pfSense » pfSense Packages

I was exporting a test config to Windows which had a large number of different P1 options, and the profile generated the following command:

Set-VpnConnectionIPsecConfiguration -Name "VPN (k9) - Mobile IPsec" `
 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -DHGroup Group2 `
 -CipherTransformConstants GCMAES128 -AuthenticationTransformConstants SHA256128 -PfsGroup PFS2048 `
 -PassThru -Force

This resulted in an error when Windows tried to connect:

The IPsec cipher transform is not compatible with the policy

Similar to #12948, but #12948 suggested setting AuthenticationTransformConstants to None which did not help this case, and it wasn't set that way in the profile as the previous fix there seemed to imply it should be.

In this case, I had to set AuthenticationTransformConstants to GCMAES128 and at that point it succeeded.

I have the server config handy that ended up exporting that in my lab.