Improving IPSEC Encryption settings

[CP-NDA]

Hi,

I have a few questions about the existing encryption settings in R81.20.

We still have some communities using AES256 or AES128 and SHA1. We would like to improve security and are considering moving to:

Suite-B-GCM-256 default settings:

• AES-GCM-256
• SHA-384
• EC DH Group 20

Suite-B-GCM-128 default settings:

• AES-GCM-128
• SHA-256
• EC DH Group 19

I read but it's not clear to me.

sk73980 - Relative speeds of algorithms for IPsec and SSL

Solved: R80.x Performance Tuning Tip - AES-NI - Page 2 - Check Point CheckMates

Do both suites of protocols support AES-NI?

Also, are the same protocols used in Phase 1 and Phase 2 when using the pre-defined suites?

Do you have any other suggestions or recommendations?

Thank you,

Nicolas

[PhoneBoy · Accepted solution]

As far as I know, they should be covered in AES-NI and even handled in SecureXL.

[Timothy_Hall · Accepted solution]

Assuming the processor architecture of your appliance supports AES-NI, yes you want to use the GCM variants of AES for IPSec Phase 2.  Use of the AES-GCM variants is supported both by SecureXL (in the fastpath) and the Firewall Worker cores (Medium & slowpath).  Here are the relevant pages from my Gateway Performance Optimization course explaining this:

[CP-NDA]

Thank you

Really clear !