Displaying IKE Information

You can view the algorithms and groups that can be used in Phase 1 IKE negotiations.

How to Display Available Groups and Algorithms for Phase 1 IKE Exchanges

In this procedure, you determine which Diffie-Hellman groups are available for use in Phase 1 IKE exchanges. You also view the encryption and authentication algorithms that are available for IKE Phase 1 exchanges. The numeric values match the values that are specified for these algorithms by the Internet Assigned Numbers Authority (IANA).

Before You Begin

You must become an administrator who is assigned the Network IPsec Management rights profile. For more information, see How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.

1. Display the list of Diffie-Hellman groups that IKE can use in Phase 1.

   Diffie-Hellman groups set up IKE SAs.

   # ikeadm dump groups
   Value Strength Description
   1     66       ietf-ike-grp-modp-768
   2     77       ietf-ike-grp-modp-1024
   5     91       ietf-ike-grp-modp-1536
   14    110      ietf-ike-grp-modp-2048
   15    130      ietf-ike-grp-modp-3072
   16    150      ietf-ike-grp-modp-4096
   17    170      ietf-ike-grp-modp-6144
   18    190      ietf-ike-grp-modp-8192
   
   Completed dump of groups

   You would use one of these values as the argument to the oakley_group parameter in an IKE Phase 1 transform, as in:

   p1_xform
     { auth_method preshared oakley_group 15 auth_alg sha encr_alg aes }

2. Display the list of authentication algorithms that IKE can use in Phase 1.

   # ikeadm dump authalgs
   Value Name
   1     md5
   2     sha1
   4     sha256
   5     sha384
   6     sha512
   
   Completed dump of authalgs

   You would use one of these names as the argument to the auth_alg parameter in an IKE Phase 1 transform, as in:

   p1_xform
     { auth_method preshared oakley_group 15 auth_alg sha256 encr_alg 3des }

3. Display the list of encryption algorithms that IKE can use in Phase 1.

   # ikeadm dump encralgs
   Value Name
   3     blowfish-cbc
   5     3des-cbc
   1     des-cbc
   7     aes-cbc
   
   Completed dump of encralgs

   You would use one of these names as the argument to the encr_alg parameter in an IKE Phase 1 transform, as in:

   p1_xform
     { auth_method preshared oakley_group 15 auth_alg sha256 encr_alg aes }

See Also

For tasks to configure IKE rules that require these values, see Configuring IKE (Task Map).