Add an L2TP IPSec Phase 1 Transform

L2TP has three default Phase 1 transform sets:

  • SHA1-AES256-DH2
  • SHA1-AES256-DH20
  • SHA2(256)-AES256-DH14

When the tunnel is created, the Firebox can use any of these transforms to match the transform set of the other VPN endpoint.

You can add more transform sets up to a maximum of nine. For example, you could add SHA1-AES128-DH2. The Firebox would then have four transform sets. The transform set at the top of the list is used first.

SHA-2 is not supported on XTM 21, 22, 23, 505, 510, 520, 530, 515, 525, 535, 545, 810, 820, 830, 1050, and 2050 devices. The hardware cryptographic acceleration in those models does not support SHA-2. All other models support SHA-2.

See Also

Configure IPSec VPN Phase 1 Settings