Bilješka
Pristup ovoj stranici zahtijeva provjeru vjerodostojnosti. Možete pokušati da se prijavite ili promijenite direktorije.
Pristup ovoj stranici zahtijeva provjeru vjerodostojnosti. Možete pokušati promijeniti direktorije.
This article shows the supported IPsec policy combinations for Point-to-site VPN connectivity in Azure Virtual WAN.
Default IPsec policies
The following table shows the default IPsec parameters for Point-to-site VPN connections. These parameters are automatically chosen by the Virtual WAN Point-to-site VPN gateway when a Point-to-site profile is created.
| Setting | Parameters |
|---|---|
| Phase 1 IKE Encryption | AES256 |
| Phase 1 IKE Integrity | SHA256 |
| DH Group | DHGroup24 |
| Phase 2 IPsec Encryption | GCMAES256 |
| Phase 2 IPsec Integrity | GCMAES256 |
| PFS Group | PFS24 |
Custom IPsec policies
When working with custom IPsec policies, keep in mind the following requirements:
- IKE - For Phase 1 IKE, you can select any parameter from IKE Encryption, plus any parameter from IKE Integrity, plus any parameter from DH Group.
- IPsec - For Phase 2 IPsec, select any parameter from IPsec Encryption, plus any parameter from IPsec Integrity, plus PFS. If any of the parameters for IPsec Encryption or IPsec Integrity is GCM, then both IPsec Encryption and Integrity must use the same algorithm. For example, if GCMAES128 is chosen for IPsec Encryption, GCMAES128 must also be chosen for IPsec Integrity.
Custom IKE main mode policies support Diffie-Hellman Group 14, Group 24, or ECP (Elliptic Curve Groups) ECP256 (Group 19) and ECP384 (Group 20). Similar cryptographic group requirements apply to IPsec quick mode policies.
The following table shows the available IPsec parameters for Point-to-site VPN connections.
| Setting | Parameters |
|---|---|
| Phase 1 IKE Encryption | AES128, AES256, GCMAES128, GCMAES256 |
| Phase 1 IKE Integrity | SHA256, SHA384 |
| DH Group | DHGroup14, DHGroup24, ECP256, ECP384 |
| Phase 2 IPsec Encryption | GCMAES128, GCMAES256, SHA256 |
| Phase 2 IPsec Integrity | GCMAES128, GCMAES256 |
| PFS Group | PFS14, PFS24, ECP256, ECP384 |
The following table lists the corresponding Diffie-Hellman groups that the custom policy supports:
| Diffie-Hellman group | DHGroup | PFSGroup | Key length |
|---|---|---|---|
| 14 | DHGroup14 | PFS14 | 2048-bit MODP |
| 19 | ECP256 | ECP256 | 256-bit ECP |
| 20 | ECP384 | ECP384 | 384-bit ECP |
| 24 | DHGroup24 | PFS24 | 2048-bit MODP |
Next steps
See How to create a point-to-site connection
For more information about Virtual WAN, see the Virtual WAN FAQ.