Does the SRX4100 supports these authentication/encryption algorithms:
Phase 1
IKEv2
Encryption AES-256
Hash/Integrity SHA-512
DH Group 19
Lifetime 86400
Phase 2
DH Group 21
Lifetime 28800
Those authentication/encryption algorithms are supported but there are some software requirements:
Junos OS 23.4R1.9 or higher
junos-ike package installed.
Once on a Junos version 23.4R1.9 or higher and the junos-ike package has been installed all the options will be available.
To install the junos-ike package use this:
root@srx> request system software add optional://junos-ike.tgz
Verified junos-ike signed by PackageProductionECP256_2024 method ECDSA256+SHA256
The command is hidden, so it needs to be manually entered , also reboot might be required.
Reference document:
IKE settings enhancements (SRX1500, SRX1600, SRX2300, SRX4100, SRX4200, SRX4600, SRX5400, SRX5800, and vSRX3.0)—Starting in Junos OS Release 23.4R1, J-Web supports the following for the junos-ikepackage installed devices:
https://www.juniper.net/documentation/us/en/software/junos/release-notes/23.4/junos-release-notes-23.4r1/topics/new-features/feature-descriptions/jweb.html
root@fw> show security ike security-associations detail
IKE peer 1.1.1.2, Index 1, Gateway Name: IKE-GW
Algorithms:
Authentication : hmac-sha512
Encryption : aes256-cbc
Pseudo random function: hmac-sha512
Diffie-Hellman group : DH-group-19
root@fw> show security ipsec security-associations detail
ID: 500001 Virtual-system: root, VPN Name: VPN
Version: IKEv2
PFS group: DH-group-21
Protocol: ESP, Authentication: hmac-sha512, Encryption: aes-cbc (256 bits)
root@fw# show security ike | display set
set security ike proposal standard authentication-method pre-shared-keys
set security ike proposal standard dh-group group19
set security ike proposal standard authentication-algorithm sha-512
set security ike proposal standard encryption-algorithm aes-256-cbc
set security ike proposal standard lifetime-seconds 86400
set security ike policy IKE-POL mode main
set security ike policy IKE-POL proposals standard
set security ike policy IKE-POL pre-shared-key ascii-text "$9$tXZR01hevLVwgSrwgoJHkp0B"
set security ike gateway IKE-GW ike-policy IKE-POL
set security ike gateway IKE-GW address 1.1.1.2
set security ike gateway IKE-GW external-interface xe-0/0/0
set security ike gateway IKE-GW version v2-only
root@fw# show security ipsec | display set
set security ipsec proposal standard authentication-algorithm hmac-sha-512
set security ipsec proposal standard encryption-algorithm aes-256-cbc
set security ipsec proposal standard lifetime-seconds 28800
set security ipsec policy IPSEC-POL perfect-forward-secrecy keys group21
set security ipsec policy IPSEC-POL proposals standard
set security ipsec vpn VPN bind-interface st0.0
set security ipsec vpn VPN ike gateway IKE-GW
set security ipsec vpn VPN ike ipsec-policy IPSEC-POL
set security ipsec vpn VPN establish-tunnels immediately
root@fw# run show version
Model: srx4100
Junos: 23.4R1.9