Kernaali Tools
Home / Configuration & sysadmin / IKEv2 Proposal Checker
Configuration & sysadmin

IKEv2 Proposal Checker

Check a limited IKEv2 transform selection and understand its interoperability caveats.

Local calculation · inputs are not sent to a server.

Result

Calculating the example…

How it works

IKEv2 proposals negotiate encryption, PRF, integrity where needed, and a key-exchange group. AEAD provides its own integrity, while CBC needs a separate integrity transform. The PRF remains necessary with AEAD. This checker distinguishes those structural rules from algorithm policy.

Worked example

AES-GCM with no separate integrity, PRF SHA2-256 and group 19 is structurally consistent in this model. Adding a separate HMAC integrity transform to this AEAD selection is rejected.

Inputs, edge cases & common mistakes

This is an IKE SA helper, not an ESP/Child-SA proposal parser or a universal security score. Key lengths and tag variants must also match. RFC 8247 is updated by RFC 9395; the latter deprecates IKEv1 and additional obsolete algorithms. Authentication, peer identity, implementation, lifetimes, downgrade handling and organizational policy need their own review. No generated firewall configuration is applied.

Technical references

Reviewed 9 September 2026. Found an issue? Send a correction with a reproducible example.