| 14.5 |  | Task 3 - Configure IPSec Parameters |
| 14.5.4 |  | Available IPSec transforms |

| The PIX Security Appliance supports the transform sets listed in Figure . Choosing IPSec transforms combinations can be complex. The following recommendations may be used for selecting appropriate transforms:

- Include an ESP encryption transform for data confidentiality.
- Consider including an ESP authentication transform or an AH transform to provide authentication services for the transform set:

- To ensure data authentication for the outer IP header as well as the data, include an AH transform.
- To ensure data authentication, use either ESP or AH. Choose from the MD5 or SHA, HMAC keyed hash variants, authentication algorithms.

- Remember that SHA is generally considered stronger than MD5.

Examples of acceptable transform combinations are as follows:

- esp-des should be used for traffic requiring encryption with high throughput.
- ah-md5-hmac for authenticating packet contents with no encryption
- esp-3des and esp-md5-hmac for strong encryption and authentication
- ah-sha-hmac and esp-3des and esp-sha-hmac for strong encryption and authentication