topic FIPS mode IPSec cipher suite subset in General Topics https://live.paloaltonetworks.com/t5/general-topics/fips-mode-ipsec-cipher-suite-subset/m-p/21474#M15679 <HTML><HEAD></HEAD><BODY><P>When you enable FIPS mode on the firewall, what are the subsets of cipher suites available that the admin guide is referring to?</P><P></P><P>Admin guide - </P><P> "When configuring IPSec, a subset of the normally available cipher suites is available."</P></BODY></HTML> Wed, 03 Apr 2013 17:10:19 GMT jlivingston 2013-04-03T17:10:19Z FIPS mode IPSec cipher suite subset https://live.paloaltonetworks.com/t5/general-topics/fips-mode-ipsec-cipher-suite-subset/m-p/21474#M15679 <HTML><HEAD></HEAD><BODY><P>When you enable FIPS mode on the firewall, what are the subsets of cipher suites available that the admin guide is referring to?</P><P></P><P>Admin guide - </P><P> "When configuring IPSec, a subset of the normally available cipher suites is available."</P></BODY></HTML> Wed, 03 Apr 2013 17:10:19 GMT https://live.paloaltonetworks.com/t5/general-topics/fips-mode-ipsec-cipher-suite-subset/m-p/21474#M15679 jlivingston 2013-04-03T17:10:19Z Re: FIPS mode IPSec cipher suite subset https://live.paloaltonetworks.com/t5/general-topics/fips-mode-ipsec-cipher-suite-subset/m-p/21475#M15680 <HTML><HEAD></HEAD><BODY><P>Yeah PA should update that documentation to really specify which cipher suites are supported.</P><P></P><P>Found this post in this forum but its regarding SSL:</P><P></P><P><A __default_attr="8418" __jive_macro_name="message" class="jive_macro jive_macro_message" href="https://live.paloaltonetworks.com/"></A></P><P></P><P>and this one that only Group 14 is supported in FIPS mode regarding IKE/IPSEC:</P><P></P><P><A __default_attr="2721" __jive_macro_name="document" class="jive_macro jive_macro_document" href="https://live.paloaltonetworks.com/"></A></P><P></P><P>I asked a similar question for more than a year ago but very limited replies <span class="lia-unicode-emoji" title=":grinning_face_with_big_eyes:">😃</span></P><P></P><P><A __default_attr="11930" __jive_macro_name="message" class="jive_macro jive_macro_message" href="https://live.paloaltonetworks.com/"></A></P><P></P><P>And in case someone from PA finds this thread, would be nice with a followup for <A __default_attr="21363" __jive_macro_name="message" class="jive_macro jive_macro_message" href="https://live.paloaltonetworks.com/"></A> aswell <img id="smileyhappy" class="emoticon emoticon-smileyhappy" src="https://live.paloaltonetworks.com/i/smilies/16x16_smiley-happy.png" alt="Smiley Happy" title="Smiley Happy" /></P></BODY></HTML> Wed, 03 Apr 2013 19:59:01 GMT https://live.paloaltonetworks.com/t5/general-topics/fips-mode-ipsec-cipher-suite-subset/m-p/21475#M15680 mikand 2013-04-03T19:59:01Z Re: FIPS mode IPSec cipher suite subset https://live.paloaltonetworks.com/t5/general-topics/fips-mode-ipsec-cipher-suite-subset/m-p/21476#M15681 <HTML><HEAD></HEAD><BODY><P>The ciphers supported under FIPS for ipsec are: <SPAN style="font-family: 'Lucida Grande', 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 12px; background-color: #ffffff;">HMAC-SHA-1 with either AES128, AES192, or AES256.&nbsp; If perfect forward secrecy is required, only DH Group 14 is permitted.</SPAN></P></BODY></HTML> Wed, 03 Apr 2013 19:59:16 GMT https://live.paloaltonetworks.com/t5/general-topics/fips-mode-ipsec-cipher-suite-subset/m-p/21476#M15681 zarina 2013-04-03T19:59:16Z Re: FIPS mode IPSec cipher suite subset https://live.paloaltonetworks.com/t5/general-topics/fips-mode-ipsec-cipher-suite-subset/m-p/21477#M15682 <HTML><HEAD></HEAD><BODY><P>Thanks a ton sdarapuneni.</P></BODY></HTML> Wed, 03 Apr 2013 20:09:38 GMT https://live.paloaltonetworks.com/t5/general-topics/fips-mode-ipsec-cipher-suite-subset/m-p/21477#M15682 jlivingston 2013-04-03T20:09:38Z