Juniper Proposal sets IKE/IPSEC

When building VPNs on SRX platforms, you need to be aware of the built-in proposal sets. Juniper has 3 canned proposal-sets  known simply as;

basic
standard
compatible

basic offers DES with  DH-group1 and SHA1 or MD5 authentication

NOTE: I never recommend the above for a VPN

standard offers  slightly better and more proposals such as 3DES DH-group2 with sha1 or AES128 DHGRP2 and SHA1

NOTE: This is the minimum accept proposals that should be used IMHO

compatible offers  a few more options
                       3DES with DH-group2 SHA1
                       3DES with DH-group2 MD5
                        DES DH-group2 SHA1
                        DES DH-group2 md5


You need to be aware that the difference proposal sets, and the availability within each when using ipsec-vpn


Ideally, you should craft your own proposal and define these for your ike and ipsec proposals

set security ike proposal AES128-SHA128-DH5 authentication-method pre-shared-keys
set security ike proposal AES128-SHA128-DH5 dh-group group5
set security ike proposal AES128-SHA128-DH5 authentication-algorithm sha-128
set security ike proposal AES128-SHA128-DH5 encryption-algorithm aes-128-cbc
set security ike proposal AES128-SHA128-DH5 lifetime-seconds 28800
~                                                                     

 set security ike proposal AES192-SHA192-DH5 authentication-method pre-shared-keys
set security ike proposal AES192-SHA192-DH5 dh-group group5
set security ike proposal AES192-SHA192-DH5 authentication-algorithm sha-192
set security ike proposal AES192-SHA192-DH5 encryption-algorithm aes-192-cbc
set security ike proposal AES192-SHA192-DH5 lifetime-seconds 28800


and

set security ipsec proposal ESP-AES128-SHA256 protocol esp
set security ipsec proposal ESP-AES128-SHA256 authentication-algorithm hmac-SHA256-128
set security ipsec proposal ESP-AES128-SHA256 encryption-algorithm aes-128-cbc
set security ipsec proposal ESP-AES128-SHA256 lifetime-seconds 3600
~
set security ipsec proposal ESP-AES256-SHA192protocol esp
set security ipsec proposal ESP-AES256-SHA192 authentication-algorithm hmac-SHA256-192
set security ipsec proposal ESP-AES256-SHA192 encryption-algorithm aes-192-cbc
set security ipsec proposal ESP-AES256-SHA192 lifetime-seconds 3600


For DF-groups, you should strive for  DH-group14 or  higher & if the far-end peer supports it.

Try to avoid   dh-group 1 and 2 . Even dh-group5 should not be used but that's the minimum accept group  to avoid interoperability. Almost all security vpn devices supports dh-group5. For PFS, enable it when you can and if you need 100% security. PFS will ensure all new key-generation is not done from previous phase keys.

Even if some one knew your PSK for example, they could not break your encryption without brute-force and that would take million of years to do.

Ken Felix
Freelance Network/Security Engineer
kfelix  -----a----t---- socpuppets ---dot---com

    ^    ^
=( #  # )=
      @
      /   \