Overview Package Class Deprecated Help

ipsec
IPSecTunnel

public class IPSecTunnel

Stats:
ipsec.IPSecTunnelStats ipsec.TrafficForwardingTunnelStats

Properties
autoEstablish Specifies whether to attempt to establish a phase 1 exchange automatically.

type=boolean
default=false
Displayed(tab/group)=Auto-Establish (Dynamic Keying)
bfdDesignate The Designated parameter specifies whether the IPsec tunnel is the designated BFD tunnel.

type=boolean
default=false
Displayed(tab/group)=Designated (BFD)
bfdEnable The Enabled parameter specifies whether to create a BFD object for the IPsec tunnel.

type=boolean
default=false
Displayed(tab/group)=Enabled (BFD)
clearDfBit This specifies whether to clear Do not Fragment (DF) bit in the outgoing packets in this tunnel.

type=boolean
default=false
Displayed(tab/group)=Clear Do-Not-Fragment Bit (/IP Fragmentation)
copyDfBit This specifies whether to copy Do not Fragment (DF) bit in the outgoing packets IPSec tunnel header from the customer clear traffic.

type=boolean
default=false
Displayed(tab/group)=Copy Don't Fragment Bit (/IP Fragmentation)
copyTrafficClass While set to true, it will cause DSCP/ECN(IPv4) or traffic class(IPv6) to be copied from outer IP header to inner IP header after decapsulation.

type=boolean
default=false
Displayed(tab/group)=Copy Traffic Class Upon Decapsulation
creationOrigin

type=svt.L2RouteOriginType
access=read-create
default=manual
encapsulatedIpMtu This specifies the MTU size for IP packets after tunnel encapsulation has been added. The range is 0 or between 512 and 9000. When a value of zero (0) is specified, it indicates the maximum supported MTU size on the SAP for this tunnel.

type=long
default=0
minimum=0
maximum=9000
units=Octets
Displayed(tab/group)=Encapsulated IP MTU (/IP Fragmentation)
hostEsaId Indicates the active ESA that is being used to host this IPsec tunnel. It will contain a non-zero value only when the tunnel is both operationally up and is being hosted by an ESA Virtual Machine.

type=int
access=read-only
default=0
minimum=0
maximum=16
Displayed(tab/group)=ESA ID (/Host ESA)
hostEsaVmId Indicates the active ESA Virtual Machine that is being used to host this IPsec tunnel. It will contain a non-zero value only when the tunnel is both operationally up and is being hosted by an ESA Virtual Machine.

type=int
access=read-only
default=0
minimum=0
maximum=4
Displayed(tab/group)=ESA VM ID (/Host ESA)
icmp6NumPkt2Big This specifies how many packet-too-big ICMPv6 messages are issued.

type=long
default=100
minimum=10
maximum=1000
Displayed(tab/group)=Number of Messages (/ICMPv6 Message Generation)
icmp6Pkt2Big This specifies whether packet-too-big ICMP messages should be sent.

type=boolean
default=true
Displayed(tab/group)=Packet-Too-Big Messages Enabled (/ICMPv6 Message Generation)
icmp6Pkt2BigTime This specifies the time frame in seconds that is used to limit the number of packet-too-big ICMPv6 messages issued per time frame.

type=long
default=10
minimum=1
maximum=60
units=seconds
Displayed(tab/group)=Message Time Frame (/ICMPv6 Message Generation)
icmpFragReq Specifies whether or not 'Fragmentation required and DF flag set' ICMP messages should be sent. If icmpFragReq is not enabled, both icmpFragReqNum and icmpFragReqTime values are set to default.

type=boolean
default=true
Displayed(tab/group)=Fragmentation Messages Enabled (/ICMP Message Generation)
icmpFragReqNum Specifies how many 'Fragmentation required and DF flag set' ICMP messages are transmitted in the time frame specified by icmpFragReqTime

type=long
default=100
minimum=10
maximum=1000
Displayed(tab/group)=Number of Messages (/ICMP Message Generation)
icmpFragReqTime Specifies the time frame in seconds that is used to limit the number of 'Fragmentation required and DF flag set' ICMP messages transmitted per time frame.

type=int
default=10
minimum=1
maximum=60
units=seconds
Displayed(tab/group)=Message Time Frame (/ICMP Message Generation)
ipMtu This specifies the MTU size for IP packets for this tunnel. The range is 0 or between 512 and 9000. When a value of zero (0) is specified, it indicates the maximum supported MTU size on the SAP for this tunnel.

type=long
default=0
minimum=0
maximum=9000
units=Octets
Displayed(tab/group)=Configured IP MTU (/IP Fragmentation)
ipsec.IPSecSecurityAssociation-Set type=Children-Set
ipsec.IPSecTunnelBfd-Set type=Children-Set
ipsec.IPsecTnlDstAddr-Set type=Children-Set
keying Specifies the keying type that this tunnel will use.

type=ipsec.KeyingType
Displayed(tab/group)=Keying
matchTrustAnchor

type=Pointer
access=read-only
default=
Displayed(tab/group)=Match Trust Anchor (Dynamic Keying/Certificate)
operationalFlags Indicates the reason why the tunnel is operationally down.

type=ipsec.TunnelOperFlagsType
access=read-only
Displayed(tab/group)=Operational Flags (States)
pMtuDiscoveryAging Specifies the number of seconds used to age out the learned MTU, which is obtained through path MTU discovery.

type=long
default=900
minimum=900
maximum=3600
units=seconds
Displayed(tab/group)=Path MTU Aging Time (/IP Fragmentation)
privateTcpMssAdjust Specifies the Maximum Segment Size (MSS) for the TCP traffic in an IPsec tunnel which is sent from the private network to the public network. The system may use this value to adjust or insert the MSS option in TCP SYN packet. Valid values (-1|512..9000). The value of '-1' specifies that the TCP MSS adjustment functionality on the private side is disabled.

type=long
default=-1
minimum=-1
maximum=9000
Displayed(tab/group)=Private (/TCP MSS Adjust)
propogatePMtuV4 Specifies whether or not to propogate a path MTU to IPv4 hosts.

type=boolean
default=true
Displayed(tab/group)=Propogate Path MTU IPv4 (/IP Fragmentation)
propogatePMtuV6 Specifies whether or not to propogate a path MTU to IPv6 hosts.

type=boolean
default=true
Displayed(tab/group)=Propogate Path MTU IPv6 (/IP Fragmentation)
publicTcpMssAdjust Specifies the Maximum Segment Size (MSS) for the TCP traffic in an IPsec tunnel which is sent from the public network to the private network. The system may use this value to adjust or insert the MSS option in TCP SYN packet. Valid values (-1|0|512..9000). The TCP MSS adjustment functionality on the public side network is disabled when the following conditions are met. 1) The value of publicTcpMssAdjust is '-1' or 2) The values of publicTcpMssAdjust and encapsulatedIpMtu are both '0'. The new MSS is calculated based on the following rules. 1) When the value of publicTcpMssAdjust is '0' (auto) and encapsulatedIpMtu has a non-zero value, New MSS = encapsulatedIpMtu - total header size (e.g., encryption, encapsulation, TCP and IP headers) 2) When the value of publicTcpMssAdjust is in the range of (512..9000) New MSS = publicTcpMssAdjust.

type=long
default=-1
minimum=-1
maximum=9000
Displayed(tab/group)=Public (/TCP MSS Adjust)
remoteAddressType Specifies the address of the interface on the remote node of this IPsec tunnel.

type=rtr.InetAddressType
default=ipv4
Displayed(tab/group)=Remote Gateway Address Type (/Tunnel Endpoints)
remoteIpAddress Specifies the address of the idisplnterface on the remote node of this IPsec tunnel.

type=InetAddress
default=0.0.0.0
Displayed(tab/group)=Remote Gateway Address (/Tunnel Endpoints)
secPlcyStrictMatch Specifies whether or not the system does a strict match for this IPsec tunnel when it receives a CREATE_CHILD exchange request, which is not for rekey.

type=boolean
default=false
Displayed(tab/group)=Strict Match (/Security Policy)
securityPolicyId Specifies the IPsec security policy entry in the tmnxIPsecPolicyTable that this tunnel.

type=int
access=read-only
default=0
minimum=0
maximum=8192
securityPolicyPointer

type=Pointer
default=
Displayed(tab/group)=Security Policy ID (/Security Policy)
tunnelName Specifies the user-provided description for each tmnxIPsecTunnelEntry in the table tmnxIPsecTunnelTable.

type=string
access=read-create
default=
minimum=1
maximum=32
Mandatory on create
Displayed(tab/group)=Name
  
Properties inherited from ipsec.IPSecBaseTunnel
description, dynamicKeyTransformId1Pointer, dynamicKeyTransformId2Pointer, dynamicKeyTransformId3Pointer, dynamicKeyTransformId4Pointer, localDynamicKeyTransformId1Pointer, localDynamicKeyTransformId2Pointer, localDynamicKeyTransformId3Pointer, localDynamicKeyTransformId4Pointer, replayWindow
 
Properties inherited from ipsec.IPSecBaseEntity
certFile, certProfilePointer, certTrustAnchorPointer, defaultResult, gwAddressType, gwIpAddress, ikePolicyPointer, keyFile, localCertTrustAnchorPointer, localIdType, localIdValue, localIkePolicyPointer, preSharedKey, primary, remoteIdType, remoteIdValue, secondary, trustAnchorProfilePointer
 
Properties inherited from svt.GenericMsIsaTunnel
adminState, operationalState, portId, sapEncapValue, serviceId, serviceIdPointer, siteId, siteServiceId, svcName
 
Properties inherited from ManagedObject
actionMask, children-Set, deploymentState, isFaultSquelched, name, objectFullName, selfAlarmed
 
Supported Network Elements
7750 SR Supported from 10.0.R1 until 13.0.R13
  • Excluded chassis types: 7750-SR1, 7750-SRc4, 7750-SRa4, 7750-SRa8, 7750 SR-1e, 7750 SR-2e, 7750 SR-3e, 7750-SR1 Fixed CFM, 7750 SR-14s, 7750 SR-7s, 7750 SR-1s, 7750 SR-2s
Supported from 13.0.R13 until 14.0.R1
  • Excluded chassis types: 7750-SRc4, 7750-SRa4, 7750-SRa8, 7750-SR1 Fixed CFM, 7750 SR-14s, 7750 SR-7s, 7750 SR-1s, 7750 SR-2s
Supported from 14.0.R1 until 14.0.R4
  • Excluded chassis types: 7750-SRc4, 7750-SRa4, 7750-SRa8, 7750 SR-1e, 7750 SR-2e, 7750 SR-3e, 7750-SR1 Fixed CFM, 7750 SR-14s, 7750 SR-7s, 7750 SR-1s, 7750 SR-2s
Supported from 14.0.R4 until 20.10.R1
  • Excluded chassis types: 7750-SRc4, 7750-SRa4, 7750-SRa8, 7750-SR1 Fixed CFM, 7750 SR-14s, 7750 SR-7s, 7750 SR-1s, 7750 SR-2s
Supported from 20.10.R1 until 21.2.R1
  • Excluded chassis types: 7750-SRc4, 7750-SRa4, 7750-SRa8, 7750 SR-14s, 7750 SR-7s, 7750 SR-1s
Supported from 21.2.R1 until 21.7.R1
  • Excluded chassis types: 7750-SRc4, 7750-SRa4, 7750-SRa8, 7750 SR-7s, 7750 SR-14s
Supported from 21.7.R1
  • Excluded chassis types: 7750-SRc4, 7750-SRa4, 7750-SRa8
7705 SAR Gen 2
7450 ESS Supported from 11.0.R1
  • Excluded chassis types: 7450-ESS1
  • Required Capabilities: MixedMode
7705 SAR Hm
7705 SAR Supported from 6.1.R1
  • Excluded chassis types: 7705-SARM ASAP, 7705-SARM, 7705-SARM ASAP FL, 7705-SARM FL, 7705 SAR-A T1/E1, 7705 SAR-A, 7705-SARF
7705 SAR H Supported from 6.1.R1
Product Specifics
7450 ESS 20.0
7450 ESS 21.0
7450 ESS 22.0
7450 ESS 23.0
7450 ESS 24.0
7450 ESS 25.0
7705 SAR Gen 2 25.0
7705 SAR H 20.0
7705 SAR H 21.0
7705 SAR H 22.0
7705 SAR H 23.0
7705 SAR H 24.0
7705 SAR H 25.0
7705 SAR H 9.0
7705 SAR Hm 20.0
7705 SAR Hm 21.0
7705 SAR Hm 22.0
7705 SAR Hm 23.0
7705 SAR Hm 24.0
7705 SAR Hm 25.0
7705 SAR 20.0
7705 SAR 21.0
7705 SAR 22.0
7705 SAR 23.0
7705 SAR 24.0
7705 SAR 25.0
7750 SR 20.0
7750 SR 21.0
7750 SR 22.0
7750 SR 23.0
7750 SR 24.0
7750 SR 25.0