IPsec tunnel fields

The following fields define an IPsec tunnel profile.

Table:

Field	Description
Connection ID	A unique identifier for the tunnel on the selected application instance.
Local endpoint (left)	The IP address of the application instance. This value is authoritative for the local side of the security association and is populated automatically.
Peer endpoint (right)	The IP address of the remote host that the appliance negotiates the tunnel with.
Mode	The IPsec mode for the tunnel. Host-to-host (transport mode) is the only supported mode.
IKE version	The IKE version policy for the tunnel. The appliance uses IKEv2 and rejects peers that attempt to negotiate IKEv1.
IKE algorithm	One or more encryption, integrity, and Diffie-Hellman group combinations (proposals) used to establish the IKE security association. You can select multiple proposals. Choose from the FIPS/STIG-recommended catalog.
ESP algorithm	One or more ciphers (proposals) that protect payload traffic in the child security association. You can select multiple proposals. Choose from the FIPS/STIG-recommended catalog.
Perfect Forward Secrecy (PFS)	When enabled, guarantees that the compromise of one key does not expose past or future traffic protected by other keys.
Pre-shared key (PSK)	The shared secret used to authenticate the tunnel. You can generate the PSK on the appliance, or enter a PSK that was already generated by another source. The PSK must match between both sites.