Security Policies

General Syntax

network vpn security-policies <name> <key> <value>

The examples below are for a policy called "secure".

New

network vpn security-policies new secure

Destroy

network vpn security-policies destroy secure

Integrity

Adding values should be possible by prepending a + or - character:

network vpn security-policies secure integrity +SHA512 +SHA384 -SHA256
network vpn security-policies secure integrity SHA512

Ciphers

Same as above:
network vpn security-policies secure cipher +AES256 +AES192 -AES128

Group Type

network vpn security-policies secure group-type +MODP4096

Compression

network vpn security-policies secure compression on
network vpn security-policies secure compression off

Key Exchange

network vpn security-policies secure key-exchange ikev2
network vpn security-policies secure key-exchange ikev1

Perfect Forward Secrecy

network vpn security-policies secure pfs on
network vpn security-policies secure pfs off

IKE/ESP Key Lifetime

network vpn security-policies secure lifetime 3600

Defaults

There should be a policy that cannot be modified called system which we just build in with our defaults. If a new one is created, it should create a copy of the system one which then can be modified.

The system one will change over time, but any copies won't.

Show it all

$ network vpn security-policies secure show
Security Policy: secure

  Ciphers:
    AES-256, AES-128

  Integrity:
    SHA-512, SHA-384, MD5 (broken)

  Group Types:
    MODP-8192, MODP-4096, ECP-192

  Perfect Forward Secrecy:   enabled
  Key Lifetime:              1h

  Compression:               enabled

To use it (later)

network vpn ipsec Connection1 security-policy secure

Possible Values