The Internet Key Exchange port (IKE)

[01:14:19] ABILIS_CPX:d p po:ike

PO:921 - Not Saved (SAVE CONF), Not Refreshed (INIT) --------------------------
IKE    ------------------------------------------------------------------------
       LOG:DS       lowpo:902       ACT:YES      mxps:2048   NRTY:3    TB:10
       WDIR:C:\APP\IKE\
       NATT:AUTO    NATT-N-IKE:YES  NATT-PF:YES  NATT-KA:20

Usually this parameter makes possible to activate/deactivate logging functionalities of meaningful events of the port as well as the detection and signalling of alarms in case of critical events.

The following table shows the available options and the related functionalities usable by the parameter:

Option	Meaning
D	Recording of the driver state changes and/or the meaningful events in Debug Log
S	Recording of the driver state changes and/or the meaningful events in the System Log
A	Periodic detection of possible alarms. The detected alarms can be displayed the command ALARM VIEW or by the analogous command available on the UTILITY of the LCD display on the front panel
L	On alarm detection, acoustic signal generation plus a message on the LCD display. This function depends on activation of alarms detection by the "A" option
T	Generation by the Agent SNMP of Abilis CPX of SNMP traps corresponding to any change of the driver state and/or occurring of meaningful events

Beside the already described options the following values are also allowed:

Option	Meaning
NO	It means that all the logging functionalities, alarms detection and generation, above mentioned, are disabled.
ALL	It means that all the logging functionalities, alarms detection and generation, above mentioned, are enabled.
+E	This option added to one or more of the previous ones, extends its (their) set of meaningful events. The value "ALL+E" activates all the options and extends the set of meaningful events. The value "NO+E" is meaningless so it is ignored.

Options can be combined together.

Some examples:

• setting "LOG:DS+E", activates the extended logging functions for Events Log and System Log
• setting "LOG:STA", activates the extended logging functions for System Log, SNMP traps generation and periodic detection of alarm states;

By using the characters "+" and "-" as prefix of one or more options is possible to add or delete one or more functionalities without setting from the scratch the value of the parameters.

Some examples:

• Suppose the current value of the parameter is "LOG:DSTA", by setting "LOG:-A", the periodic detection of eventual alarm states is removed, leaving unchanged all the remaining options; in such way the final value of the parameter will be "LOG:DST";
• Suppose the current value of the parameter is "LOG:ST", by setting "LOG:+DA", the logging function of the events on the Events Log and the periodic alarm detection are added to the already activated options; in such way the final value of the parameter will be "LOG:DSTA".

The changes made on this parameter are immediately activated, without the need of initialization commands.

It sets the Abilis CPX lower level port. It can only be an UDP port.

Value "NONE" isolates the IKE port.

This parameter allows to run-time activate/deactive IKE functionalities.

When it is set to "YES", the port is configured, active, and the IKE driver performs its activities.

When it is set to "NO", the port is configured, active, but the IKE driver does not execute any action.

It specifies maximum length of UDP datagram which can be processed by IKE driver port.

This value cannot be changed without CPX restart.

It specifies maximum number of IKE packet retransmissions.

It specifies retransmission IKE packet delay.

This parameter selects the directory where IKE.CNS file is saved. It cannot be empty. It must be a physical full path in DOS notation, i.e. starting with a drive letter in the range ['A'..'Z'] and ending with the '\' character. The maximum accepted working directory string length is 128 characters. Case is preserved and spaces are allowed, but strings holding spaces must be written between quotation marks (E.g.: "C:\My dir\").

Specifies NAT traversal working mode for IKE port.

NO: NAT traversal is disabled
YES: Forced NAT traversal mode
AUTO: NAT traversal is automatically detected

Specifies whether the NAT traversal port floating is enabled or disabled.

NO: Port floating is disabled
YES: Port floating is enabled

Specifies whether the NAT traversal NON-IKE marker is enabled or disabled.

NO: NON-IKE marker is disabled
YES: NON-IKE marker is enabled

Specifies the NAT traversal keep-alive timer.

[15:00:45] ABILIS_CPX:D S PO:IKE

PO:921 ------------------------------------------------------------------------
IKE    IKE-STATE:ACTIVE       IPSEC-STATE:ACTIVE
       ISAKMP-SA:1    ISAKMP-SA-EST:1    IPSEC-SA:1    IPSEC-SA-EST:1
       - Security Associations diagnostics: -----------------------------------
       SerialNo   Name                                     Type     Side
                  LocIp-LocPort         LocNet/LocMask     State    ReplaceTime
                  RemIp-RemPort         RemNet/RemMask     Pending  ExpiryTime
       ------------------------------------------------------------------------
       13                                                  IPsec    RESPONDER
                  192.168.006.001/500   192.168.006.001/32 QUICK-R2 3422
                  192.168.006.002/500    192.168.006.002/32 0        3542
       ------------------------------------------------------------------------
       12                                                  ISAKMP   RESPONDER
                  192.168.006.001/500   000.000.000.000/00 MAIN-R3  3420
                  192.168.006.002/500    000.000.000.000/00 0        3540
       ------------------------------------------------------------------------

It shows the current state of the IKE port driver.

Driver	States	Description	Values shown in:
			System Log	Events Log	Display LCD
IKE	DOWN	State set when registration to lower UDP port fail (UDP service is not possible).			dn
	INACTIVE	IKE port is running, but the ACT: parameter is set to "NO".			na
	ACTIVE	IKE port is fully ready to work.			RD
	INIT	IKE port is in init state.			in

It shows the current state of the IPsec port driver.

INACTIVE: IPsec port is not "ready" to work with IKE driver.
ACTIVE: IPsec port is fully ready to work.

It shows current number of the ISAKMP Security Associations (Main mode of IKE).

It shows current number of the established ISAKMP Security Associations (Main mode of IKE).

It shows current number of the IPsec Security Associations (Quick mode of IKE).

It shows current number of established the IPsec Security Associations (Quick mode of IKE).

It shows serial number of the ISAKMP/IPsec Security Associations.

Specifies name of the ISAKMP/IPsec Security Association.

Specifies type of the Security Association.

Specifies side of the Security Association.

Local IP address/local IKE UDP port.

Remote IP address/remote IKE UDP port.

Local client network number/mask. For IPsec SA only.

Remote client network number/mask. For IPsec SA only.

It shows the current state (phase) of IKE negotiation for the Security Association.

ISAKMP SA. Main mode of IKE negotiation:

State	Description
MAIN-R0, MAIN-R1	1 IKE message is received from peer (responder side).
MAIN-R2	2 IKE message is received from peer (responder side).
MAIN-R3	3 IKE message is received from peer (responder side). ISAKMP SA is established.
MAIN-I1	1 IKE message is sent to peer (initiator side).
MAIN-I2	2 IKE message is sent to peer (initiator side).
MAIN-I3	3 IKE message is sent to peer (initiator side).
MAIN-I4	3 IKE message is received from peer (initiator side). ISAKMP SA is established.

IPsec SA. Quick mode of IKE negotiation:

State	Description
QUICK-R0, QUICK-R1	1 IKE message is received from peer (responder side).
QUICK-R2	2 IKE message is received from peer (responder side). IPsec SA is established.
QUICK-I1	1 IKE message is sent to peer (initiator side).
QUICK-I2	2 IKE message is sent to peer (initiator side). IPsec SA is established.

Specifies number of the pending IPsec SA connections for the current negotiating ISAKMP SA.

Specifies remaining time (in seconds) to begin replace current ISAKMP/IPsec SA.

Specifies remaining time (in seconds) to expiry current ISAKMP/IPsec SA.

[15:00:45] ABILIS_CPX:D SE PO:IKE

PO:921 ------------------------------------------------------------------------
IKE    --- Cleared 000:00:10:02 ago, on 22/03/2005 at 22:53:43 ----------------
       -----------|---INPUT---|--OUTPUT---|-----------|---INPUT---|--OUTPUT---|
       CHR        |      15220|       1756|LONG       |          0|          0|
       FRM        |         31|         23|BAD-FMT    |          0|           |
       FRM-LOST   |          0|           |DUPLICATED |          6|           |
       ------------------------------------------------------------------------
       -----------|--ISAKMP---|---IPSEC---|
       SA-R       |          4|          9|
       SA-I       |          0|          0|
       SA-EST-R   |          3|          1|
       SA-EST-I   |          0|          0|
       AUTH-FAIL  |          0|          0|
       NO-PROP    |          0|          0|
       ------------------------------------------------------------------------

The INPUT counter is incremented every time IKE port receives a UDP datagram from UDP.

The OUTPUT counter is incremented every time IKE port sends a UDP datagram to UDP.

The INPUT counter is incremented every time IKE port receives a UDP datagram from UDP.

The OUTPUT counter is incremented every time IKE port sends a UDP datagram to UDP

The counter is incremented every time a UDP datagram is discarded because there are no available receiving buffers.

The INPUT counter is incremented every time the IKE port discards a too long incoming UDP datagram.

The OUTPUT counter is incremented every time the IKE port discards a too long outgoing UDP datagram.

The counter is incremented every time the IKE port discards an incoming UDP datgram with bad format.

The counter is incremented every time the IKE port discards a duplicated incoming UDP datgram.

ISAKMP: The counter is incremented every time the remote IKE peer begins ISAKMP SA negotiation (Main mode).

IPSEC: The counter is incremented every time the remote IKE peer begins IPsec SA negotiation (Quick mode).

ISAKMP: The counter is incremented every time the local IKE port begins ISAKMP SA negotiation (Main mode).

IPSEC: The counter is incremented every time the local IKE port begins IPsec SA negotiation (Quick mode).

ISAKMP: The counter is incremented every time the ISAKMP SA is successfully established (Main mode).

IPSEC: The counter is incremented every time the IPsec SA is successfully established (Quick mode).

ISAKMP: The counter is incremented every time the ISAKMP SA is successfully established (Main mode).

IPSEC: The counter is incremented every time the IPsec SA is successfully established (Quick mode).

ISAKMP: The counter is incremented every time the ISAKMP SA negotiation is dropped because authentication is fail (Main mode).

IPSEC: The counter is incremented every time the IPsec SA negotiation is dropped because authentication is fail (Quick mode)

ISAKMP: The counter is incremented every time the ISAKMP SA negotiation is dropped because ISAKMP proposal not choosen (Main mode).

IPSEC: The counter is incremented every time the IPsec SA negotiation is dropped because IPsec proposal not choosen (Quick mode)