IPSec Deprecated Cipher Suites not proposed even though configured via web configurator
pooperman last edited by
I'm setting up a proof of concept / demo VPN connection with some older hardware which don't support the higher DH Groups (14 and above).
In the web configurator the DH Groups 1,2 and 5 are still valid options. But StongSwan doses not list them as configured proposals when IPSec negotiation is occurring.
So i am wondering if there is a config we can change to enable the weak cipher suites for testing purposes?
If you have them configured on a P1 or P2 they should be proposed and used if needed.
You'll need to show the contents of your
/var/etc/ipsec/ipsec.confand the related IPsec logs to tell anything for sure.