Tutorial: Change the Data-Channel Encryption Cipher

Overview

The data-channel encryption cipher determines how the data packets transmitted through the OpenVPN tunnel are encrypted and decrypted. On the server, ciphers can be specified in order of priority. The first cipher that the client also supports will be used for the VPN session. This allows for backward compatibility so that newer clients capable of better encryption ciphers will prefer to use those, while older clients can still connect using older cipher methods.

In default settings, the Access Server is compliant with FIPS-140-2. The cipher used is AES-256, and when deployed in an environment that enforces FIPS compliance, it can operate without configuration changes.

This tutorial explains how to use the Admin Web UI or the command-line interface (CLI) to configure the ciphers.

Caution

Since the cipher configuration can be independently set on the client and server sides, changing the setting on the server side may require updating the client connection profile to match the new settings. Keep this in mind when changing the cipher list on existing deployments.

Prerequisites

An installed Access Server.
Admin Web UI access.

Step 1: Determine what ciphers to allow

When you define the data-channel encryption ciphers, you list multiple ciphers separated by a colon as an ordered data cipher string. This is specified in order of priority so that the first cipher that matches what the client supports will be used for the VPN session. The default configuration is as follows:

AES-256-GCM
AES-128-GCM
?CHACHA20-POLY1305 (enabled if supported on the server side)*

*The CHACHA20-POLY1305 cipher is prepended with a question mark to indicate that it is a soft requirement. This means that if the server environment supports the use of this cipher, it will be enabled and can be used; otherwise, it will be ignored. This cipher is optimized for use in environments where hardware AES-256 support is unavailable.

Recommended values

AES-256-GCM
AES-128-GCM
CHACHA20-POLY1305

Optional values

AES-256-CBC
AES-192-CBC
AES-128-CBC
AES-192-GCM

Deprecated values

BF-CBC
DES-CBC
DES-EDE3-CBC
DESX-CBC
none

Caution

The value “none” completely disables data channel encryption. We don’t recommend using it — it is only meant for debugging purposes. The other ciphers mentioned may no longer be allowed by the OpenSSL security settings in your operating system.

Supported Ciphers in Access Server

	Test Case	Ubunutu 20 (x86)	Ubuntu 20 (ARM64)	Ubuntu 22	Ubuntu 22 ARM	Debian 10	Debian 11	Debian 12	Red Hat 8	Red Hat 9	FIPS Ubuntu 20	FIPS Red Hat 8
AES-256-GCM	Only VPN cipher Only data cipher Both	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅
AES-128-GCM	Only VPN cipher Only data cipher Both	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅
CHACHA20-POLY1305	Only VPN cipher Only data cipher Both	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ❌ ❌	❌ ❌ ❌
DESX-CBC	Only VPN cipher Only data cipher Both	✅ ❌ ❌	✅ ❌ ❌	❌ ❌ ❌	❌ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	❌ ❌ ❌	✅ ❌ ❌	❌ ❌ ❌	✅ ❌ ❌	❌ ❌ ❌
none	Only VPN cipher Only data cipher Both	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌
DES-EDE3-CBC	Only VPN cipher Only data cipher Both	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅
BF-CBC	Only VPN cipher Only data cipher Both	✅ ❌ ✅	✅ ✅ ✅	✅ ❌ ❌	✅ ❌ ❌	✅ ✅ ✅	✅ ✅ ✅	✅ ❌ ❌	✅ ✅ ✅	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌
DES-CBC	Only VPN cipher Only data cipher Both	✅ ✅ ✅	✅ ✅ ✅	❌ ❌ ❌	❌ ❌ ❌	✅ ✅ ✅	✅ ✅ ✅	❌ ❌ ❌	✅ ✅ ✅	❌ ❌ ❌	✅ ❌ ❌	❌ ❌ ❌
AES-128-CBC	Only VPN cipher Only data cipher Both	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅
AES-256-CBC	Only VPN cipher Only data cipher Both	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅
AES-192-CBC	Only VPN cipher Only data cipher Both	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅
	Total fails:	5	4	10	10	4	4	10	4	10	10	13

Test Case

Ubunutu 20 (x86)

Ubuntu 20 (ARM64)

Ubuntu 22

Ubuntu 22 ARM

Debian 10

Debian 11

Debian 12

Red Hat 8

Red Hat 9

FIPS Ubuntu 20

FIPS Red Hat 8

AES-256-GCM

Only VPN cipher

Only data cipher

Both

✅

AES-128-GCM

Only VPN cipher

Only data cipher

Both

✅

CHACHA20-POLY1305

Only VPN cipher

Only data cipher

Both

✅

❌

DESX-CBC

Only VPN cipher

Only data cipher

Both

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

none

Only VPN cipher

Only data cipher

Both

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

DES-EDE3-CBC

Only VPN cipher

Only data cipher

Both

✅

BF-CBC

Only VPN cipher

Only data cipher

Both

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

DES-CBC

Only VPN cipher

Only data cipher

Both

✅

❌

✅

❌

✅

❌

✅

❌

AES-128-CBC

Only VPN cipher

Only data cipher

Both

✅

AES-256-CBC

Only VPN cipher

Only data cipher

Both

✅

AES-192-CBC

Only VPN cipher

Only data cipher

Both

✅

Total fails:

5

4

10

4

10

4

10

13

Option 1: Configure the ciphers in the Admin Web UI

Sign in to the Admin Web UI.
Click VPN Server.
lick the Security / Encryption tab.
Enter your preferred data channel ciphers in the fields for Data-channel ciphers. (You may need to uncheck Use Defaults to remove and add ciphers.)
Click Save and Restart.

Option 2: Configure the ciphers in the CLI

To configure the ciphers from the CLI:

Connect to the console and get root privileges.
Set the data-channel encryption ciphers:
```
sacli --key "vpn.server.data_ciphers" --value <CIPHERS>1 ConfigPut
sacli start
```
1
Enter a string format with multiple ciphers separated by a colon (:). For example, AES-256-GCM:AES-128-GCM:?CHACHA20-POLY1305.

To restore the default setting:

sacli --key "vpn.server.data_ciphers" ConfigDel
sacli start

Tutorial: Change the Data-Channel Encryption Cipher

Overview

Caution

Prerequisites

Step 1: Determine what ciphers to allow

Recommended values

Optional values

Deprecated values

Caution

Option 1: Configure the ciphers in the Admin Web UI

Option 2: Configure the ciphers in the CLI

Search results