IPSEC chachapoly support, windows clients parameters?

[periko]

Hello guys.

The new cipher for IPSEC Chachapoly:

Support for ChaCha20-Poly1305 encryption with IPsec

I want to setup EAP-MSCHAPv2 and EAP-TLS but would like to know the settings to use with this new cipher under IPSEC?

🔒 Log in to view

Any help will be appreciated, thanks!!!

[jimp]

As far as I'm aware, Windows doesn't support ChaCha20-Poly1305 for IPsec yet.

If it did, it would be listed in their docs for configuring VPN parameters:

https://learn.microsoft.com/en-us/powershell/module/vpnclient/set-vpnconnectionipsecconfiguration

[periko]

@jimp I was thinking that maybe Windows will be limited about this, them ipsec site to site between 2 pfsense boxes could benefit from this new feauture.
Thanks master.

[jimp]

Yes, it does work pfSense <-> pfSense and also with TNSR (TNSR <-> TNSR and TNSR <-> pfSense).

It may not be any faster than AES-GCM depending on your setup but the only way to know for sure is to test it on your own hardware, environment, and workload.