fortigate-ipsec-40-mr3

Auto Key phase 1 parameters Defining IKE negotiation parameters
P1 Proposal
Select the encryption and authentication algorithms that will
be used to generate keys for protecting negotiations.
Add or delete encryption and authentication algorithms as
required. Select a minimum of one and a maximum of three
combinations. The remote peer must be configured to use at
least one of the proposals that you define.
You can select any of the following symmetric-key algorithms:
DES-Digital Encryption Standard, a 64-bit block algorithm
that uses a 56-bit key.
3DES-Triple-DES, in which plain text is encrypted three
times by three keys.
AES128-A 128-bit block algorithm that uses a 128-bit key.
AES192-A 128-bit block algorithm that uses a 192-bit key.
AES256-A 128-bit block algorithm that uses a 256-bit key.
You can select one of the following message digests to check
the authenticity of messages during phase 1 negotiations:
MD5-Message Digest 5, the hash algorithm developed by
RSA Data Security.
SHA1-Secure Hash Algorithm 1, which produces a 160-bit
message digest.
SHA-256 Secure Hash Algorithm 256, which produces a
256-bit message digest
SHA-384 Secure Hash Algorithm 384, which produces a
384-bit message digest
SHA-512 Secure Hash Algorithm 512, which produces a
512-bit message digest
To specify a third combination, use the add button beside the
fields for the second combination.
SHA-256, SHA-384 and SHA-512 are not accelerated by
some FortiASIC processors (including FortiASIC network
processors and security processors). As a result, using SHA-
256, SHA-384 and SHA-512 may reduce the performance of
the FortiGate unit more significantly than SHA-1 which is
accelerated by all FortiASIC processors.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 51
http://docs.fortinet.com/