85068d80d"
  name: "Test"
  type: "vpn-community-star"
  encryption-suite: "suite-b-gcm-256"
  ike-phase-1: 
    encryption-algorithm: "aes-256"
    diffie-hellman-group: "group-15"
    data-integrity: "sha384"
  ike-phase-2: 
    encryption-algorithm: "aes-gcm-128"
    ike-p2-use-pfs: false
    ike-p2-pfs-dh-grp: "group-15"
        ike-p2-rekey-time: 3600
    data-integrity: "sha384"

[the_rock]

You are 100% correct. I just tested in my lab and got same results.

Andy

[Hugo_vd_Kooij]

But if I read the API and the screenshot output correctly the results in themselves are consistent in that both Smart Console and the API show the exact same details.

So the issue has been there for a long time. As I recall the settings weren't consistent for like ... ages with the Suite and the individual settings not matching in Smartconsole.