Consequences of replacing CBC encryption with GCM on IPSec and IKE profiles

J.Smith575107 — Wed, 27 Aug 2025 08:23:39 GMT

I am looking to replace all existing CBC encryption with GCM within IPSec/ IKE crypto but need to be certain that functionality will remain.

What if any impact would this have on the existing profiles if changed?

Unfortunately could not find a definitive answer on the forums/ elsewhere. Many thanks.

Re: Consequences of replacing CBC encryption with GCM on IPSec and IKE profiles

reaper — Thu, 28 Aug 2025 13:26:54 GMT

Except for a little outage the moment you make the change on both sides, nothing would really change.

I'd double check to make sure each (IKE + IPSec) profile is only used by the intended ike gateway/ipsec tunnel. If you're using the same profile for all your gateways and tunnels, start by creating a fresh one and assigning that to the gateways/tunnels you intend to switch over so you can take it step by step. in some cases the transition may be a little less smoothly if the remote end is a different vendor.

remember to set authentication in the IKE profile to 'non-auth'

topic Re: Consequences of replacing CBC encryption with GCM on IPSec and IKE profiles in Next-Generation Firewall Discussions

Consequences of replacing CBC encryption with GCM on IPSec and IKE profiles

Re: Consequences of replacing CBC encryption with GCM on IPSec and IKE profiles