Skip to content

Commit d8e6b19

Browse files
RoRoJnerda-codes
andcommitted
Apply suggestions from code review
Co-authored-by: Néda <[email protected]>
1 parent 8b3f178 commit d8e6b19

File tree

2 files changed

+4
-9
lines changed

2 files changed

+4
-9
lines changed

pages/site-to-site-vpn/reference-content/security-proposals.mdx

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ When defining your Site-to-Site VPN security proposal, you must define the algor
4646
| Protocol | Element | Description | User must define? |
4747
|-----------------|-----------------|----------------------------------------------------|----------------------------|
4848
| **ESP** | **Encryption** | Algorithm to encrypt traffic's data payloads | ✅ Yes |
49-
| **ESP** | **Integrity** | HMAC-based algorithm to verify data payloads have not been tampered with. <br/><br/>Only set an HMAC integrity algorithm if **not** using an AEAD algorithm for ESP encryption (see below). Otherwise, integrity is built in, and you do not need to set an ESP integrity algorithm. | ❓ Depends |
49+
| **ESP** | **Integrity** | HMAC-based algorithm to verify data payloads have not been tampered with. <br/><br/> Only set an HMAC integrity algorithm if **not** using an AEAD algorithm for ESP encryption (see below). Otherwise, integrity is built in, and you do not need to set an ESP integrity algorithm. | ❓ Depends |
5050
| **ESP** | **Key Exchange Method** | DH group to define strength of key exchange | ❌ No |
5151

5252
## Encryption algorithms
@@ -74,7 +74,7 @@ Integrity is based on **H**ash-based **M**essage **A**uthentication **C**ode (HM
7474
| Algorithm | Output Size (bits)| Security Level | Notes | Recommended? |
7575
|-------------------------|--------------------|-----------------|---------------------------------------------------------|---------------------|
7676
| `sha512` | 512 | ✅ Very Strong | Suitable for high security environments. Use for long term security. | ✅ Recommended |
77-
| `sha384` | 384 | ✅ Strong | Balanced security/performance. Good alternative to `sha-512` | ✅ Recommended |
77+
| `sha384` | 384 | ✅ Strong | Balanced security/performance. Good alternative to `sha-512`. | ✅ Recommended |
7878
| `sha256` | 256 | ✅ Strong | Default for most VPNs. Recommended baseline. | ✅ Recommended |
7979

8080
## Key exchange methods
@@ -83,13 +83,13 @@ Key exchange is **D**iffie-**H**ellman-based. The following DH groups can be set
8383

8484
| DH Group | Bit Size | Security Level | Use Case | Recommended? |
8585
|------------------------|-----------|-----------------|------------------------------------------------------------------|------------------|
86-
| `ecp521` | 521 | ✅ Very Strong | Suitable for high security environments. May be overkill (lowers performance) |👍 Acceptable |
86+
| `ecp521` | 521 | ✅ Very Strong | Suitable for high security environments. May be overkill (lowers performance). |👍 Acceptable |
8787
| `ecp384` | 384 | ✅ Strong | Both strong and fast. **Our top choice for modern VPNs.** |✅ Recommended |
8888
| `ecp256` | 256 | ✅ Strong | Suitable for performance-sensitive VPNs. |✅ Recommended |
8989
| `curve25519` (X25519) | 256 | ✅ Very Strong | Both strong and fast. **Our top choice for performance**. |✅ Recommended |
9090
| `modp4096` | 4096 | ✅ Strong | Strong but slow. May be suitable for legacy VPNs. |👍 Acceptable |
9191
| `modp3072` | 3072 | ✅ Medium-Strong | May be suitable for legacy VPNs. |👍 Acceptable |
92-
| `modp2048` | 2048 | ⚠️ Minimum | Use for older VPNs only if absolutely needed |⚠️ Use with caution |
92+
| `modp2048` | 2048 | ⚠️ Minimum | Use for older VPNs only if absolutely needed. |⚠️ Use with caution |
9393

9494
## Standard recommendation
9595

pages/site-to-site-vpn/reference-content/understanding-s2svpn.mdx

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -172,8 +172,3 @@ Use [Network ACLs](/vpc/reference-content/understanding-nacls/) if you want to l
172172
- You cannot modify the Private Network that a VPN is connected to after creation
173173
- You must use the auto-generated pre-shared key (PSK) for a VPN connection: you cannot currently define your own PSK
174174
- We cannot currently provide a configuration file for customer gateway devices
175-
176-
177-
178-
179-

0 commit comments

Comments
 (0)