DH Group 24 phase 2

N2Z2 — Thu, 05 May 2022 15:54:50 GMT

Hi all,

could you confirm that pan does not support dh group 24 in phase 2?

I've a peer that (just a test, is an android device with native ikev2 psk vpn configured) asks for that group and I got this error

DH group id 24 != 20, responding with INVALID_KE_PAYLOAD

Thanks

Re: DH Group 24 phase 2

reaper — Thu, 05 May 2022 16:23:51 GMT

That's right, group 20 is currently the highest supported key exchange algorithm