After upgrading to Junos OS 23.4R1 on vSRX 3.0, administrators may expect to see HMAC-SHA-384 and HMAC-SHA-512 as available IPsec authentication algorithm options. However, these options may not appear in the CLI despite being referenced in the Junos 23.4R1 feature documentation:

https://www.juniper.net/documentation/us/en/software/junos/release-notes/23.4/junos-release-notes-23.4r1/topics/new-features/feature-descriptions/jweb-3.html

When configuring an IPsec proposal, the expected HMAC-SHA-384 and HMAC-SHA-512 algorithms are not available.

Example:

[edit security ipsec proposal IPSEC-PROPOSAL]
user@srx-device# set authentication-algorithm ?
Possible completions:
hmac-md5-96 HMAC-MD5-96 authentication algorithm
hmac-sha-256-128 HMAC-SHA-256-128 authentication algorithm
hmac-sha1-96 HMAC-SHA1-96 authentication algorithm
[edit security ipsec proposal IPSEC-PROPOSAL]
user@srx-device#

The IKE package (junos-ike.tgz) is not installed on the device. Without this package, the additional HMAC authentication algorithm options are not exposed for IPsec configuration.

• Install the IKE package manually:

> request system software add optional://junos-ike.tgz

Reference:

https://supportportal.juniper.net/s/article/Junos-IKE-package-for-SRX-devices-iked

• J-Web Installation Procedure:

1. Log in to the Junos J-Web Interface.
2. Navigate to Network > VPN > IPsec VPN > Global Settings.
3. Select Install IKE Package.
4. Save and commit the changes.

The IKE package installation requires a device reboot for activation. After the reboot, the additional authentication algorithms, including HMAC-SHA-384 and HMAC-SHA-512, should become available for IPsec proposal configuration.

After installation and reboot, verify the available authentication algorithms:

[edit security ipsec proposal IPSEC-PROPOSAL]
user@srx-device# set authentication-algorithm ?

Confirm that the desired HMAC-SHA-384 and HMAC-SHA-512 options are listed in the available completions.