IPsec {{bibref|RFC4301}} object that supports the configuration of Encapsulating Security Payload (ESP) {{bibref|RFC4303}} and Authentication Header (AH) {{bibref|RFC4302}} in tunnel mode {{bibref|RFC4301|Section 3.2}}. Use of IKEv2 {{bibref|RFC5996}} is assumed. The IPsec object does not currently support static configuration of tunnels and child Security Associations (SAs). See the IPsec Theory of Operation {{bibref|TR-181i2|Appendix IX}} for a description of the working of this IPsec data model. Enables or disables IPsec. IPsec status. {{enum}} The {{enum|Error}} value MAY be used by the CPE to indicate a locally defined error condition. Indicates whether or not Authentication Header (AH) {{bibref|RFC4302}} is supported. Supported IKEv2 encryption algorithms {{bibref|IKEv2-params|Transform Type 1}}. {{enum}} Note that these are the names from the above reference, transformed as follows: * Leading ''ENCR_'' (when present) discarded because they are all encryption algorithms so it's not needed. * Underscores changed to hyphens to preserve names used in existing data models (and because of inconsistent conventions). * Phrases collapsed where unambiguous, e.g. "with a(n) NN octet ICV" -> "-NN". As additional algorithms are added to the above reference, this data model will be extended according to the above conventions. Supported ESP encryption algorithms {{bibref|IKEv2-params|Transform Type 1}} {{bibref|RFC4835|Section 3.1.1}}. {{enum}} Note that these are the names from the above reference, transformed as follows: * Leading ''ENCR_'' (when present) discarded because they are all encryption algorithms so it's not needed. * Underscores changed to hyphens to preserve names used in existing data models (and because of inconsistent conventions). * Phrases collapsed where unambiguous, e.g. "with a(n) NN octet ICV" -> "-NN". * Some algorithms with apparently rather specialised application are omitted, e.g. ''ENCR_NULL_AUTH_AES_GMAC''. As additional algorithms are added to the above reference, this data model will be extended according to the above conventions. Supported IKEv2 pseudo-random functions {{bibref|IKEv2-params|Transform Type 2}}. {{enum}} Note that these are the names from the above reference, transformed as follows: * Leading ''PRF_'' (when present) discarded because they all pseudo-random functions so it's not needed. * Underscores changed to hyphens to preserve names used in existing data models. * Hyphen inserted after ''AES'' (or other acronym) when immediately followed by a key length. As additional functions are added to the above reference, this data model will be extended according to the above conventions. Supported integrity algorithms {{bibref|IKEv2-params|Transform Type 3}}. {{enum}} Note that these are the names from the above reference, transformed as follows: * Leading ''AUTH_'' (when present) discarded because they all authentication (integrity) algorithms so it's not needed. * Underscores changed to hyphens to preserve names used in existing data models. As additional algorithms are added to the above reference, this data model will be extended according to the above conventions. Supported Diffie-Hellman group transforms {{bibref|IKEv2-params|Transform Type 4}}. {{enum}} Note that these are the names from the above reference, transformed as follows: * Name (other than ''NONE'') always starts with the type of group, currently ''MODP'' or ''ECP'' (implies ECP random). * This is followed by ''-NN'', where ''NN'' is the group length in bits. * this is followed by ''-PRIME-NN'' for groups with prime order subgroups, where ''NN'' is the subgroup length in bits. As additional algorithms are added to the above reference, this data model will be extended according to the above conventions. The maximum number of entries in the {{object|Filter}} table. A value of 0 means no specific limit. The maximum number of entries in the {{object|Profile}} table. A value of 0 means no specific limit. {{numentries}} {{numentries}} {{numentries}} {{numentries}} Global IPsec statistics. These statistics include all IPsec traffic, i.e. all IKEv2 negotiation, IKEv2 SAs and child SAs. The CPE MUST reset global IPsec Stats parameters (unless otherwise stated in individual object or parameter descriptions) either when IPsec is disabled ({{param|#.Enable}} is set to {{false}}) or when IPsec is enabled ({{param|#.Enable}} is set to {{true}}). The total number of times an IPsec negotiation failure has occurred. The total number of {{units}} sent by IPsec. The total number of {{units}} received by IPsec. The total number of {{units}} sent by IPsec. The total number of {{units}} received by IPsec. The total number of {{units}} discarded by IPsec due to any error. This can include packets dropped due to a lack of transmit buffers. The total number of {{units}} discarded by IPsec due to an unknown SPI (Security Parameter Index). The total number of {{units}} discarded by IPsec due to ESP decryption errors. The total number of {{units}} discarded by IPsec due to integrity errors. The total number of {{units}} discarded by IPsec due to replay errors. The total number of {{units}} discarded by IPsec due to policy errors. The total number of {{units}} discarded by IPsec due to errors other than unknown SPI, decryption, integrity, replay or policy errors. This can include packets dropped due to a lack of receive buffers. Filter table that represents the IPsec Security Policy Database (SPD) {{bibref|RFC4301|Section 4.4.1}} selection criteria. Each (ordered) entry defines a set of selection criteria and references a {{object|#.Profile}} table entry that specifies how matching packets will be processed. SPD filtering is performed for all packets that might need to cross the IPsec boundary {{bibref|RFC4301|Section 3.1}}. Given that IPsec operates at the IP level, this means that SPD filtering conceptually occurs after bridging and before routing. For enabled table entries, if {{param|Interface}} is not a valid reference and {{param|AllInterfaces}} is {{false}}, then the table entry is inoperable and the CPE MUST set {{param|Status}} to {{enum|Error_Misconfigured|Status}}. Enables or disables this IPsec Filter table entry. The status of this IPsec Filter table entry. {{enum}} The {{enum|Error_Misconfigured}} value indicates that a necessary configuration value is undefined or invalid. The {{enum|Error}} value MAY be used by the CPE to indicate a locally defined error condition. {{datatype|expand}} For each packet, the highest ordered entry that matches the filter criteria is applied. All lower order entries are ignored. SPD selection criterion. {{reference}} This specifies the ingress interface associated with the entry. It MAY be a layer 1, 2 or 3 interface. However, the types of interfaces for which filters can be instantiated is a local matter to the CPE. SPD selection criterion. This specifies that all ingress interfaces are associated with the entry. If {{true}}, the value of {{param|Interface}} is ignored since all ingress interfaces are indicated. SPD selection criterion. Destination IP address. {{empty}} indicates this criterion is not used, i.e. is ''ANY''. SPD selection criterion. Destination IP address mask. If not {{empty}}, only the indicated network portion of the {{param|DestIP}} address is to be used for selection. {{empty}} indicates that the full {{param|DestIP}} address is to be used for selection. If {{false}}, the rule matches only those packets that match the (masked) {{param|DestIP}} entry, if specified. If {{true}}, the rule matches all packets except those that match the (masked) {{param|DestIP}} entry, if specified. SPD selection criterion. Source IP address. {{empty}} indicates this criterion is not used, i.e. is ''ANY''. SPD selection criterion. Source IP address mask. If not {{empty}}, only the indicated network portion of the {{param|SourceIP}} address is to be used for selection. {{empty}} indicates that the full {{param|SourceIP}} address is to be used for selection. If {{false}}, the rule matches only those packets that match the (masked) {{param|SourceIP}} entry, if specified. If {{true}}, the rule matches all packets except those that match the (masked) {{param|SourceIP}} entry, if specified. SPD selection criterion. Protocol number. A value of -1 indicates this criterion is not used, i.e. is ''ANY''. Note that {{bibref|RFC4301}} refers to this as the ''Next Layer Protocol''. It is obtained from the IPv4 ''Protocol'' or the IPv6 ''Next Header'' fields. If {{false}}, the rule matches only those packets that match {{param|Protocol}}, if specified. If {{true}}, the rule matches all packets except those that match {{param|Protocol}}, if specified. SPD selection criterion. Destination port number. A value of -1 indicates this criterion is not used, i.e. is ''ANY''. The value of this parameter is ignored for protocols that do not use ports, e.g. ICMP (1). SPD selection criterion. If specified, indicates a destination port address range from {{param|DestPort}} through {{param}} (inclusive), in which case {{param}} MUST be greater than or equal to {{param|DestPort}}. A value of -1 indicates that no destination port range is specified. If {{false}}, the rule matches only those packets that match {{param|DestPort}} (or port range), if specified. If {{true}}, the rule matches all packets except those that match {{param|DestPort}} (or port range), if specified. SPD selection criterion. Source port number. A value of -1 indicates this criterion is not used, i.e. is ''ANY''. The value of this parameter is ignored for protocols that do not use ports, e.g. ICMP (1). SPD selection criterion. If specified, indicates a source port address range from {{param|SourcePort}} through {{param}} (inclusive), in which case {{param}} MUST be greater than or equal to {{param|SourcePort}}. A value of -1 indicates that no source port range is specified. If {{false}}, the rule matches only those packets that match {{param|SourcePort}} (or port range), if specified. If {{true}}, the rule matches all packets except those that match {{param|SourcePort}} (or port range), if specified. Indicates how packets that match this rule will be processed {{bibref|RFC4301|Section 4.4.1}}. Packet is not allowed to traverse the IPsec boundary; packet will be discarded Packet is allowed to bypass traverse the IPsec boundary without protection Packet is afforded protection as specified by {{param|Profile}} The profile that defines the IPsec treatment for matching packets. {{reference}} If {{param|ProcessingChoice}} is {{enum|Protect|ProcessingChoice}}, {{param}} MUST NOT be {{empty}}. In this case, if it ever becomes {{empty}}, e.g. because the referenced profile is deleted, this IPsec Filter table entry is invalid and {{param|Status}} MUST be set to {{enum|Error_Misconfigured|Status}}. If {{param|ProcessingChoice}} is not {{enum|Protect|ProcessingChoice}}, {{param}} is ignored. Any changes to the referenced profile will have an immediate effect on any established IPsec tunnels. Such changes will often force IKEv2 sessions and child SAs to be re-established. Profile table that represents the IPsec Security Policy Database (SPD) {{bibref|RFC4301|Section 4.4.1}} processing info. Each entry defines the IPsec treatment for packets that match the {{object|#.Filter}} entries that reference the entry. Controls the maximum number of child Security Association (SA) pairs that can be negotiated by a single IKEv2 session. If a new child SA pair is needed, but the current IKEv2 session already has {{param}} child SA pairs, an additional IKEv2 session (and therefore an additional IPsec tunnel) will be established. A value of 0 means no specific limit. Note that support for more than one child SA pair per IKEv2 session is OPTIONAL {{bibref|RFC5996|Section 1.3}}. The host name or IP address of the remote IPsec tunnel endpoint. If more than one name/address is supplied, they will be tried in turn, i.e. they are in decreasing order of precedence. Identifier of the forwarding policy associated with traffic that is associated with this profile. The forwarding policy can be referenced by entries in the {{object|##.Routing.Router.{i}.IPv4Forwarding}} and {{object|##.Routing.Router.{i}.IPv6Forwarding}} tables, and therefore allows SPD selection criteria to influence the forwarding decision. The "child" security protocol. This is not to be confused with {{object|#.Filter}}.{{param|#.Filter.{i}.Protocol}}, which is an SPD selector that can select packets that already have AH or ESP headers. {{object}}.{{param}} selects whether AH or ESP will be used when encapsulating a packet. Authentication Header {{bibref|RFC4302}}; can only be selected if {{param|#.AHSupported}} is {{true}} Encapsulating Security Payload {{bibref|RFC4303}} IKEv2 CPE authentication method {{bibref|RFC5996|Section 2.15}}. {{reference|an enabled row in the {{object|##.Security.Certificate}} table or in another table that contains appropriate CPE credentials}} If {{empty}}, or the referenced row is disabled or deleted, the CPE chooses the authentication method based on local policy. Allowed IKEv2 encryption algorithms. Allowed ESP encryption algorithms. Allowed IKEv2 pseudo-random functions. Allowed IKEv2 integrity algorithms. Allowed AH integrity algorithms {{bibref|IKEv2-params|Transform Type 3}} {{bibref|RFC4835|Section 3.2}}. Allowed ESP integrity algorithms {{bibref|IKEv2-params|Transform Type 3}} {{bibref|RFC4835|Section 3.1.1}}. Allowed IKEv2 Diffie-Hellman group transforms. IKEv2 Dead Peer Detection (DPD) timeout in {{units}}. {{bibref|RFC5996|section 2.4}} IKEv2 NAT traversal (NAT-T) keepalive timeout in {{units}}. {{bibref|RFC3948|Section 4}} The size of the AH or ESP Anti-Replay Window. {{bibref|RFC4302|Section B.2}} {{bibref|RFC4303|Section A2}} A value of 0 means that Sequence Number Verification is disabled. Controls the value of the ''Do Not Fragment'' (DF) bit. {{bibref|RFC4301|Section 8.1}} Copy from inner header; applies only when both inner and outer headers are IPv4 DSCP with which to mark the outer IP header for traffic that is associated with this IPsec channel. A value of -1 indicates copy from the incoming packet. A value of -2 indicates automatic marking of DSCP. De-tunneled packets are never re-marked. Automatic DSCP marking behavior is a local matter to the CPE, possibly influenced by other Broadband Forum standards that it supports. IKEv2 SA lifetime in {{units}}, or zero if there is no traffic constraint on its expiration. If both {{param}} and {{param|IKEv2SATimeLimit}} are non-zero, the IKEv2 SA is deleted when the first limit is reached. IKEv2 SA lifetime in {{units}}, or zero if there is no time constraint on its expiration. If both {{param}} and {{param|IKEv2SATrafficLimit}} are non-zero, the IKEv2 SA is deleted when the first limit is reached. Action to take when an IKEv2 SA expires, whether as a result of hitting a traffic limit or a time limit. Child SA lifetime in {{units}}, or zero if there is no traffic constraint on its expiration. If both {{param}} and {{param|ChildSATimeLimit}} are non-zero, the child SA is deleted when the first limit is reached. Child SA lifetime in {{units}}, or zero if there is no time constraint on its expiration. If both {{param}} and {{param|ChildSATrafficLimit}} are non-zero, the child SA is deleted when the first limit is reached. Action to take when a Child SA expires, whether as a result of hitting a traffic limit or a time limit. {{numentries}} Each instance of this object represents an IKEv2 Configuration Payload (CP) {{bibref|RFC5996|Section 3.15}} Attribute that MUST, if enabled, be sent in IKEv2 CP CFG_REQUEST messages. All such Attributes MUST be listed. Enables or disables this {{object}} entry. CP Attribute Type as described in {{bibref|RFC5996|Section 3.15.1}} and defined in {{bibref|IKEv2-params|IKEv2 Configuration Payload Attribute Types}}. A hexbinary encoded CP Attribute Value as described in {{bibref|RFC5996|Section 3.15.1}} and defined in {{bibref|IKEv2-params|IKEv2 Configuration Payload Attribute Types}}. Represents an IPsec tunnel, i.e. a virtual IP interface that models an IPsec tunnel entry point and exit point. A {{object}} instance always references (and has the same lifetime as) a ({{enum|Tunnel|##.IP.Interface.{i}.Type}},{{enum|Tunneled|##.IP.Interface.{i}.Type}}) {{object|##.IP.Interface}} pair. The {{object}} instance models the IPsec-specific concepts, the {{enum|Tunnel|##.IP.Interface.{i}.Type}} {{object|##.IP.Interface}} instance models the generic concepts, and the {{enum|Tunneled|##.IP.Interface.{i}.Type}} {{object|##.IP.Interface}} instance exists only so it can be referenced by forwarding or filter rules. {{object}} instances are automatically created (as needed) when {{object|#.Filter}} instances are enabled and disabled. Each instance's {{param|Filters}} parameter references the {{object|#.Filter}} instances that require the {{object}} instance to exist. If this list ever becomes {{empty}}, e.g. because all the referenced {{object|#.Filter}} instances have been disabled or deleted, the CPE MAY choose not to delete the {{object}} instance (and its associated ({{enum|Tunnel|##.IP.Interface.{i}.Type}},{{enum|Tunneled|##.IP.Interface.{i}.Type}}) {{object|##.IP.Interface}} pair). This can be desirable, because {{object|##.QoS.Classification}}, {{object|##.Routing.Router.{i}.IPv4Forwarding}}, {{object|##.Routing.Router.{i}.IPv6Forwarding}} etc instances might be referencing the {{object|##.IP.Interface}} instances. The corresponding auto-created {{enum|Tunnel|##.IP.Interface.{i}.Type}} {{object|##.IP.Interface}} instance. {{reference||delete}} The corresponding auto-created {{enum|Tunneled|##.IP.Interface.{i}.Type}} {{object|##.IP.Interface}} instance. {{reference||delete}} The {{object|#.Filter}} instances that require this {{object}} instance to exist. {{reference}} Statistics for this IPsec tunnel, i.e. all traffic that has passed through the tunnel, including IKEv2 negotiation, IKEv2 SA and ChildSA traffic. The CPE MUST reset the tunnel's Stats parameters (unless otherwise stated in individual object or parameter descriptions) either when the tunnel becomes operationally down due to a previous administrative down (i.e. its associated {{param|###.IP.Interface.{i}.Status}} parameter transitions to a down state after the tunnel has been disabled) or when the tunnel becomes administratively up (i.e. its associated {{param|###.IP.Interface.{i}.Enable}} parameter transition from {{false}} to {{true}}). Note that this object does not include generic statistics that are available in the associated {{object|###.IP.Interface.{i}.Stats}} object. The total number of inbound {{units}} discarded due to ESP decryption errors. The total number of inbound {{units}} discarded due to integrity errors. The total number of inbound {{units}} discarded due to replay errors. The total number of inbound {{units}} discarded due to policy errors. The total number of inbound {{units}} discarded due to errors other than decryption, integrity, replay or policy errors. This can include packets dropped due to a lack of receive buffers. Represents an IKEv2 Security Association (SA), corresponding to an IKEv2 session. Instances are automatically created and deleted as IKEv2 SAs are created and deleted. The current operational state of the IKEv2 SA. The associated {{object|#.Tunnel}} instance. {{reference}} Note that {{param}} is a unique key, i.e only one {{object}} instance is associated with a given {{object|#.Tunnel}} instance. During rekeying {{bibref|RFC5996|Section 2.8}}, a new IKEv2 SA is created and inherits the existing IKEv2 SA's child SAs, then the old IKEv2 SA is deleted. From the management point of view the new and old IKEv2 SAs are the same SA and MUST be modeled using the same {{object}} instance. The local IP address that this IKEv2 SA was negotiated with. This is assigned via IKEv2 and will also be available via the associated {{object|#.Tunnel}}'s {{param|#.Tunnel.{i}.TunnelInterface}} {{object|##.IP.Interface.{i}.IPv4Address}} or {{object|##.IP.Interface.{i}.IPv6Address}} table (as appropriate). The IP address of the peer that this IKEv2 SA was negotiated with. This will be the IP address of one of the security gateways configured via {{param|#.Profile.{i}.RemoteEndpoints}}. The encryption algorithm applied to traffic carried by this IKEv2 SA. This will be one of the {{param|#.Profile.{i}.IKEv2AllowedEncryptionAlgorithms}} from the {{object|#.Profile}} instance via which this IKEv2 SA was created. The length of the encryption key in {{units}} used for the algorithm specified in the {{param|EncryptionAlgorithm}} parameter. The value is 0 if the key length is implicit in the specified algorithm or there is no encryption applied. The pseudo-random function used by this IKEv2 SA. This will be one of the {{param|#.Profile.{i}.IKEv2AllowedPseudoRandomFunctions}} from the {{object|#.Profile}} instance via which this IKEv2 SA was created. The integrity algorithm applied to the traffic carried by this IKEv2 SA. This will be one of the {{param|#.Profile.{i}.IKEv2AllowedIntegrityAlgorithms}} from the {{object|#.Profile}} instance via which this IKEv2 SA was created. The Diffie-Hellman Group used by this IKEv2 SA. This will be one of the {{param|#.Profile.{i}.IKEv2AllowedDiffieHellmanGroupTransforms}} from the {{object|#.Profile}} instance via which this IKEv2 SA was created. When this IKEv2 SA was set up. Whether NAT traversal is supported by the device and, if so, whether a NAT was detected. {{numentries}} {{numentries}} Statistics for this IKEv2 Security Association (SA). The CPE MUST reset the IKEv2 SA's Stats parameters (unless otherwise stated in individual object or parameter descriptions) whenever the associated {{param|#.Tunnel}} instance's Stats parameters are reset. The total number of {{units}} handled in the outbound direction by the IKEv2 SA. The total number of {{units}} handled in the inbound direction by the IKEv2 SA. The total number of {{units}} handled in the outbound direction by the IKEv2 SA. The total number of {{units}} handled in the inbound direction by the IKEv2 SA. The total number of outbound {{units}} from this IKEv2 SA discarded for any reason. This can include {{units}} dropped due to a lack of transmit buffer space. Note that this refers to IKE protocol {{units}}, and not to {{units}} carried by other SAs. The total number of inbound {{units}} to this IKEv2 SA discarded due to decryption errors. Note that this refers to IKEv2 protocol {{units}}, and not to {units}} carried by other SAs. The total number of inbound {{units}} to this IKEv2 SA discarded due to integrity errors. Note that this refers to IKEv2 protocol {{units}}, and not to {{units}} carried by other SAs. The total number of inbound {{units}} to this IKEv2 SA discarded for reasons other than decryption or integrity errors. This can include {{units}} dropped due to a lack of receive buffer space. Note that this refers to IKEv2 protocol {{units}}, and not to {{units}} carried by other SAs. This is a transitory table that lists all the IKEv2 Configuration Payload (CP) {{bibref|RFC5996|Section 3.15}} Attributes that have been received via CFG_REPLY messages. Table entries are automatically created to correspond with received Attributes. However, it is a local matter to the CPE when to delete old table entries. If the same Attribute is received multiple times, it is up to the CPE to decide which entries to include (i.e. whether the same Attribute will be present multiple times). In order to allow for the same Attribute to be present multiple times within the table, this table has no unique key defined. CP Attribute Type as described in {{bibref|RFC5996|Section 3.15.1}} and defined in {{bibref|IKEv2-params|IKEv2 Configuration Payload Attribute Types}}. A hexbinary encoded CP Attribute Value as described in {{bibref|RFC5996|Section 3.15.1}} and defined in {{bibref|IKEv2-params|IKEv2 Configuration Payload Attribute Types}}. Represents a child Security Association (SA) pair, i.e. an inbound child SA and an outbound child SA. The current operational state of the child SA pair. The inbound child SA's Security Parameter Index (SPI). The outbound child SA's Security Parameter Index (SPI). The date and time when the child SA was created. Statistics for this child Security Association (SA). The CPE MUST reset the child SA's Stats parameters (unless otherwise stated in individual object or parameter descriptions) whenever the parent {{object|#}} instance's Stats parameters are reset. The number of {{units}} handled by the outbound child SA. The number of {{units}} handled by the inbound child SA. The number of {{units}} handled by the outbound child SA. The number of {{units}} handled by the inbound child SA. The number of {{units}} discarded by the outbound child SA due to any error. This can include compression errors or errors due to a lack of transmit buffers. The number of {{units}} discarded by the inbound child SA due to decryption errors. The number of {{units}} discarded by the inbound child SA due to integrity errors. The number of {{units}} discarded by the inbound child SA due to replay errors. The number of {{units}} discarded by the inbound child SA due to policy errors. The number of {{units}} discarded by the inbound child SA due to errors other than decryption, integrity, replay or policy errors. This can include decompression errors or errors due to a lack of receive buffers.