windows-itpro-docs/windows/security/operating-system-security/network-security/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md

title, description, ms.date, ms.topic

title	description	ms.date	ms.topic
How to configure cryptographic settings for IKEv2 VPN connections	Learn how to update the IKEv2 cryptographic settings of VPN servers and clients by running VPN cmdlets to secure connections.	08/03/2023	how-to

How to configure cryptographic settings for IKEv2 VPN connections

In IKEv2 VPN connections, the default setting for IKEv2 cryptographic settings are:

• Encryption Algorithm: DES3
• Integrity, Hash Algorithm: SHA1
• Diffie Hellman Group (Key Size): DH2

These settings aren't secure for IKE exchanges.

To secure the connections, update the configuration of VPN servers and clients by running VPN cmdlets.

VPN server

For VPN servers that run Windows Server 2012 R2 or later, you need to run Set-VpnServerConfiguration to configure the tunnel type. These settings are effective for all IKEv2 VPN connections.

Set-VpnServerConfiguration -TunnelType IKEv2 -CustomPolicy

On an earlier version of Windows Server, run Set-VpnServerIPsecConfiguration. Since Set-VpnServerIPsecConfiguration doesn't have -TunnelType, the configuration applies to all tunnel types on the server.

Set-VpnServerIPsecConfiguration -CustomPolicy

VPN client

For VPN client, you need to configure each VPN connection. For example, run Set-VpnConnectionIPsecConfiguration (version 4.0) and specify the name of the connection:

Set-VpnConnectionIPsecConfiguration -ConnectionName <String>

IKEv2 Crypto Settings Example

The following commands configure the IKEv2 cryptographic settings to:

• Encryption Algorithm: AES128
• Integrity, Hash Algorithm: SHA256
• Diffie Hellman Group (Key Size): DH14

IKEv2 VPN Server

Set-VpnServerConfiguration -TunnelType IKEv2 -CustomPolicy -AuthenticationTransformConstants SHA256128 -CipherTransformConstants AES128 -DHGroup Group14 -EncryptionMethod AES128 -IntegrityCheckMethod SHA256 -PFSgroup PFS2048 -SALifeTimeSeconds 28800 -MMSALifeTimeSeconds 86400 -SADataSizeForRenegotiationKilobytes 1024000  
restart-service RemoteAccess -PassThru

If you need to switch back to the default IKEv2 settings, use this command:

Set-VpnServerConfiguration -TunnelType IKEv2 -RevertToDefault  
restart-service RemoteAccess -PassThru

IKEv2 VPN Client

Set-VpnConnectionIPsecConfiguration -ConnectionName <String - your VPN connection name> -AuthenticationTransformConstants SHA256128 -CipherTransformConstants AES128 -DHGroup Group14 -EncryptionMethod AES128 -IntegrityCheckMethod SHA256 -PfsGroup PFS2048 -Force

If you need to switch back to the default IKEv2 settings, use this command:

Set-VpnConnectionIPsecConfiguration -ConnectionName <String - your VPN connection name> -RevertToDefault -Force

Tip

If you're configuring a all-user VPN connection or a Device Tunnel you must use the -AllUserConnection parameter in the Set-VpnConnectionIPsecConfiguration command.