{"id":960,"date":"2026-07-14T21:43:58","date_gmt":"2026-07-14T18:43:58","guid":{"rendered":"https:\/\/mangen.kitabara.org\/?p=960"},"modified":"2026-07-14T21:52:13","modified_gmt":"2026-07-14T18:52:13","slug":"recommended-ikev2-ipsec-encryption-settings-best-practice","status":"publish","type":"post","link":"https:\/\/mangen.kitabara.org\/index.php\/recommended-ikev2-ipsec-encryption-settings-best-practice\/","title":{"rendered":"Recommended IKEv2 IPsec Encryption Settings (Best Practice)"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The following IKEv2 IPsec encryption values represent the best\u2011practice configuration I currently use and recommend:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>BOVPN Phase 1:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Encryption: <strong>AES\u2011GCM\u2011128<\/strong><\/li>\n\n\n\n<li>Diffie\u2011Hellman Group: <strong>19<\/strong><\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402e51e60&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402e51e60\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"630\" height=\"550\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Phase1_settings.png\" alt=\"\" class=\"wp-image-961\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Phase1_settings.png 630w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Phase1_settings-300x262.png 300w\" sizes=\"auto, (max-width: 630px) 100vw, 630px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><strong>BOVPN Phase 2:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Encryption: <strong>AES\u2011GCM\u2011128<\/strong><\/li>\n\n\n\n<li>Perfect Forward Secrecy (PFS): <strong>Group 19<\/strong><\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402e5239a&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402e5239a\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"540\" height=\"513\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Phase2_settings.png\" alt=\"\" class=\"wp-image-962\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Phase2_settings.png 540w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Phase2_settings-300x285.png 300w\" sizes=\"auto, (max-width: 540px) 100vw, 540px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><strong>Why GCM?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It is strongly recommended to migrate to <strong>GCM\u2011based<\/strong> algorithms. In most environments, <strong>128\u2011bit GCM<\/strong> provides more than sufficient security.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Compared to CBC, <strong>GCM128 offers stronger practical security than CBC256<\/strong>, and it is significantly more <strong>CPU\u2011efficient<\/strong>, which improves VPN performance and reduces load on both Firebox and client devices.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Phase 1 Considerations<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Phase 1 encryption values have minimal impact on actual VPN throughput. For this reason, you may choose to use stronger settings in Phase 1 if desired.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The maximum values supported by WatchGuard Firebox in Phase1 are:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AES\u2011GCM\u2011256<\/strong>, DH Group <strong>21<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>DH Group and PFS Guidance<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Minimum recommended DH Group is:<strong> 14<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DH Group and PFS selection is partly preference\u2011based, but WatchGuard provides clear guidance in the <a href=\"https:\/\/www.watchguard.com\/help\/video-tutorials\/Optimize_BOVPN\/index.html\" data-type=\"link\" data-id=\"https:\/\/www.watchguard.com\/help\/video-tutorials\/Optimize_BOVPN\/index.html\" target=\"_blank\" rel=\"noopener\">Optimize BOVPN Throughput<\/a> video.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>IKEv2 shared settings<\/strong> are used for all manual BOVPN tunnels and BOVPN virtual interfaces that use IKEv2 when at least one remote gateway has a dynamic IP address.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mobile VPN with IKEv2 also uses these shared settings<\/strong>. It always uses the <strong>highest\u2011priority Phase 1 transform<\/strong> from the shared settings in its own configuration.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402e52b2b&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402e52b2b\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"554\" height=\"753\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/IKEv2-mobile-shared-1.png\" alt=\"\" class=\"wp-image-970\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/IKEv2-mobile-shared-1.png 554w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/IKEv2-mobile-shared-1-221x300.png 221w\" sizes=\"auto, (max-width: 554px) 100vw, 554px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402e52f3d&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402e52f3d\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"550\" height=\"358\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/IKEv2-mobile-phase2.png\" alt=\"\" class=\"wp-image-968\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/IKEv2-mobile-phase2.png 550w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/IKEv2-mobile-phase2-300x195.png 300w\" sizes=\"auto, (max-width: 550px) 100vw, 550px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">If you configure <strong>AES\u2011GCM<\/strong> in the <em>IKEv2 Shared Settings<\/em> as the first option, the <strong>IKEv2 Client Profile download<\/strong> cannot create the Windows <strong>AddVPN.ps1<\/strong> installation script inside the IKEv2 *.tgz file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Instead, it creates an <strong>error.txt<\/strong> file. The error message incorrectly claims that the Windows IKEv2 client does not support AES\u2011GCM in Phase 1.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is <strong>not true<\/strong> \u2014 Windows 10 and Windows 11 fully support AES\u2011GCM for Phase 1.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A workaround is to move the <strong>AES\u2011GCM<\/strong> option to the <strong>second<\/strong> position in the IKEv2 Shared Settings. Then download the IKEv2 Client Profile from the Firebox. After the download, change AES\u2011GCM back to the <strong>first<\/strong> position again.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Edit the\u00a0<strong>AddVPN.ps1<\/strong>\u00a0file (found in the\u00a0<strong>IKEv2 Client Profile \\Windows\\ps<\/strong>\u00a0folder) and change the following settings.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>-AuthenticationTransformConstants &#8216;GCMAES128&#8217;<\/li>\n\n\n\n<li>-CipherTransformConstants &#8216;GCMAES128&#8217;<\/li>\n\n\n\n<li>-DHGroup &#8216;ECP256&#8217;<\/li>\n\n\n\n<li>-EncryptionMethod &#8216;GCMAES128&#8217;<\/li>\n\n\n\n<li>-IntegrityCheckMethod &#8216;SHA256&#8217;<\/li>\n\n\n\n<li>-PfsGroup &#8216;ECP256&#8217;<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"992\" height=\"309\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/IKEv2-Shared-settings-2-1.png\" alt=\"\" class=\"wp-image-965\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/IKEv2-Shared-settings-2-1.png 992w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/IKEv2-Shared-settings-2-1-300x93.png 300w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/IKEv2-Shared-settings-2-1-768x239.png 768w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/IKEv2-Shared-settings-2-1-980x305.png 980w\" sizes=\"auto, (max-width: 992px) 100vw, 992px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>The following IKEv2 IPsec encryption values represent the best\u2011practice configuration I currently use and recommend: BOVPN Phase 1: BOVPN Phase 2: Why GCM? It is strongly recommended to migrate to GCM\u2011based algorithms. In most environments, 128\u2011bit GCM provides more than sufficient security. Compared to CBC, GCM128 offers stronger practical security than CBC256, and it is&hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,4,2],"tags":[],"class_list":["post-960","post","type-post","status-publish","format-standard","hentry","category-ikev2","category-vpn","category-watchguard"],"_links":{"self":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/960","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/comments?post=960"}],"version-history":[{"count":5,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/960\/revisions"}],"predecessor-version":[{"id":973,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/960\/revisions\/973"}],"wp:attachment":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/media?parent=960"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/categories?post=960"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/tags?post=960"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}