topic Re: diffie-hellman groups supports in version 6.7 in Network Security

diffie-hellman groups supports in version 6.7

support040 — Thu, 28 Jan 2021 13:13:28 GMT

Hi,

I need a simple Answer please ...

all release Notes tells us some DH groups not supported in FTD version 6.7

Please give me a simple answer:

WHICH DH groups WILL support in FTD version 6.7 for IKE v1 and V2 for Phase 1 and 2 ????

thanks for your clear answer

Ashkan

Rob Ingram — Thu, 28 Jan 2021 13:19:30 GMT

The following DH groups are supported from FTD 6.7:- 14,15, 16, 19, 20 and 21

FTD 6.7 removed support for:- 2, 5 and 25

HTH

Marvin Rhoads — Thu, 28 Jan 2021 13:47:04 GMT

So...

"If you are still using these features in IKE proposals or IPsec policies, change and verify your VPN configuration before you upgrade."

If you don't do that, the upgrade will break them.

Note that ASA 9.15 similarly removes support for DH groups 2 and 24 (as well as some less-secure encryption algorithms and hashes).