starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

IKE Proposal configuration requires authentication even with AES GCM #8947

New Issue
Closed
opened 2025-12-29 20:43:12 +01:00 by adam · 6 comments
adam commented 2025-12-29 20:43:12 +01:00
Owner
Copy Link

Originally created by @markkuleinio on GitHub (Dec 12, 2023).

Originally assigned to: @jeremystretch on GitHub.

Deployment Type

Self-hosted

NetBox Version

v3.7-beta1

Python Version

3.11

Steps to Reproduce

  1. Go to VPN - IKE Proposals, Add
  2. Select Encryption algorithm: 256-bit AES (GCM)

Expected Behavior

It should be possible to select "None" in Authentication algorithm.

Example of PAN-OS configuration:

set network ike crypto-profiles ike-crypto-profiles IKE-SHA384-AES256-DH20-86400 encryption aes-256-gcm
set network ike crypto-profiles ike-crypto-profiles IKE-SHA384-AES256-DH20-86400 hash non-auth
set network ike crypto-profiles ike-crypto-profiles IKE-SHA384-AES256-DH20-86400 dh-group group20
set network ike crypto-profiles ike-crypto-profiles IKE-SHA384-AES256-DH20-86400 lifetime hours 24

Observed Behavior

Authentication algorithm must be selected from the dropdown, there is no "None" option, not possible to match NetBox with the actual device configuration

image

Originally created by @markkuleinio on GitHub (Dec 12, 2023). Originally assigned to: @jeremystretch on GitHub. ### Deployment Type Self-hosted ### NetBox Version v3.7-beta1 ### Python Version 3.11 ### Steps to Reproduce 1. Go to VPN - IKE Proposals, Add 2. Select Encryption algorithm: 256-bit AES (GCM) ### Expected Behavior It should be possible to select "None" in Authentication algorithm. Example of PAN-OS configuration: ``` set network ike crypto-profiles ike-crypto-profiles IKE-SHA384-AES256-DH20-86400 encryption aes-256-gcm set network ike crypto-profiles ike-crypto-profiles IKE-SHA384-AES256-DH20-86400 hash non-auth set network ike crypto-profiles ike-crypto-profiles IKE-SHA384-AES256-DH20-86400 dh-group group20 set network ike crypto-profiles ike-crypto-profiles IKE-SHA384-AES256-DH20-86400 lifetime hours 24 ``` ### Observed Behavior Authentication algorithm must be selected from the dropdown, there is no "None" option, not possible to match NetBox with the actual device configuration ![image](https://github.com/netbox-community/netbox/assets/25136274/c5db1a95-9728-4335-b5cd-a956768c2bfb)
adam added the type: bugstatus: acceptedbetaseverity: low labels 2025-12-29 20:43:12 +01:00
adam closed this issue 2025-12-29 20:43:12 +01:00
adam commented 2025-12-29 20:43:13 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Dec 12, 2023):

Is there a difference in the PAN-OS config between explicitly setting hash non-auth and not setting the parameter at all? Or is this effectively the same? Just trying to fully understand the context.

@jeremystretch commented on GitHub (Dec 12, 2023): Is there a difference in the PAN-OS config between explicitly setting `hash non-auth` and not setting the parameter at all? Or is this effectively the same? Just trying to fully understand the context.
adam commented 2025-12-29 20:43:14 +01:00
Author
Owner
Copy Link

@markkuleinio commented on GitHub (Dec 12, 2023):

# show
set network ike crypto-profiles ike-crypto-profiles TEST encryption aes-256-gcm
set network ike crypto-profiles ike-crypto-profiles TEST dh-group group20
set network ike crypto-profiles ike-crypto-profiles TEST lifetime hours 24

# commit
Validation Error:
 network -> ike -> crypto-profiles -> ike-crypto-profiles -> TEST  is missing 'hash'
 network -> ike -> crypto-profiles -> ike-crypto-profiles is invalid

# set hash ?
  [          Start a list of values.
  md5        below 80-bit strength
  non-auth   Integrity check is unnecessary when AESGCM is chosen
  sha1       NIST rating 128-bit strength
  sha256     NIST rating 256-bit strength
  sha384     NIST rating over 256-bit strength
  sha512     NIST rating over 256-bit strength

# set hash non-auth

# commit
Configuration committed successfully

PAN-OS 10.2.7

@markkuleinio commented on GitHub (Dec 12, 2023): ``` # show set network ike crypto-profiles ike-crypto-profiles TEST encryption aes-256-gcm set network ike crypto-profiles ike-crypto-profiles TEST dh-group group20 set network ike crypto-profiles ike-crypto-profiles TEST lifetime hours 24 # commit Validation Error: network -> ike -> crypto-profiles -> ike-crypto-profiles -> TEST is missing 'hash' network -> ike -> crypto-profiles -> ike-crypto-profiles is invalid # set hash ? [ Start a list of values. md5 below 80-bit strength non-auth Integrity check is unnecessary when AESGCM is chosen sha1 NIST rating 128-bit strength sha256 NIST rating 256-bit strength sha384 NIST rating over 256-bit strength sha512 NIST rating over 256-bit strength # set hash non-auth # commit Configuration committed successfully ``` PAN-OS 10.2.7
adam commented 2025-12-29 20:43:14 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Dec 12, 2023):

Ok, so the command itself is required and no-hash effectively represents "none." Thanks.

@jeremystretch commented on GitHub (Dec 12, 2023): Ok, so the command itself is required and `no-hash` effectively represents "none." Thanks.
adam commented 2025-12-29 20:43:14 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Dec 12, 2023):

Just want to say thank you for giving the beta a test run and helping us tweak it further.

@DanSheps commented on GitHub (Dec 12, 2023): Just want to say thank you for giving the beta a test run and helping us tweak it further.
adam commented 2025-12-29 20:43:15 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Dec 12, 2023):

We should also think about IPSec policies (phase two): It should be possible to set only encryption or authentication (or both), right?

As for IKE policies (phase one), IIRC encryption is always required.

@jeremystretch commented on GitHub (Dec 12, 2023): We should also think about IPSec policies (phase two): It should be possible to set only encryption _or_ authentication (or both), right? As for IKE policies (phase one), IIRC encryption is always required.
adam commented 2025-12-29 20:43:15 +01:00
Author
Owner
Copy Link

@markkuleinio commented on GitHub (Dec 12, 2023):

We should also think about IPSec policies (phase two): It should be possible to set only encryption or authentication (or both), right?

I'd say yes:

# edit ipsec-crypto-profiles IPSEC_TEST
# set ?
+ dh-group   phase-2 DH group (PFS DH group)
> ah         AH only
> esp        ESP options
> lifesize   IPSec SA lifesize
> lifetime   IPSec SA lifetime

# set ah ?
> authentication   Authentication algorithm

# set ah authentication ?
  [        Start a list of values.
  md5      below 80-bit strength
  sha1     NIST rating 128-bit strength
  sha256   NIST rating 256-bit strength
  sha384   NIST rating over 256-bit strength
  sha512   NIST rating over 256-bit strength

# set ah authentication sha512
# set lifetime seconds 3600
# show
set network ike crypto-profiles ipsec-crypto-profiles IPSEC_TEST ah authentication sha512
set network ike crypto-profiles ipsec-crypto-profiles IPSEC_TEST lifetime seconds 3600

# commit
Configuration committed successfully

= no ESP

@markkuleinio commented on GitHub (Dec 12, 2023): > We should also think about IPSec policies (phase two): It should be possible to set only encryption or authentication (or both), right? I'd say yes: ``` # edit ipsec-crypto-profiles IPSEC_TEST # set ? + dh-group phase-2 DH group (PFS DH group) > ah AH only > esp ESP options > lifesize IPSec SA lifesize > lifetime IPSec SA lifetime # set ah ? > authentication Authentication algorithm # set ah authentication ? [ Start a list of values. md5 below 80-bit strength sha1 NIST rating 128-bit strength sha256 NIST rating 256-bit strength sha384 NIST rating over 256-bit strength sha512 NIST rating over 256-bit strength # set ah authentication sha512 # set lifetime seconds 3600 # show set network ike crypto-profiles ipsec-crypto-profiles IPSEC_TEST ah authentication sha512 set network ike crypto-profiles ipsec-crypto-profiles IPSEC_TEST lifetime seconds 3600 # commit Configuration committed successfully ``` = no ESP
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label beta severity: low status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#8947
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?