Overview

You can create a secure tunnel between two LANs secured by a firewall. This article describes creating an IPsec VPN tunnel between Kerio Control and another device. Before you start, read the topic which describes Kerio Control settings.

Back to top

---

 

Information

This section includes default and supported values for IPsec implemented in Kerio Control. Both endpoints should be able to communicate automatically. If a problem occurs and you have to set the values manually, consult the following tables for default and supported values in Kerio Control. Kerio Control uses the default values. Remote endpoints of the tunnel can also use the recommended values.

 

Phase 1 (IKE):

Variable	Default values	Supported values	Unsupported values
Mode	Main	NA	Aggressive
Remote ID type	hostname	IP address	NA
NAT Traversal	enabled	NA	NA
Ciphersuite (policies)	aes128-sha1-modp2048,3des-sha1-modp1536	NA	NA
Version	IKEv1, IKEv2	NA	NA
DPD Timeouts	enabled (150 sec)	NA	NA
Lifetime	3 hours	NA	NA

 

Phase 2 (ESP):

Variable	Supported Values	Unsupported Values
Mode	Tunnel	Transport
Protocol	ESP	AH
Ciphersuite (policies)	aes128-sha1, 3des-sha1	NA
PFS	off	NA
Lifetime	60 mins	NA

Supported ciphers

Each cipher consists of three parts:

• Encryption Algorithm — for example, aes128
• Integrity Algorithm — for example, sha1
• Diffie Hellman Groups — for example, modp2048

Kerio Control supports the following ciphers:

Phase 1 (IKE) - supported ciphers

Encyption Algorithms	Integrity Algorithms	Diffie Hellman Groups
aes128 or aes (128 bit AES-CBC) aes192 (192 bit AES-CBC) aes256 (256 bit AES-CBC) 3des (168 bit 3DES-EDE-CBC)	md5 (MD5 HMAC) sha1 or sha (SHA1 HMAC) sha2_256 or sha256 (SHA2_256_128 HMAC) sha2_384 or sha384 (SHA2_384_192 HMAC) sha2_512 or sha512 (SHA2_512_256 HMAC)	2 (modp1024) 5 (modp1536) 14 (modp2048) 15 (modp3072) 16 (modp4096) 18 (modp8192) 22 (modp1024s160) 23 (modp2048s224) 24 (modp2048s256)

 

Phase 2 (ESP) - supported ciphers

Encyption Algorithms	Integrity Algorithms	Diffie Hellman Groups
aes128 or aes (128 bit AES-CBC) aes192 (192 bit AES-CBC) aes256 (256 bit AES-CBC) 3des (168 bit 3DES-EDE-CBC) blowfish256 (256 bit Blowfish-CBC)	md5 (MD5 HMAC) sha1 or sha (SHA1 HMAC) aesxcbc (AES XCBC)	none (no PFS) 2 (modp1024) 5 (modp1536) 14 (modp2048) 15 (modp3072) 16 (modp4096) 18 (modp8192) 22 (modp1024s160) 23 (modp2048s224) 24 (modp2048s256)

Back to top