Tutorial: Change the Data-Channel Encryption Cipher
Overview
The data-channel encryption cipher determines how the data packets transmitted through the OpenVPN tunnel are encrypted and decrypted. On the server, ciphers can be specified in order of priority. The first cipher that the client also supports will be used for the VPN session. This allows for backward compatibility so that newer clients capable of better encryption ciphers will prefer to use those, while older clients can still connect using older cipher methods.
In default settings, the Access Server is compliant with FIPS-140-2. The cipher used is AES-256, and when deployed in an environment that enforces FIPS compliance, it can operate without configuration changes.
On Access Server 2.9 and newer, you can configure the ciphers in the Admin Web UI. This tutorial explains using the Admin Web UI or the command-line interface (CLI).
Prerequisites
Access Server 2.9 and newer.
Admin Web UI access.
When you define the data-channel encryption ciphers, you list multiple ciphers separated by a colon as an ordered data cipher string. This is specified in order of priority so that the first cipher that matches what the client supports will be used for the VPN session. The default configuration is as follows:
AES-256-GCM
AES-128-GCM
?CHACHA20-POLY1305 (enabled if supported on the server side)*
Backward compatibility cipher (only on Access Server 2.9 through 2.12)
*The CHACHA20-POLY1305 cipher is prepended with a question mark to indicate that it is a soft requirement. This means that if the server environment supports the use of this cipher, it will be enabled and can be used; otherwise, it will be ignored. This cipher is optimized for use in environments where hardware AES-256 support is unavailable.
Recommended values
AES-256-GCM
AES-128-GCM
CHACHA20-POLY1305
Optional values
AES-256-CBC
AES-192-CBC
AES-128-CBC
AES-192-GCM
Deprecated values
BF-CBC
DES-CBC
DES-EDE3-CBC
DESX-CBC
none
Supported Ciphers in Access Server
Test Case
Ubunutu 20 (x86)
Ubuntu 20 (ARM64)
Ubuntu 22
Ubuntu 22 ARM
Debian 10
Debian 11
Debian 12
Red Hat 8
Red Hat 9
FIPS Ubuntu 20
FIPS Red Hat 8
AES-256-GCM
Only VPN cipher
Only data cipher
Both
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
AES-128-GCM
Only VPN cipher
Only data cipher
Both
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
CHACHA20-POLY1305
Only VPN cipher
Only data cipher
Both
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
❌
❌
❌
❌
❌
DESX-CBC
Only VPN cipher
Only data cipher
Both
✅
❌
❌
✅
❌
❌
❌
❌
❌
❌
❌
❌
✅
❌
❌
✅
❌
❌
❌
❌
❌
✅
❌
❌
❌
❌
❌
✅
❌
❌
❌
❌
❌
none
Only VPN cipher
Only data cipher
Both
✅
❌
❌
✅
❌
❌
✅
❌
❌
✅
❌
❌
✅
❌
❌
✅
❌
❌
✅
❌
❌
✅
❌
❌
✅
❌
❌
✅
❌
❌
✅
❌
❌
DES-EDE3-CBC
Only VPN cipher
Only data cipher
Both
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
BF-CBC
Only VPN cipher
Only data cipher
Both
✅
❌
✅
✅
✅
✅
✅
❌
❌
✅
❌
❌
✅
✅
✅
✅
✅
✅
✅
❌
❌
✅
✅
✅
✅
❌
❌
✅
❌
❌
✅
❌
❌
DES-CBC
Only VPN cipher
Only data cipher
Both
✅
✅
✅
✅
✅
✅
❌
❌
❌
❌
❌
❌
✅
✅
✅
✅
✅
✅
❌
❌
❌
✅
✅
✅
❌
❌
❌
✅
❌
❌
❌
❌
❌
AES-128-CBC
Only VPN cipher
Only data cipher
Both
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
AES-256-CBC
Only VPN cipher
Only data cipher
Both
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
AES-192-CBC
Only VPN cipher
Only data cipher
Both
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
✅
Total fails:
5
4
10
10
4
4
10
4
10
10
13
As of Access Server 2.9, you can configure the ciphers in the Admin Web UI using a string format with multiple ciphers separated by a colon (:)—for example, AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305.
Sign in to the Admin Web UI.
Select Configuration → Advanced VPN.
Enter your preferred data channel ciphers under Data channel ciphers.
