Tutorial: Change the Data-Channel Encryption Cipher

When you define the data-channel encryption ciphers, you list multiple ciphers separated by a colon as an ordered data cipher string. This is specified in order of priority so that the first cipher that matches what the client supports will be used for the VPN session. The default configuration is as follows:

AES-256-GCM
AES-128-GCM
?CHACHA20-POLY1305 (enabled if supported on the server side)*

*The CHACHA20-POLY1305 cipher is prepended with a question mark to indicate that it is a soft requirement. This means that if the server environment supports the use of this cipher, it will be enabled and can be used; otherwise, it will be ignored. This cipher is optimized for use in environments where hardware AES-256 support is unavailable.

Recommended values⁠

AES-256-GCM
AES-128-GCM
CHACHA20-POLY1305

Optional values⁠

AES-256-CBC
AES-192-CBC
AES-128-CBC
AES-192-GCM

Deprecated values⁠

BF-CBC
DES-CBC
DES-EDE3-CBC
DESX-CBC
none

Supported Ciphers in Access Server

	Test Case	Ubunutu 20 (x86)	Ubuntu 20 (ARM64)	Ubuntu 22	Ubuntu 22 ARM	Debian 10	Debian 11	Debian 12	Red Hat 8	Red Hat 9	FIPS Ubuntu 20	FIPS Red Hat 8
AES-256-GCM	Only VPN cipher Only data cipher Both	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅
AES-128-GCM	Only VPN cipher Only data cipher Both	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅
CHACHA20-POLY1305	Only VPN cipher Only data cipher Both	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ❌ ❌	❌ ❌ ❌
DESX-CBC	Only VPN cipher Only data cipher Both	✅ ❌ ❌	✅ ❌ ❌	❌ ❌ ❌	❌ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	❌ ❌ ❌	✅ ❌ ❌	❌ ❌ ❌	✅ ❌ ❌	❌ ❌ ❌
none	Only VPN cipher Only data cipher Both	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌
DES-EDE3-CBC	Only VPN cipher Only data cipher Both	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅
BF-CBC	Only VPN cipher Only data cipher Both	✅ ❌ ✅	✅ ✅ ✅	✅ ❌ ❌	✅ ❌ ❌	✅ ✅ ✅	✅ ✅ ✅	✅ ❌ ❌	✅ ✅ ✅	✅ ❌ ❌	✅ ❌ ❌	✅ ❌ ❌
DES-CBC	Only VPN cipher Only data cipher Both	✅ ✅ ✅	✅ ✅ ✅	❌ ❌ ❌	❌ ❌ ❌	✅ ✅ ✅	✅ ✅ ✅	❌ ❌ ❌	✅ ✅ ✅	❌ ❌ ❌	✅ ❌ ❌	❌ ❌ ❌
AES-128-CBC	Only VPN cipher Only data cipher Both	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅
AES-256-CBC	Only VPN cipher Only data cipher Both	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅
AES-192-CBC	Only VPN cipher Only data cipher Both	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅	✅ ✅ ✅
	Total fails:	5	4	10	10	4	4	10	4	10	10	13

Test Case

Ubunutu 20 (x86)

Ubuntu 20 (ARM64)

Ubuntu 22

Ubuntu 22 ARM

Debian 10

Debian 11

Debian 12

Red Hat 8

Red Hat 9

FIPS Ubuntu 20

FIPS Red Hat 8

AES-256-GCM

Only VPN cipher

Only data cipher

Both

✅

AES-128-GCM

Only VPN cipher

Only data cipher

Both

✅

CHACHA20-POLY1305

Only VPN cipher

Only data cipher

Both

✅

❌

DESX-CBC

Only VPN cipher

Only data cipher

Both

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

none

Only VPN cipher

Only data cipher

Both

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

DES-EDE3-CBC

Only VPN cipher

Only data cipher

Both

✅

BF-CBC

Only VPN cipher

Only data cipher

Both

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

✅

❌

DES-CBC

Only VPN cipher

Only data cipher

Both

✅

❌

✅

❌

✅

❌

✅

❌

AES-128-CBC

Only VPN cipher

Only data cipher

Both

✅

AES-256-CBC

Only VPN cipher

Only data cipher

Both

✅

AES-192-CBC

Only VPN cipher

Only data cipher

Both

✅

Total fails:

5

4

10

4

10

4

10

13

To configure the ciphers from the CLI:

Connect to the console and get root privileges.
Set the data-channel encryption ciphers:
```
sacli --key "vpn.server.data_ciphers" --value <CIPHERS> ConfigPut
sacli start
```
1. Enter a string format with multiple ciphers separated by a colon (:). For example, AES-256-GCM:AES-128-GCM:?CHACHA20-POLY1305.

To restore the default setting:

sacli --key "vpn.server.data_ciphers" ConfigDel
sacli start

Tutorial: Change the Data-Channel Encryption Cipher⁠

Overview⁠

Recommended values⁠

Optional values⁠

Deprecated values⁠

Was this information helpful?