Modifying encryption algorithms on client workstations

Microsoft Windows uses outdated encryption algorithms by default: 3DES, SHA1 and Diffie-Hellmann DH2 group.

It is necessary to modify them to increase security and to be compatible with the algorithms selected on the firewall.

1. Launch the Microsoft Powershell utility.
2. Enter the following command:

Set-VpnConnectionIPsecConfiguration -ConnectionName <connection_name> -AuthenticationTransformConstants GCMAES256 -CipherTransformConstants GCMAES256 -EncryptionMethod GCMAES256 -IntegrityCheckMethod SHA256 -PfsGroup ECP256 -DHGroup ECP256 -PassThru -Force

Where the parameter <ConnectionName> corresponds to the name of the VPN connection created in the Configure Microsoft Windows VPN Client section. In this example: vpn-eap-tls.

The command returns the update information:

IMPORTANT
If you are configuring a VPN connection for all users or a device tunnel, you need to add the parameter "-AllUserConnection" to the "Set-VpnConnectionIPsecConfiguration" command.