Skip to main content
Version: current

profile

ip/ipsec/profile​

Type: Directory

Profiles define a set of parameters used for IKE negotiation during Phase 1. These parameters can be shared with other peer configurations.

FlagNameDescription
*defaultWhether the item is the default.
ArgumentTypeDescription
name ( mandatory )stringProfile name.
hash-algorithmenum (md5 | sha1 | sha256 | sha384 | sha512)Hash algorithm.
prf-algorithmenum (auto | sha1 | sha256 | sha384 | sha512)PRF algorithm (IKEv2 only).
enc-algorithmubit (aes-256, aes-192, aes-128, 3des, des)Encryption algorithm.
dh-groupubit (x25519, ecp256, ecp384, ecp521, modp6144, modp4096, modp3072, modp2048, modp1536, modp1024, modp768)Diffie-Hellman group.
lifetimetimePhase 1 lifetime (IKEv1 only).
lifebytesnumPhase 1 lifetime in bytes (IKEv1 only). It is used only as an administrative value which is added to the proposal. Used in cases where the remote peer requires a specific lifebytes value to establish phase 1.
proposal-checkenum (obey | strict | claim | exact) { obey:1, strict:2, claim:3, exact:4 }

Phase 2 lifetime check logic:

  • claim - take the shortest of proposed and configured lifetimes and notify the initiator about it.
  • exact - require lifetimes to be the same.
  • obey - accept whatever is sent by an initiator.
  • strict - if the proposed lifetime is longer than the default then reject the proposal otherwise accept a proposed lifetime.
nat-traversalboolUse Linux NAT-T mechanism to solve IPsec incompatibility with NAT routers between IPsec peers. This can only be used with the ESP protocol (AH is not supported by design, as it signs the complete packet, including the IP header, which is changed by NAT, rendering the AH signature invalid). The method encapsulates IPsec ESP traffic into UDP streams in order to overcome some minor issues that make ESP incompatible with NAT.
ppkenum (no | psk | qkd | psk-ike-initial)Post-quantum preshared key (IKEv2 only).
dpd-intervalalt { special: enum (disable-dpd) { disable-dpd:0 } , num: time [ .. 3600] }Dead peer detection interval.
dpd-maximum-failuresnumMaximum DPD failures before peer is considered dead (IKEv1 only).