Using SHA1 for ipsec integrity for a VPN gateway point-to-site connection

Question

Using SHA1 for ipsec integrity for a VPN gateway point-to-site connection

kok boon 20

As referred from this page: https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about

The combination of AES256/SHA1/NONE is valid, but when trying to set the policy using

New-AzVpnClientIpsecParameter -IkeEncryption AES256 -IkeIntegrity SHA1 -DhGroup DHGroup24 -IpsecEncryption AES256 -IpsecIntegrity SHA1 -PfsGroup PFS24

got an error:

New-AzVpnClientIpsecParameter: Cannot validate argument on parameter 'IpsecIntegrity'. The argument "SHA1" does not belong to the set "GCMAES256,GCMAES128,SHA256" specified by the ValidateSet attribute.

KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-10-17T05:19:59.73+00:00

@kok boon

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to configure AES256/SHA1/NONE.

From the document you have shared,

However, from the command you have shared,

New-AzVpnClientIpsecParameter -IkeEncryption AES256 -IkeIntegrity SHA1 -DhGroup DHGroup24 -IpsecEncryption AES256 -IpsecIntegrity SHA1 -PfsGroup PFS24

I see you have used a PfsGroup of "PFS24" , which should be "None".

Can you please use "None" and let us know if the issue prevails?

Cheers,

Kapil
kok boon 20 Reputation points

2023-10-17T05:49:17.7266667+00:00

Hi @KapilAnanth-MSFT , same issue after changing to NONE
kok boon 20 Reputation points

2023-10-17T05:50:18.52+00:00

Hi @KapilAnanth-MSFT , same issue after changing to NONE
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-10-17T05:52:43.2766667+00:00
@kok boon

May I ask if it is the same error message you are getting this time?

If not, can you please share the error message?

Cheers,

Kapil
kok boon 20 Reputation points

2023-10-17T05:57:39.5333333+00:00

@KapilAnanth-MSFT hi yes, same error.

New-AzVpnClientIpsecParameter: Cannot validate argument on parameter 'IpsecIntegrity'. The argument "SHA1" does not belong to the set "GCMAES256,GCMAES128,SHA256" specified by the ValidateSet attribute.
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-10-18T08:53:30.61+00:00

@kok boon

Thanks for your feedback.

I shall check internally if SHA1 is supported still or only with certain SKUs and will get back to you shortly.

Cheers,

Kapil
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-10-20T06:28:50.81+00:00

@kok boon

Are you using vWAN VPN gateway or a regular VPN gateway?

Cheers,

Kapil
kok boon 20 Reputation points

2023-10-24T06:52:06.1833333+00:00

regular vpn gateway
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-10-26T08:28:24.7966667+00:00

@kok boon

Reaching out to check if there are any questions on this.

The document is now updated with this information as well

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.

Accepted answer

0 additional answers

Your answer

KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-10-17T05:19:59.73+00:00

@kok boon

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to configure AES256/SHA1/NONE.

From the document you have shared,

However, from the command you have shared,

New-AzVpnClientIpsecParameter -IkeEncryption AES256 -IkeIntegrity SHA1 -DhGroup DHGroup24 -IpsecEncryption AES256 -IpsecIntegrity SHA1 -PfsGroup PFS24

I see you have used a PfsGroup of "PFS24" , which should be "None".

Can you please use "None" and let us know if the issue prevails?

Cheers,

Kapil
kok boon 20 Reputation points

2023-10-17T05:49:17.7266667+00:00

Hi @KapilAnanth-MSFT , same issue after changing to NONE
kok boon 20 Reputation points

2023-10-17T05:50:18.52+00:00

Hi @KapilAnanth-MSFT , same issue after changing to NONE
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-10-17T05:52:43.2766667+00:00

@kok boon

May I ask if it is the same error message you are getting this time?

If not, can you please share the error message?

Cheers,

Kapil
kok boon 20 Reputation points

2023-10-17T05:57:39.5333333+00:00

@KapilAnanth-MSFT hi yes, same error.

New-AzVpnClientIpsecParameter: Cannot validate argument on parameter 'IpsecIntegrity'. The argument "SHA1" does not belong to the set "GCMAES256,GCMAES128,SHA256" specified by the ValidateSet attribute.
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-10-18T08:53:30.61+00:00

@kok boon

Thanks for your feedback.

I shall check internally if SHA1 is supported still or only with certain SKUs and will get back to you shortly.

Cheers,

Kapil
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-10-20T06:28:50.81+00:00

@kok boon

Are you using vWAN VPN gateway or a regular VPN gateway?

Cheers,

Kapil
kok boon 20 Reputation points

2023-10-24T06:52:06.1833333+00:00

regular vpn gateway
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-10-26T08:28:24.7966667+00:00

@kok boon

Reaching out to check if there are any questions on this.

The document is now updated with this information as well

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.

Answer 1

@kok boon

I checked this behavior internally and our Product Team confirmed that the supported "-IpsecIntegrity" values are GCMAES256, GCMAES128, SHA256 only.

The values provided in the What IKE/IPsec policies are configured on VPN gateways for P2S? are default values and are not available for a custom policy

You can refer to the supported values for any Parameters in the "Accepted values" section of New-AzVpnClientIpsecParameter for a Custom Policy

I have created a work item to update the document, highlighting the above.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.

Share via

Using SHA1 for ipsec integrity for a VPN gateway point-to-site connection

0 additional answers

Your answer