From 8e94552594aae657358978988de9909ee4287a43 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Mon, 3 Dec 2018 05:25:36 +0100 Subject: IPsec: use Suite-B-GCM-256 algorithms for IKEv2 & ESP. (That is, remove algorithms from Suite-B-GCM-128.) Cf. https://wiki.strongswan.org/projects/strongswan/wiki/IKEv2CipherSuites and https://wiki.strongswan.org/projects/strongswan/wiki/SecurityRecommendations . --- roles/common/templates/etc/ipsec.conf.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/common/templates/etc/ipsec.conf.j2 b/roles/common/templates/etc/ipsec.conf.j2 index 938f6b8..0ff9fbb 100644 --- a/roles/common/templates/etc/ipsec.conf.j2 +++ b/roles/common/templates/etc/ipsec.conf.j2 @@ -7,8 +7,8 @@ config setup conn %default keyexchange = ikev2 keyingtries = %forever - ike = aes128gcm16-prfsha256-ecp256,aes256gcm16-prfsha384-ecp384! - esp = aes128gcm16-ecp256,aes256gcm16-ecp384! + ike = aes256gcm16-prfsha384-ecp384! + esp = aes256gcm16-ecp384! {% if 'NATed' not in group_names %} mobike = no {% endif %} -- cgit v1.2.3