IPsec Configuration

IPsec on pfSense® software offers numerous configuration options which influence the performance and security of IPsec connections. For most users performance is the most important factor. When crafting a configuration, carefully select options to ensure optimal efficiency while maintaining strong security and compatibility with equipment on both ends of a tunnel.

Tip

For low-to-moderate bandwidth usage deployments the options may not have significant impact on performance. Even so, take care not to use insecure options such as SHA1 or weak pre-shared keys.

Warning

pfSense software supports several options which are weak from a security standpoint. These are included for compatibility with third party vendors and equipment which do not support stronger options. The GUI includes warnings against using these options.

The next sections outline how to design an IPsec tunnel and the options available.

• IPsec Tunnel Design
  • IPsec Modes
  • Interface Selection
• IPsec Tunnels Tab
• Phase 1 Settings
  • General Information
  • IKE Endpoint Configuration
  • Phase 1 Proposal (Authentication)
  • Phase 1 Proposal (Encryption Algorithm)
  • Expiration and Replacement
  • Advanced Options
• Phase 2 Settings
  • General Information
  • Networks
  • Phase 2 Proposal (SA/Key Exchange)
  • Expiration and Replacement
  • Keep Alive
• IPsec Mobile Clients Tab
  • Enable
  • Extended Authentication
  • Client Configuration
• IPsec Pre-Shared Keys Tab
• Advanced IPsec Settings