onitake commented on issue #3138: StrongSwan with several rightsubnet's - ikev1 URL: https://github.com/apache/cloudstack/issues/3138#issuecomment-495403717 From internal exchanges with @dudarra , I understand that there are a few technical limitations and peculiarities that VPN users should be aware of. So, it may make sense to improve the documentation, API and/or UI related to VPN configuration. In particular, the available cipher suites seem to be outdated and not in line with best cryptographic practices. MD5, SHA1? These hashing algorithms are considered broken by the cryptographic community. Why does CloudStack not offer SHA256, SHA348 and SHA512? Also, why aren't there any other Diffie-Hellman groups offered besides 1, 2 and 5? Why is there no option to enable CTR or GCM AES block cipher modes?
---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected] With regards, Apache Git Services
