🔒IPsec / IKE Crypto Profile Matcher
Compare VPN Phase 1 (IKE) and Phase 2 (IPsec) cryptographic proposals side-by-side in real-time. Detect algorithm, Diffie-Hellman group, and lifetime mismatches before applying them to your firewalls.
Load Configuration Examples (CLI)
Test the parsing engine by loading predefined Cisco, Fortinet, or Juniper configurations.
Understanding IPsec VPN Negotiation
To establish a secure IPsec tunnel, both routers or firewalls (known as Peers) must perform a series of negotiations divided into two independent phases. If the cryptographic profiles are not symmetric, the negotiation will fail immediately for security reasons.
Phase 1 (IKE / ISAKMP SA)
Establishes an initial secure, authenticated tunnel. In this phase, peers agree on the encryption method, integrity hash, and Diffie-Hellman (DH) group to create a temporary shared secret key.
Common errors: Negotiating IKEv1 on one end and IKEv2 on the other, or selecting different DH groups. These mismatches generate a NO_PROPOSAL_CHOSEN error in the initiation phase.
Phase 2 (IPsec / Data SA)
Defines the cryptographic parameters applied to encrypt the payload traffic traveling inside the VPN (usually via ESP protocol).
Importance of PFS (Perfect Forward Secrecy): PFS forces peers to renegotiate independent ephemeral keys using a new Diffie-Hellman exchange in Phase 2. If one peer has PFS enabled with a specific DH group and the other end has it disabled (None), Phase 1 will establish successfully, but Phase 2 will fail and no traffic will flow.
Practical Tips for VPN Debugging:
- Check firewall logs: Identify whether the failure occurs in Phase 1 (often logs referencing MM_KEY_EXCHANGE or aggressive mode) or Phase 2 (logs referencing Quick Mode or IPSEC SA).
- Lifetimes (Expiration times): Even though the tunnel might connect with mismatched lifetimes, uncoordinated rekeying is the #1 cause of tunnel instability and intermittent micro-outages. It is highly recommended to configure them identically on both sides.
- Modern DH Groups: Avoid using Group 2 and Group 5 as they are considered cryptographically weak. The current minimum recommended standard in enterprise environments is Group 14 (2048-bit) or elliptic curve groups like Group 19.