IPSec VPN from Azure to Oracle Cloud Using PfSense on Azure

Reply to IPSec VPN from Azure to Oracle Cloud Using PfSense on Azure on Wed, 05 Jun 2019 15:22:49 GMT

JeGr — Wed, 05 Jun 2019 15:22:49 GMT

No problems. A pity that the oracle side is such a downgrade in security... SHA1 and anything smaller then 3k in PFS Key Groups should be shamed in 2019. And we haven't even talked about supporting AES-GCM yet...

Anyway nice you got it working with that.

Cheers,
Jens

Reply to IPSec VPN from Azure to Oracle Cloud Using PfSense on Azure on Wed, 05 Jun 2019 13:50:10 GMT

tharu.rtk — Wed, 05 Jun 2019 13:50:10 GMT

Hi Je,

Thanks for the quick response. Actually i changed the configuration as you suggested and it worked and i was able to established the VPN connection. Unfortunately from Oracle side there is no way to change the VPN configuration. My configuration shown below;

Phase I
Encryption Algorithm: AES
Key Length : 256
Hash : Sha1
DH Group : Group 5 (1536 bit)
Peer Detection : Disable

Phase II
Protocol : ESP
Encryption Algorithm : AES 256 Bit
Hash Algorithm : SHA 1
PFS Key Group : 5

Cheers mate. Thank you so much for the support :)

Reply to IPSec VPN from Azure to Oracle Cloud Using PfSense on Azure on Wed, 05 Jun 2019 10:32:14 GMT

JeGr — Wed, 05 Jun 2019 10:32:14 GMT

Thats IPSEC Phase 1 error, as you have nothing configured, that is matching the proposal from the remote site.

Yours is: AES 128 (CBC) with SHA256 and DH Group 6(? 2048bits).

They need at least: AES 192, better AES-256 (CBC, not GCM from that string) with SHA256 or SHA384 (I'd use 384 at least) and a DH Group of LOUSY 1536 bits or lower.

You should really check if that other side (oracle I suppose) could be configured to higher standards. Anything DH below 2k shouldn't be in use anymore. Even better use elliptic curves (DH Group 28-31 for example).

For them to have max DH Group to 1536 bits and even offering as low as 768 and offering SHA1 is really really disheartening from a security standpoint.