IKE Policies
Table of Contents >> IPsec/IKE Programmer's Reference
IPsec is used to protect traffic between one or more sets of peers. However, IPsec requires keying material for the different cryptographic algorithms used for this protection. This information can be provided to the IPsec Security Database manually, or it can be negotiated by IKE. IKE Policies provide a set of rules that govern the attributes of this negotiation between sets of peers.
To enable this feature, define TM_USE_IKE_POLICIES in <trsystem.h>.
 Note:
|
IKE Policies require the use of priorities. See the Priority-based IPsec Processing section for more details. |
IKE Policy configuration is not unlike IPsec Policy configuration. IKE Policy configuration includes IKE Policy Selector and IKE Policy Transform definition along with a configurable methodology for matching these two sets into a distinct protection suite. This allows multiple sets of peers to establish certain criteria that governs the negotiation of IPsec keying material.
Processing
When incoming IKE traffic is received, the IKE Policy Database is searched in priority order. Priorities are established such that lower priority values have precedence over higher values. IKE Policy Selectors are matched against incoming traffic in similar fashion to IPsec selector matching. The first matching Policy dictates all required parameters for the acceptance of the IKE message. These attributes include accepted transforms, keylengths, lifetimes, preshared keys, and various other IKE-related features.
When outgoing traffic is matched against IPsec policy, a priority reference within the IPsec policy dictates the IKE Policy to be used when forming the outgoing IKE message. This will determine Identity Protect vs. Aggressive Mode, the transforms used in the message, etc.
| Note:
|
The priority space is shared between IPsec Policies and IKE Policies; only one IPsec or IKE Policy can be assigned a given priority. |
User APIs
IKE Policy creation utilizes only a few function calls however relies heavily upon various structures and their formats:
- tfIkePolicyAddByPriority() Provides an interface for creating a single IKE policy
- tfIkePolicyDeleteByPriority() Provides an interface for deleting a single IKE Policy
- tfIkePolicyRestore() Provides an interface for creating IKE Policies in bulk
Additionally, three calls are exposed to manage the IKE SA Database:
- tfIkeClearSas() Clears the IKE SA Database
- tfIkeClearSasByPriority() Clears the IKE SAs by IKE Policy (given priority)
IPsec Functions
The procedure for adding and deleting IPsec Policies differs slightly when using IKE Policies.
1. When using tfPolicyAdd(), specify the Priority of the IKE Policy in the ikePolicy parameter.
2. When using tfPolicyRestore(), specify the Priority of the IKE Policy in the ippPriority data member of ttIpsecPolicyPair.
