<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Building your config file to conform Suite B RFC 6379 is a good reference. <br><br><a href="https://datatracker.ietf.org/doc/rfc6379/?include_text=1">https://datatracker.ietf.org/doc/rfc6379/?include_text=1</a><br><div dir="ltr"><br>On Jul 9, 2019, at 1:06 AM, Kaushal Shriyan <<a href="mailto:kaushalshriyan@gmail.com">kaushalshriyan@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div dir="ltr"><div dir="ltr">Thanks Paul for the help and much appreciated.</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jul 9, 2019 at 9:12 AM Paul Wouters <<a href="mailto:paul@nohats.ca">paul@nohats.ca</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Tue, 9 Jul 2019, Kaushal Shriyan wrote:<br>
<br>
> I am running libreswan version 3.29 on CentOS 7.6 and the details are as below:-<br>
<br>
> I have the below config. <br>
><br>
> conn apps-tomcat-primary<br>
> type=tunnel<br>
> authby=secret<br>
> left=%defaultroute<br>
> leftid=128.117.167.12<br>
> leftnexthop=%defaultroute<br>
> leftsubnet=<a href="http://128.117.167.12/32" rel="noreferrer" target="_blank">128.117.167.12/32</a><br>
> right=126.114.94.7<br>
> rightsubnet=<a href="http://126.114.90.7/32" rel="noreferrer" target="_blank">126.114.90.7/32</a><br>
> ike=aes128-sha1;modp1024<br>
<br>
Note using DH2 makes no sense. It's too weak. libreswan-3.30 has it<br>
compile time disabled by default.<br>
<br>
> phase2alg=aes128-sha1;modp1536<br>
<br>
It also makes little sense to have a larger phase2 DH group.<br>
<br>
> pfs=yes<br>
> auto=start<br>
> ikev2=no<br>
> <br>
> <br>
> I will appreciate if you can let me know the suggested cipher suites (encryption and authentication) to be implemented as per the above Libreswan IPsec configuration.<br>
<br>
It will only allow what you specified on the ike= and esp= lines. Only<br>
if you specify nothing in the conn, do you get default ciphers eiter<br>
from conn %default or via the system-wide crypto policies (via conn<br>
%default).<br>
<br>
So your ike= line will only allow AES 128 bit key, SHA1 for PRF and<br>
INTEG, using DH2. Your esp=/phase2alg- line only allows AES 128 bit key,<br>
SHA1 for INTEG and DH5 Quickmode/PFS.<br>
<br>
Paul<br>
</blockquote></div>
</div></blockquote><blockquote type="cite"><div dir="ltr"><span>_______________________________________________</span><br><span>Swan mailing list</span><br><span><a href="mailto:Swan@lists.libreswan.org">Swan@lists.libreswan.org</a></span><br><span><a href="https://lists.libreswan.org/mailman/listinfo/swan">https://lists.libreswan.org/mailman/listinfo/swan</a></span><br></div></blockquote></body></html>