FIPS mode IPSec cipher suite subset

[jlivingston]

When you enable FIPS mode on the firewall, what are the subsets of cipher suites available that the admin guide is referring to?

Admin guide -

"When configuring IPSec, a subset of the normally available cipher suites is available."

[mikand]

Yeah PA should update that documentation to really specify which cipher suites are supported.

Found this post in this forum but its regarding SSL:

and this one that only Group 14 is supported in FIPS mode regarding IKE/IPSEC:

I asked a similar question for more than a year ago but very limited replies 😃

And in case someone from PA finds this thread, would be nice with a followup for aswell

[zarina · Accepted solution]

The ciphers supported under FIPS for ipsec are: HMAC-SHA-1 with either AES128, AES192, or AES256.  If perfect forward secrecy is required, only DH Group 14 is permitted.

[jlivingston]

Thanks a ton sdarapuneni.