NAME
network-vpn-security-policies - Configure VPN Security Policies
SYNOPSIS
network vpn security-policies [new|destroy] NAME… network vpn security-policies NAME COMMAND …
DESCRIPTION
With help of the vpn security-policies, it is possible to create, destroy and edit VPN security policies.
A security policy is a definition of ciphers and algorithms for integrity and key-exchanges for VPN connections.
COMMANDS
The following commands are understood:
- new NAME
-
A new security policy may be created with the new command.
NAME does not allow any spaces. - destroy NAME
-
A security policy can be destroyed with this command.
If the policy is still in use, it cannot be deleted.
For all other commands, the name of the security policy needs to be passed first:
- NAME show
-
Shows the configuration of the security policy.
- NAME key-exchange [IKEv2|IKEv1]
-
Defines the key exchange algorithm that should be used to initiate an IPsec VPN connection.
- NAME ciphers [CIPHER-LIST|+CIPHER …|-CIPHER …]
-
This command allows modifying the cipher list. A new CIPHER-LIST can be passed which will replace the current configuration. Alternatively, new ciphers can be added by prepending a + sign to the cipher name and can removed likewise using -.
A cipher is an algorithm that encrypts and decrypts data to be able to transmit it over an insecure channel. - NAME integrities [INTEGRITY-LIST|+INTEGRITY …|-INTEGRITY …]
-
This command allows modifying the integrity list similar to the ciphers command.
Integrity algorithms are used to be able to determine if data has been altered when being transferred over an untrusted channel. - NAME pseudo-random-functions [PSEUDO-RANDOM-FUNCTION-LIST|+PSEUDO-RANDOM-FUNCTION…|-PSEUDO-RANDOM-FUNCTION]
-
This command allows modifying the list of pseudo random functions similar to the ciphers command.
These functions are used in combination with an AEAD cipher only. - NAME group-types [GROUP-TYPES-LIST|+GROUP-TYPE …|-GROUP-TYPE]
-
This command allows modifying the list of group types similar to the ciphers command.
These algorithms are used to negotiate a shared secret of an insecure channel. - NAME pfs [on|off]
-
This command allows to enable or disable Perfect Forward Secrecy (PFS). If PFS is enabled, the encrypted channels of a VPN connection will be renegotiated regularly to avoid that the same keys are used for too long. If an attacker is able to obtain a key that was used to encrypt the data, it is only possible to decrypt a certain amount of data.
It is strongly recommended to enable PFS at all times. - NAME lifetime LIFETIME
-
This command allows to define how often the VPN connection is renegotiated if PFS is enabled.
- NAME compression [on|off]
-
This command allows to enable or disable compression. If compression is enabled, all data is being compressed before being sent through the VPN. This setting is ignored if the peer does not support this.
System Policies
The system comes with builtin policies that cannot be modified by the user. They are intended to provide good defaults for various situations.
|
system
|
This policy is the default for every VPN connection and allows using
all ciphers, integrity and key-exchange algorithms that are recommended
to use and have not been proven or assumed to be broken, yet.
|
|
performance
|
This policy is recommended to be used on systems that are not very powerful. Algorithms with smaller key lengths, but still considered to be secure are being used. |
System policies cannot be deleted.
AUTHORS
Michael Tremer