All, First, please forgive me if this has been asked before, I wasn't able to find anything conclusive with any good explanation. Recently I renewed a couple of web server certificates and in doing so the CA recommended that I use SHA2 with a 256-bit message digest as SHA1 was known to have been cracked and was weak. This lead to some further digging on some of the crypto stuff for the PAN firewalls and noticed that a site-to-site IPsec tunnel I had setup nearly a year ago is using SHA1 (both are PAN firewalls). My current config is: IKE Crypto is using: Encryption - aes128, 3des Authentication - sha1 DH Group - group2 Lifetime - 8 hours IPsec Crypto is using: ESP/AH - ESP Encryption - aes128, 3des Authentication - sha1 DH Group - group2 Lifetime - 1 hours I kinda followed the 'book' based on PAN's documentation from a couple years ago, and some of the details are coming back to me, but what I am wondering if implementing some of the higher encryption/authentication standards can be done by stacking. I believe I can do this on both sides with no problem, but what I am little fuzzy on is the DH group setting and does that need to be adjusted. I found this site that explained the details a little bit more: Help - IBM z/OS Management Facility. Additionally what has been your experience with using AES256 over AES128 for encryption - any performance issues? (IPsec crypto also supports AES128 CCM16). And for Authentication SHA512 over SHA256? Thanks for any help.
... View more
