[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eGoogle Distributed Cloud (GDC) air-gapped VPN supports specific ciphers for peer VPN gateways and can act as either an initiator or responder for IKE requests based on traffic origin.\u003c/p\u003e\n"],["\u003cp\u003eTo maintain consistent cipher selection, peer VPN gateways should be configured to propose and accept only one cipher per role, ensuring both sides use the same IKE cipher during negotiation.\u003c/p\u003e\n"],["\u003cp\u003eEnabling IKE fragmentation on the peer VPN gateway is recommended to prevent the dropping of large IKE packets, although certain messages like \u003ccode\u003eIKE_SA_INIT\u003c/code\u003e and \u003ccode\u003eIKE_SESSION_RESUME\u003c/code\u003e cannot be fragmented.\u003c/p\u003e\n"],["\u003cp\u003eThe supported cipher tables outline the rules for encryption, integrity, pseudo-random functions, and Diffie-Hellman groups for both Phase 1 and Phase 2 of the VPN setup, including their respective lifetimes.\u003c/p\u003e\n"],["\u003cp\u003eFor IKE configuration, GDC VPN tunnels must use IKE v2 for IPv6 traffic, and various parameters such as IPsec Mode, Auth Protocol, Shared Secret, PFS, DPD, and Traffic Selectors need to be configured appropriately.\u003c/p\u003e\n"]]],[],null,["# Supported IKE ciphers\n\nGoogle Distributed Cloud (GDC) air-gapped VPN supports the following ciphers and configuration parameters\nfor peer VPN gateways.\n\nProposal order\n--------------\n\nGDC VPN can act as an initiator or a responder to IKE requests\ndepending on the origin of traffic when a new security association (SA) is\nneeded.\n\nWhen GDC VPN initiates a VPN connection, GDC VPN proposes\nthe algorithms in the order shown in the supported cipher tables for each cipher\nrole. The peer VPN gateway receiving the proposal selects an algorithm.\n\nIf the peer VPN gateway initiates the connection, then GDC VPN\nselects a cipher from the proposal by using the same order shown in the table\nfor each cipher role.\n\nDepending on which side is the initiator or the responder, the selected cipher\ncan be different. For example, the selected cipher might even change over time\nas new security associations (SAs) are created during key rotation.\n\nTo prevent frequent changes in cipher selection, configure your peer VPN\ngateway to propose and accept only one cipher for each cipher role. This cipher\nmust be supported by both GDC air-gapped VPN and your peer VPN gateway. Don't\nprovide a list of ciphers for each cipher role. This best practice ensures that\nboth sides of your GDC air-gapped VPN tunnel always select the same IKE cipher\nduring IKE negotiation.\n\nIKE fragmentation\n-----------------\n\nGDC VPN supports IKE fragmentation as described by the IKEv2 fragmentation\nprotocol: \u003chttps://www.rfc-editor.org/rfc/rfc7383\u003e.\n\nFor best results, Google recommends that you enable IKE fragmentation, if it is\nnot already enabled, on your peer VPN gateway.\n\nIf you don't have IKE fragmentation enabled, IKE packets from GDC to\nthe peer VPN gateway that are larger than the gateway MTU are dropped.\n\nSome IKE messages can't be fragmented, including the following messages:\n\n- `IKE_SA_INIT`\n- `IKE_SESSION_RESUME`\n\nFor more information, see the Limitations section in \u003chttps://www.rfc-editor.org/rfc/rfc7383\u003e.\n\nSupported cipher tables\n-----------------------\n\nThese supported cipher tables provide the rules for substituting characters or\ngroups of characters during the encryption and decryption processes:\n\n### Phase 1\n\n### Phase 2\n\nConfigure IKE\n-------------\n\nYou can configure IKE on your peer VPN gateway for dynamic, route-based, and\npolicy-based routing.\n\nGDC VPN tunnels must use IKE v2 to support IPv6 traffic.\n\nTo configure the peer VPN gateway and tunnel for IKE, use the parameters in the\nfollowing table:\n\n**For IKEv1 and IKEv2**\n\n**Additional parameters for IKEv1 only**"]]
