Skip to main content

Configure recommended settings for IPsec subnet VPNs

Updated

  Note

To configure VPNs, you need a Unified Threat Management license.

You can remove the Legacy IPsec security warning by configuring modern, secure cryptographic protocols on your IPsec subnet VPN.

  1. Go to Network > VPN > IPsec subnets, and then select Advanced.
  2. Use the following settings:
    1. IKEv2: - Turn this setting on.
    2. Authentication type: Select ESP. Do not use AH.
    3. Cryptographic algorithm: Select AES256. Do not use 3DES or AES128.
    4. Hashing algorithm: Select SHA2. Do not use MD5 or SHA1.
    5. Diffie-Hellman Group: Select Group 14 (2048-bit modulus). Do not use groups 2, 5, 15, 16, 17, 18, 20, or 21.
    6. Perfect forward secrecy: Turn this setting on.
    7. Use compression: Turn this setting on, unless the primary VPN traffic is already encrypted or compressed.
  3. Redeploy client certificates.

  Important

After you save these configuration changes, you must redeploy the VPN certificates to all client devices. The updated security profiles and connection policies will not take effect on client devices until you refresh and redeploy their certificates.