Using Integrity Algorithms for IPsec Connections
Use specific algorithms for authenticating IPsec connections, preferring none if AES-GCM is used.
Plain language
This control is about ensuring the data that travels over the internet is genuine and hasn't been tampered with during transmission. It requires using specific methods to check the authenticity of the data. This is crucial because if this isn't done, false or harmful data could be sent or received, leading to potential data breaches or system disruptions.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Feb 2022
Control Stack last updated
19 Mar 2026
E8 maturity levels
N/A
Official control statement
AUTH_HMAC_SHA2_256_128, AUTH_HMAC_SHA2_384_192, AUTH_HMAC_SHA2_512_256 or NONE (only with AES-GCM) is used for authenticating IPsec connections, preferably NONE.
Why it matters
Weak or incorrect IPsec integrity algorithms allow packet tampering/spoofing, risking unauthorised access and data compromise.
Operational notes
Configure IPsec to use AUTH_HMAC_SHA2_256_128/384_192/512_256, or NONE only when using AES-GCM; regularly verify peer proposals.
Implementation tips
- The IT manager should identify where IPsec connections are used in the organisation. Make a list of all systems that rely on these secure communication channels, so the right integrity checks can be applied.
- The network security specialist should configure IPsec connections to use one of the approved algorithms. This can be done by adjusting settings in the network's routers or firewalls to include AUTH_HMAC_SHA2_256_128, AUTH_HMAC_SHA2_384_192, or AUTH_HMAC_SHA2_512_256, or by selecting 'none' only if AES-GCM is already in use.
- The IT team should test each IPsec connection to ensure it is using the required settings. After configuration, run network tests and monitor logs to confirm the integrity algorithms are correctly implemented and functioning as expected.
- The security officer should document the configurations. Keep a detailed record of each system's IPsec setup, noting which algorithm is used, for future audits or troubleshooting.
- Technical staff should regularly review and update these integrity settings. As part of maintenance, check periodically that systems are using the latest recommended algorithms to keep up with emerging security threats.
Audit / evidence tips
- AskThe IPsec configuration documentation: Request records that detail how IPsec is set up on each networked system GoodWill include authorised settings and a rationale for any 'none' selections with AES-GCM
- AskA demonstration of the network configuration: Have the IT team walk you through the router or firewall settings GoodShows accurate and compliant settings matching the documentation
- AskNetwork log reports: Request logs of IPsec traffic that include data on the algorithms used GoodShows regular traffic flows using the specified security settings
- AskAbout the monitoring process: Inquire how the IT team monitors IPsec connections for compliance GoodIncludes records of regular checks and timely updates when protocols change
- AskAudit trail records: Seek the formal records of past changes to IPsec configurations GoodShould include change dates, responsible personnel, and reasons for configuration changes
Cross-framework mappings
How ISM-0998 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
| layers Partially meets (1) expand_less | ||
| Annex A 8.24 | ISM-0998 mandates approved integrity/authentication algorithms for IPsec connections, with a preference for using NONE when AES-GCM provi... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.