Citrix SD-WAN

Configure Virtual WAN IPsec for FIPS Compliant operation

March 12, 2021

Contributed by:

S C

IPSec security setting enhancements are supported with addition of DH groups and random number generator functionality for compliance with Federal Standards.

To configure Virtual Path IPsec Settings:

Enable Virtual Path IPsec Tunnels for all Virtual Paths where FIPS compliance is required. IPsec settings for Virtual Paths are controlled via Default Sets.
Configure message authentication by changing the IPsec Mode to AH or ESP+Auth and use a FIPS approved hashing function. SHA1 is accepted by FIPS, but SHA256 is highly recommended.
IPsec lifetime should be configured for no more than eight hours (28,800 seconds).

The Virtual WAN uses IKE version 2 with pre-shared-keys to negotiate IPsec tunnels through the Virtual Path using the following settings:

DH Group 19: ECP256 (256-bit Elliptic Curve) for key negotiation
256-bit AES-CBC Encryption
SHA256 hashing for message authentication
SHA256 hashing for message integrity
DH Group 2: MODP-1024 for Perfect Forward Secrecy

To configure IPsec Tunnel for a third party, use the following settings:

Configure FIPS approved DH Group. Groups 2 and 5 are permissible under FIPS, however groups 14 and above are highly recommended.
Configure FIPS approved hash function. SHA1 is accepted by FIPS, however SHA256 is highly recommended.
If using IKEv2, configure a FIPS approved integrity function. SHA1 is accepted by FIPS, however SHA256 is highly recommended.
Configure an IKE lifetime, and max lifetime, of no more than 24 hours (86,400 seconds).
Configure IPsec message authentication by changing the IPsec Mode to AH or ESP+Auth and use a FIPS approved hashing function. SHA1 is accepted by FIPS, but SHA256 is highly recommended.
Configure an IPsec lifetime, and max lifetime, of no more than eight hours (28,800 seconds).

To configure IPSec tunnels:

On the MCN appliance, go to Configuration > Virtual WAN > Configuration Editor. Open an existing configuration package. Click the Advanced tab. Go to Connections > IPSec Tunnels.
Expand IKE Settings. Configure groups in DH Group drop-down list.
Expand IPsec Settings. Configure groups in the PFS Group drop-down list.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Configure Virtual WAN IPsec for FIPS Compliant operation

March 12, 2021

Contributed by:

S C

March 12, 2021

Contributed by:

S C

Configure Virtual WAN IPsec for FIPS Compliant operation

In this article