IKEv2 DH Group on SonicWall I am developing internal standards for IPsec VPN setup on SonicWall firewalls, and I have been learning about IKEv2.  When IKEv2 "mode" is selected, the UI disables the DH Group, Encryption, and Authentication fields, and I can't find what values are used, anywhere in the documentation.  Does IKEv2 have some mechanism by which it negotiates those fields to the "highest common denominator"?  If not, I'll just call tech support on Monday.
Does IKEv2 have some mechanism by which it negotiates those fields to the "highest common denominator"?


Well, IKEv2 allows the initiator to list what DH Groups, Encryption algorithms and Authentication algorithms (among others), and in what combinations; the responder then selects from that list what will be used.  It's actually pretty flexible (except for DH group; that's a bit kludgy, as the initiator has to select a 'main one', and if the responder doesn't like it, it needs to list what DH group it really wants, and we take another round trip with that group).

Now, the initiator lists things in preference order (e.g. the encryption algorithm it would prefer is listed first), and the responder is supposed to respect that order.  There's no built in logic within the IKE protocol itself that says, for example, AES-GCM is better (or worse) then ChaCha20; that's something for the initiator to decide.


  When IKEv2 "mode" is selected, the UI disables the DH Group, Encryption, and Authentication fields, and I can't find what values are used, anywhere in the documentation.


This is definitely something that ought to be both changeable and documented; if would appear unlikely that you could come up with a single policy that would make everyone happy.