IKE Group - Encryption

Topics:

• Cryptographic suites
• What to do when using a firewall
• Encryption and firewall mapping

In the IKE Group > Encryption section, you can find the cryptographic suites. Each suite consists of three elements:

• an encryption algorithm (AES, Camellia, Blowfish, etc.);
• an operating mode (CBC, CCM, GCM, etc.);
• security parameters, such as the key length (128, 192, or 256 bits) and, where required, the integrity tag length (ICV - Integrity Check Value).

Cryptographic suites are not standalone protocols: they are configurations used by IPSec/IKE to determine how data in your VPN is encrypted and authenticated.

Different firewall vendors (such as Cisco, Fortinet, etc.) use different names, often abbreviated, for the same cryptographic algorithms.
 
For the tunnel to work correctly, you must configure the same cryptographic suite on both sides, even if the name differs from one device to another. The following table helps you identify the mapping between the extended format used by Aruba Cloud and the abbreviated format typically used by firewalls.

The following table shows the mapping between the cryptographic suite format you may find on your firewall and the format used by Aruba Cloud.
 

Firewall algorithm	Aruba Cloud algorithm
aes128 aes192 aes256	128 bit AES-CBC 192 bit AES-CBC 256 bit AES-CBC
aes128ccm64 aes128ccm96 aes128ccm128	128 bit AES-CCM with 64 bit ICV 128 bit AES-CCM with 96 bit ICV 128 bit AES-CCM with 128 bit ICV
aes192ccm64 aes192ccm96 aes192ccm128	192 bit AES-CCM with 64 bit ICV 192 bit AES-CCM with 96 bit ICV 192 bit AES-CCM with 128 bit ICV
aes256ccm64 aes256ccm96 aes256ccm128	256 bit AES-CCM with 64 bit ICV 256 bit AES-CCM with 96 bit ICV 256 bit AES-CCM with 128 bit ICV
aes128ctr aes192ctr aes256ctr	128 bit AES-COUNTER 192 bit AES-COUNTER 256 bit AES-COUNTER
aes128gcm64 aes128gcm96 aes128gcm128	128 bit AES-GCM with 64 bit ICV 128 bit AES-GCM with 96 bit ICV 128 bit AES-GCM with 128 bit ICV
aes192gcm64 aes192gcm96 aes192gcm128	192 bit AES-GCM with 64 bit ICV 192 bit AES-GCM with 96 bit ICV 192 bit AES-GCM with 128 bit ICV
aes256gcm64 aes256gcm96 aes256gcm128	256 bit AES-GCM with 64 bit ICV 256 bit AES-GCM with 96 bit ICV 256 bit AES-GCM with 128 bit ICV
aes128gmac aes192gmac aes256gmac	Null encryption with 128 bit AES-GMAC Null encryption with 192 bit AES-GMAC Null encryption with 256 bit AES-GMAC
blowfish128 blowfish192 blowfish256	128 bit Blowfish-CBC 192 bit Blowfish-CBC 256 bit Blowfish-CBC
camellia128 camellia192 camellia256	128 bit Camellia-CBC 192 bit Camellia-CBC 256 bit Camellia-CBC
camellia128ccm64 camellia128ccm96 camellia128ccm128	128 bit Camellia-CCM with 64 bit ICV 128 bit Camellia-CCM with 96 bit ICV 128 bit Camellia-CCM with 128 bit ICV
camellia192ccm64 camellia192ccm96 camellia192ccm128	192 bit Camellia-CCM with 64 bit ICV 192 bit Camellia-CCM with 96 bit ICV 192 bit Camellia-CCM with 128 bit ICV
camellia256ccm64 camellia256ccm96 camellia256ccm128	256 bit Camellia-CCM with 64 bit ICV 256 bit Camellia-CCM with 96 bit ICV 256 bit Camellia-CCM with 128 bit ICV
camellia128ctr camellia192ctr camellia256ctr	128 bit Camellia-COUNTER 192 bit Camellia-COUNTER 256 bit Camellia-COUNTER
cast128	128 bit CAST-CBC
chacha20poly1305	256 bit ChaCha20/Poly1305 with 128 bit ICV
serpent128 serpent192 serpent256	128 bit Serpent-CBC 192 bit Serpent-CBC 256 bit Serpent-CBC
twofish128 twofish192 twofish256	128 bit Serpent-CBC 192 bit Serpent-CBC 256 bit Serpent-CBC
3des	168 bit 3DES-EDE-CBC

Related guides:

VPN Tunnel service

Managing the VPN Tunnel

Creating and managing a VPN Route

Deleting the VPN Tunnel