Configure IKEv2 Shared Settings
IKEv2 shared settings apply to all manual BOVPN tunnels and BOVPN virtual interfaces that use IKEv2 and have at least one remote gateway that has a dynamic IP address.
These authentication options are supported:
- MD5
- SHA1
- SHA2-256
- SHA2-384
- SHA2-512
These encryption options are supported:
- DES
- 3DES
- AES (128-bit)
- AES (192-bit)
- AES (256-bit)
- AES-GCM (128-bit) — Fireware v12.2 or higher
- AES-GCM (192-bit) — Fireware v12.2 or higher
- AES-GCM (256-bit) — Fireware v12.2 or higher
Diffie-Hellman Groups 1, 2, 5, 14, 15, 19, and 20 are supported.
For IKEv2, NAT traversal is always enabled, but you can change the NAT keep-alive interval in the Phase 1 Options.
For information about how to configure a branch office VPN to use IKEv2, see Configure IPSec VPN Phase 1 Settings.
- Select VPN > IKEv2 Shared Settings.
The IKEv2 Shared Settings page appears.
- To change the NAT Traversal Keep-alive interval, in the Keep-alive Interval text box, type or select the number of seconds that pass before the next NAT keep-alive message is sent.
- In the Phase 1 Transform Settings section you can add, edit or remove Phase 1 transforms. For more information about Phase 1 Transform settings, see Add a Phase 1 Transform.
- Click Save.
- Select VPN > IKEv2 Shared Settings.
The IKEv2 Shared Settings dialog box appears.
- To change the NAT Traversal Keep-alive interval, in the Keep-alive Interval text box, type or select the number of seconds that pass before the next NAT keep-alive message is sent.
- In the Phase 1 Transform Settings section you can add, edit or remove Phase 1 transforms. For more information about Phase 1 Transform settings, see Add a Phase 1 Transform.
- Click OK.
You can also edit the IKEv2 shared settings when you edit a BOVPN gateway or BOVPN virtual interface that uses them. These settings appear in the BOVPN configuration only if the gateway uses IKEv2 and has at least one remote gateway endpoint with a dynamic IP address. These settings appear in the Shared Settings tab within the Phase 1 Settings tab for the BOVPN gateway or virtual interface.
To edit the shared settings from within a gateway or BOVPN virtual interface:
- Select the Phase 1 Settings tab.
- From the Version drop-down list, select IKEv2.
If the Gateway has a remote gateway endpoint that has a dynamic IP address, the IKEv2 shared settings are in the Shared Settings tab. - Select the Shared Settings tab.
- Configure the IKEv2 shared settings as described in the previous procedure.