VPN is a tunneling technology that provides IP-layer security using the IKE/IPsec protocol suite. It ensures confidentiality and integrity of IP data packets and prevents them from being intercepted, disclosed, or tampered with on insecure networks (such as the Internet).

When creating a VPN connection, you can configure data encryption and authentication algorithms in a policy.

Table 1 lists the algorithms recommended for VPN in descending order of security.

**Table 1** Parameters for configuring a VPN policy
Parameter		Description
IKE Policy	Version	v2 v1 (v1 has low security. If the device supports v2, v2 is recommended.) The default value is v2.
	Authentication Algorithm	Hash algorithm used for authentication. The following algorithms are supported: SHA2-512 SHA2-384 SHA2-256 MD5(Insecure. Not recommended.) SHA1(Insecure. Not recommended.) By default, the SHA2-256 algorithm is used.
	Encryption Algorithm	The following encryption algorithms are supported: AES-256-GCM-16 (supported only by Enterprise Edition VPN) AES-128-GCM-16 (supported only by Enterprise Edition VPN) AES-256(Insecure. Not recommended.) AES-192(Insecure. Not recommended.) AES-128(Insecure. Not recommended.) 3DES(Insecure. Not recommended.) By default, the AES-128 algorithm is used.
	DH Algorithm	The following algorithms are supported: Group 21 Group 20 Group 19 Group 16 Group 15 Group 14(Insecure. Not recommended.) Group 5(Insecure. Not recommended.) Group 2(Insecure. Not recommended.) Group 1(Insecure. Not recommended.) By default, Group 15 is used.
IPsec Policy	Authentication Algorithm	Hash algorithm used for authentication. The following algorithms are supported: SHA2-512 SHA2-384 SHA2-256 MD5(Insecure. Not recommended.) SHA1(Insecure. Not recommended.) By default, the SHA2-256 algorithm is used.
IPsec Policy	Encryption Algorithm	The following encryption algorithms are supported: AES-256-GCM-16 AES-128-GCM-16 AES-256(Insecure. Not recommended.) AES-192(Insecure. Not recommended.) AES-128(Insecure. Not recommended.) 3DES(Insecure. Not recommended.) By default, the AES-128 algorithm is used.

PFS

Perfect Forward Secrecy (PFS) ensures that the compromise of the keys of an IPsec tunnel does not affect the security of other tunnels by leveraging that the keys of these tunnels are irrelevant to each other. By default, the PFS function is enabled for VPN.

Each IPsec VPN connection consists of at least one IPsec tunnel, each of which uses an independent set of keys to protect user traffic.

VPN supports the following algorithms:

DH group 1 (This algorithm is insecure. Exercise caution when using it.)
DH group 2 (This algorithm is insecure. Exercise caution when using it.)
DH group 5 (This algorithm is insecure. Exercise caution when using it.)
DH group 14
DH group 15
DH group 16
DH group 19
DH group 20
DH group 21

Anti-replay

Anti-replay uses sequence numbers to protect IPsec encrypted packets against replay attacks, which are initiated by repeatedly sending intercepted data packets. By default, the anti-replay function is enabled for the VPN service.

Resource Isolation

A VPN gateway is exclusive to a tenant. As such, tenants are isolated from each, ensuring tenant data security.

Data Protection Technologies

PFS

Anti-replay

Resource Isolation