Project

General

Profile

Actions
Copy link

Bug #12948

closed
MM JP

IPsec Profile Wizard/Windows: Script generated for IKEv2 VPN using GCM does not use an optimal Phase 2 hash configuration

Bug #12948: IPsec Profile Wizard/Windows: Script generated for IKEv2 VPN using GCM does not use an optimal Phase 2 hash configuration

Added by Marcos M over 4 years ago. Updated over 3 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
IPsec Profile Wizard
Target version:
-
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:

Description

When mixing AE ciphers in a P2 with AEAD ciphers (e.g. AES with AES128-GCM), the wizard will generate a script with the following:

# Set VPN Config
Set-VpnConnectionIPsecConfiguration -Name "VPN (pfsense) - UNA IPsec VPN" `
 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -DHGroup Group14 `
 -CipherTransformConstants GCMAES128 -AuthenticationTransformConstants SHA256128 -PfsGroup None `
 -PassThru -Force

When using the "-GCM" ciphers, the wizard should default to using the most secure valid combination. In this case AuthenticationTransformConstants should be set to None. An invalid combination leads to a Windows error stating:

The IPsec cipher transform is not compatible with the policy.

Supported combinations and more details are listed here:
https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/description-support-suite-b-cryptographic-ipsec
https://docs.microsoft.com/en-us/powershell/module/vpnclient/set-vpnconnectionipsecconfiguration?view=win10-ps

Related issues 2 (0 open — 2 closed)

Related to Bug #13368: IPsec Profile Wizard/Windows: Cannot generate a script for IKEv2 VPN using GCM ciphers when mobile P2 has no hash algorithms selectedResolvedJim Pingle

Actions
Related to Bug #13877: IPsec Profile Wizard/Windows: IKEv2 VPN using GCM configured by the generated script fails to connect with "The IPsec cipher transform is not compatible with the policy"ResolvedJim Pingle

Actions

VG Updated by Viktor Gurov over 4 years ago Actions
Copy link
 #2

  • Assignee set to Viktor Gurov
  • Release Notes deleted (Default)

JP Updated by Jim Pingle over 4 years ago Actions
Copy link
 #3

  • Project changed from pfSense Plus to pfSense Packages
  • Category changed from IPsec to IPsec Profile Wizard
  • Status changed from New to Pull Request Review

VG Updated by Viktor Gurov over 4 years ago Actions
Copy link
 #4

  • Status changed from Pull Request Review to Feedback

Merged

MM Updated by Marcos M over 4 years ago Actions
Copy link
 #5

  • Status changed from Feedback to Resolved

Now works.

JP Updated by Jim Pingle over 3 years ago Actions
Copy link
 #6

  • Related to Bug #13368: IPsec Profile Wizard/Windows: Cannot generate a script for IKEv2 VPN using GCM ciphers when mobile P2 has no hash algorithms selected added

JP Updated by Jim Pingle over 3 years ago Actions
Copy link
 #7

  • Related to Bug #13877: IPsec Profile Wizard/Windows: IKEv2 VPN using GCM configured by the generated script fails to connect with "The IPsec cipher transform is not compatible with the policy" added

JP Updated by Jim Pingle over 3 years ago Actions
Copy link
 #8

  • Status changed from Resolved to New
  • Assignee changed from Viktor Gurov to Jim Pingle

JP Updated by Jim Pingle over 3 years ago Actions
Copy link
 #9

The code added here was incorrect, see #13368 and #13877

JP Updated by Jim Pingle over 3 years ago Actions
Copy link
 #10

  • Subject changed from IPsec Export: Windows generates invalid configuration to IPsec Profile Wizard/Windows: Script generated for IKEv2 VPN using GCM does not use an optimal Phase 2 hash configuration

JP Updated by Jim Pingle over 3 years ago Actions
Copy link
 #11

  • Status changed from New to Feedback
  • % Done changed from 0 to 100

Fixed in IPsec Profile Wizard pkg v. 1.1, which has been committed and will be available with the next build.

DZ Updated by Danilo Zrenjanin over 3 years ago Actions
Copy link
 #12

Tested against:

23.01-RC (amd64)
built on Thu Jan 26 21:31:39 UTC 2023
FreeBSD 14.0-CURRENT

ipsec-profile-wizard    net    1.1_1

The generated script looks fine:

# IKEv2 VPN Import Script
# Automatically generated by pfSense
Set-Location -Path $PSScriptRoot

# Import Server Certificate CA
Import-Certificate -FilePath "pfSense_ikev2_63d3a321cb738.pem" -CertStoreLocation Cert:\LocalMachine\Root\

# Add VPN Connection
Add-VpnConnection -Name "VPN (pftest2) - Remote-IPsec" -TunnelType "Ikev2" -EncryptionLevel Required `
  -ServerAddress IPsec_Cert -PassThru

# Set VPN Config
Set-VpnConnectionIPsecConfiguration -Name "VPN (pftest2) - Remote-IPsec" `
 -EncryptionMethod GCMAES128 -IntegrityCheckMethod SHA256 -DHGroup Group14 `
 -CipherTransformConstants GCMAES128 -AuthenticationTransformConstants GCMAES128 -PfsGroup PFS2048 `
 -PassThru -Force

I was able to import the config and connect successfully from Windows 10 machine.

This ticket can be resolved.

JP Updated by Jim Pingle over 3 years ago Actions
Copy link
 #13

  • Status changed from Feedback to Resolved

JP Updated by Jim Pingle over 3 years ago Actions
Copy link
 #14

I also closed out #13877 and #13368 since they were all related. Testing one means the others are also working.

Actions
Copy link

Also available in: Atom