Management Functions
Firewall Settings
Up to 16 IP addresses (or ranges of IP addresses) can be specified for both IPv4 and IPv6.
Up to 32 MAC addresses can be specified.
IPSec
IPSec that is supported by the machine conforms to RFC2401, RFC2402, RFC2406, and RFC4305.
Operating system | Windows 8.1 Windows 10 | |
Connection mode | Transport mode | |
Key exchange protocol | IKEv1 (main mode) | |
Authentication method | Pre-shared key Digital signature | |
Hash algorithm (and key length) | HMAC-SHA1-96 HMAC-SHA2 (256 bits or 384 bits) | |
Encryption algorithm (and key length) | 3DES-CBC AES-CBC (128 bits, 192 bits, or 256 bits) | |
Key exchange algorithm/group (and key length) | Diffie-Hellman (DH) Group 14 (2048 bits) ECDH-P256 (256 bits) ECDH-P384 (384 bits) | |
ESP | Hash algorithm | HMAC-SHA1-96 |
Encryption algorithm (and key length) | 3DES-CBC AES-CBC (128 bits, 192 bits, or 256 bits) | |
Hash algorithm/encryption algorithm (and key length) | AES-GCM (128 bits, 192 bits, or 256 bits) | |
AH | Hash algorithm | HMAC-SHA1-96 |
 |
IPSec supports communication to a unicast address (or a single device). |
Registration of Keys and Certificates
If you install a key or CA certificate from a computer, make sure that they meet the following requirements:
Format | Key: PKCS#12*1 CA certificate: X.509 DER/PEM |
File extension | Key: ".p12" or ".pfx" CA certificate: ".cer" or ".pem" |
Public key algorithm (and key length) | RSA (512 bits, 1024 bits, 2048 bits, 4096 bits) DSA (1024 bits, 2048 bits, 3072 bits) ECDSA (P256, P384, P521) |
Certificate signature algorithm | RSA: SHA-1, SHA-256, SHA-384*2, SHA-512*2, MD2, MD5 DSA: SHA-1 ECDSA: SHA-1, SHA-256, SHA-384, SHA-512 |
Certificate thumbprint algorithm | SHA1 |
*1Requirements for the certificate contained in a key are pursuant to CA certificates. *2SHA384-RSA and SHA512-RSA are available only when the RSA key length is 1024 bits or more. |
|
The machine does not support use of a certificate revocation list (CRL). |
Definition of "Weak Encryption"
When <Prohibit Use of Weak Encrypt.> is set to <On>, the use of the following algorithms is prohibited.
Hash | MD4, MD5, SHA-1 |
HMAC | HMAC-MD5 |
Common key cryptosystem | RC2, RC4, DES |
Public key cryptosystem | RSA encryption (512 bits/1024 bits), RSA signature (512 bits/1024 bits), DSA (512 bits/1024 bits), DH (512 bits/1024 bits) |
|
Even when <Prohibit Weak Encryp. Key/Cert.> is set to <On>, the hash algorithm SHA-1, which is used for signing a root certificate, can be used. |