1

I am trying to setup a VPN connection on Ubuntu 20.04 using Strongswan. One of the requirements for the tunnel is to use PFS group 20.

Is the PFS group 20 being set when we have the following line in ipsec.conf?

  esp=aes256-sha512-ecp384

Thank you~!

Improve this question

1 Answer 1

Reset to default
2

Yes, PFS (or rather Diffie-Hellman) group 20 for IKE/IKEv2 is the 384-bit random ECP group defined in RFC 5903. So adding ecp384 to the ESP proposal is correct.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .