Making the IPsec policy compliant with DR mode

On the version 5 SNS firewall:

  1. Go to Configuration > VPN > IPsec VPN > Peers tab.
  2. Select the peer to be made compatible with DR mode (Remote gateways and Mobile peers).
  3. In the Advanced properties section, select the DR compliant checkbox.

Peer settings that are not DR compliant are framed in red.

Follow the procedures below to change these settings if necessary.

Changing the IKE version used by the peer

  1. Select IKEv2 for the IKE version field.

  2. This change must also be made on the peer in question. If it is a mobile tunnel, follow the compliance procedure described in the section Creating a DR-compliant tunnel on a mobile client .

Changing the authentication method used by the peer

  1. In the Identification section, set the Authentication method field to Certificate.
  2. Fill in the Peer ID field. This field must use one of the following formats:
    • Distinguished Name (DN). This is the subject of the peer certificate (e.g., C=FR,ST=Nord,L=Villeneuve d'Ascq,O=Stormshield,OU=Documentation,CN=DR-Compliant-Gateway-Peer.stormshield.eu),
    • Subject Alternative Name (SAN). This is one of the aliases that may be defined when the peer certificate is created (e.g., DR-Compliant-Gateway-Peer.stormshield.eu).

    NOTE
    The possible length of a certificate's subject may cause compatibility issues with third-party devices (encryption mechanisms encryption mechanisms, VPN gateways, etc. that are not SNS firewalls). In this case, you are strongly advised to use the SAN that was set when the peer certificate was created.

  1. This change must also be made on the peer in question. If it is a mobile tunnel, follow the compliance procedure described in the section Creating a DR-compliant tunnel on a mobile client .

Changing authentication and encryption algorithms

  1. In the General section, ensure that the IKE profile field is set to a DR-compliant profile (DR profile provided by default or custom profile - My DR Profile in this example).
  2. This change must also be made on the peer in question. If it is a mobile tunnel, follow the compliance procedure described in the section Creating a DR-compliant tunnel on a mobile client .

Adding the trust chain that was used to sign certificates in the list of Approved certification authorities

  1. Go to Configuration > VPN > IPsec VPN > Identification tab.
  2. In the Approved certification authorities grid, check whether the entire trust chain is there, meaning from the Root CA to the sub-CA that signed the certificates used for DR mode (IPsec-DR-CA in this example).
  3. If this is not the case, click on Add and select the certification authority in question.

  4. This change must also be made on the peer in question. If it is a mobile tunnel, follow the compliance procedure described in the section Creating a DR-compliant tunnel on a mobile client .

Optional - Setting DR encryption profiles (or compatible custom profiles) as default profiles

This procedure makes it possible to set DR profiles (or compatible custom profiles) as the profiles suggested by default for all future peers, and all IPsec rules that must be created on the firewall.

  1. Go to Configuration > VPN > IPsec VPN > Encryption profiles tab.
  2. In the menu on the left, under the IKE section, select the DR profile (or custom DR-compliant profile).
    Ensure that the profile has the following characteristics:
    • Two Diffie-Hellman profiles are offered: DH28 Brainpool Elliptic Curve Group (256-bits), selected by default, and DH19 NIST Elliptic Curve Group (256-bits).
    • The AES_GCM_16 algorithm is selected as the default proposal, and AES_CTR as the second proposal.

    The Encryption strength of the chosen algorithm must not be changed.

  3. Click on the Actions menu.
  4. Select Define the default profile.
    This IKE profile is now used by default for new IPsec tunnels that are added to the firewall's configuration.
  5. In the menu on the left, under the IPsec section, select the DR profile (or custom DR-compliant profile).
    Ensure that the profile has the following characteristics:
    • The HMAC_SHA256 algorithm is selected as the authentication proposal.
    • The AES_GCM_16 algorithm is selected as the default encryption proposal, and AES_CTR as the second proposal.

    The Encryption strength of the chosen algorithm must not be changed.

  6. Click on the Actions menu.
  7. Select Define the default profile.
    This IPsec profile is now used by default for IPsec tunnels defined in the firewall's configuration.