Struct:ttIkePolicyInString

 
#include trsecapi.h
 
 
typedef struct tsIkePolicyInString
{
/* Make sure this is first - typecast for tfBuildSelect */
    ttIpsecSelectorInString           ikpsSelectorString;
 
 /* Defines IKE mode, role, PFS , initial contact config */
    ttUser16Bit                       ikpsAttributes;
/*
 * The Dhgroup defined within ttIsakmpTransDataPtr is for Phase 1.  If PFS
 * for Phase 2 is defined, then we need to specify the group to use.
 */
    ttUser8Bit                        ikpsPhase2Dhgroup;
    ttUserVoidPtr                     ikpsPskPtr;
    ttUser16Bit                       ikpsPskLen;
#ifdef TM_USE_IKE_DPD
    ttUser32Bit                       ikpsDpdWorryMetric;
    ttUser32Bit                       ikpsDpdRetransDelay;
    ttUser8Bit                        ikpsDpdRetransLimit;
    ttUser8Bit                        ikpsDpdMode;
#endif /* TM_USE_IKE_DPD */
#ifdef TM_USE_NATT
/* Keep Alive interval in seconds */
    ttUser8Bit                        ikpsNattKAInterval;
#endif /* TM_USE_NATT */
} ttIkePolicyInString;
typedef ttIkePolicyInString TM_FAR * ttIkePolicyInStringPtr;
 

Structure Description

This structure is used when creating IKE Policy database entries with tfIkePolicyRestore(). This defines all aspects of an IKE Policy except for the Phase 1 Transforms.

Members

• ikpsSelectorString

  This is the same IPsec Policy selector structure which defines the source and destination address(es), port(s), and protocol(s)

• ikpsAttributes

  The attributes of the IKE Policy define the behavior and features of the IKE messages. This field may contain any combination of the flags described below except where otherwise noted.

• ikpsPhase2Dhgroup

  This field is currently not active.

• ikpsPskPtr

  IKE Phase 1 negotiations support only preshared key authentication. This points to a user-allocated buffer which represents the preshared key to be used.

• ikpsPskLen

  This value contains the preshared key length pointed to by ikpsPskPtr.

• ikpsDpdWorryMetric

  This contains the Dead Peer Detection Worry Metric.

• ikpsDpdRetransDelay

  This contains the Dead Peer Detection Retransmission Delay.

• ikpsDpdRetransLimit

  This contains the Dead Peer Detection Retransmission Limit.

• ikpsDpdMode

  This contains the Dead Peer Detection Mode.

• ikpsNattKAInterval

  This value contains the time interval, in seconds, between NAT-Traversal keep alive messages. When NAT devices are detected between peers, these keep alive messages are sent to make sure NAT mappings do not expire. Set this to 0 to use the default value provided by TM_IKE_NATT_KA_INTERVAL.

IKE Policy Attribute Flags

• TM_IKE_ROLE_INITIATOR

  This flag must be set in order for local outbound traffic to generate IKE messages if appropriate IPsec SAs are not found.

• TM_IKE_ROLE_RESPONDER

  This flag must be set in order for local incoming IKE messages to be processed for IPsec SA setup.

Note:

TM_IKE_ROLE_INITIATOR and/or TM_IKE_ROLE_RESPONDER must be set in order to create a valid IKE Policy.

• TM_IKE_MODE_MAIN

  This flag must be set to allow Identity Protect processing for this Policy.

• TM_IKE_MODE_AGGRESSIVE

  This flag must be set to allow Aggressive Mode processing for this Policy.

Note:

TM_IKE_MODE_MAIN and/or TM_IKE_MODE_AGGRESSIVE must be set in order to create a valid IKE Policy. If both are set and the local peer is the initiator, Aggressive Mode is tried first, then Main Mode if the former fails.

• TM_IKE_PHASE1_PFS

  This flag must be set to enable Perfect Forward Secrecy.

• TM_IKE_INITIAL_CONTACT

  This flag must be set to enable Initial Contact notifications.

• TM_IKE_DPD

  This flag must be set to enable Dead Peer Detection.

• TM_IKE_NATT

  This flag must be set to enable NAT-T.

• TM_IKE_TRECK

  This flag must be set in order to include the Treck Vendor ID payload in IKE messages. This enables IKE rekey collision logic when communicating with another Treck IKE implementation.

Note:

Numerous IKE Policy features must be enabled using tfIpsecSetOptions() before they will function.