IPsec Configuration Policy Information Model
Extracted elements (28)
ExecutionStrategy 'Do Until Success' behaves asymmetrically: an IKE initiator tries each action in ActionOrder until one succeeds (e.g., trying main mode then aggressive mode, or multiple peers), while a responder uses the first appropriate action from the ordered list. 'Do All' supports nested SA construction (e.g., outer tunnel then inner transport). 'Do Until Failure' is inherited from PCIMe but is not expected to be useful for IPsec.
IKERejectAction goes beyond a simple UDP/500 packet discard: because SACondition can reference a PeerIDPayloadFilterEntry (available immediately in aggressive mode), a responder can selectively reject negotiations from specific peer identities, providing finer-grained denial-of-service mitigation than blanket IP-address-based filtering.
IPsec policy traverses multiple representations—LDAP schemas, COPS on-the-wire format, XML documents, and text-based configuration languages. A single task-independent canonical information model is needed so that each task-specific representation can be derived from a common, precisely specified source.
MinLifetimeSeconds and MinLifetimeKilobytes on IKENegotiationAction prevent denial-of-service attacks in which a peer requests an arbitrarily short SA lifetime, forcing frequent and computationally expensive Diffie-Hellman renegotiations. Setting either property to zero disables the minimum check.
UML static class diagrams were chosen as the canonical form because they provide a graphical, task-independent way to model systems. The conceptual UML view does not necessarily translate class-for-class into any particular implementation; for example, an LDAP schema may flatten the hierarchy to fewer classes due to reference-following inefficiency.
IPsecPolicyForEndpoint associates a PolicyGroup with a specific IPProtocolEndpoint (interface). If that association is absent, the system-wide IPsecPolicyForSystem PolicyGroup is used as the default fallback for that endpoint. An endpoint may have at most one associated PolicyGroup.
The information model is designed so that additional key exchange protocols beyond IKE can be integrated by subclassing SANegotiationAction; only IKENegotiationAction is currently defined. The object-oriented inheritance from PCIM/PCIMe also allows future IPsec extensions to be added without restructuring existing classes.
Actions contained in an IKERule MUST be IKEAction or IKERejectAction (phase 1 actions); actions in an IPsecRule MUST be phase 2 or preconfigured SA actions (e.g., IPsecTransportAction, IPsecBypassAction). All SARule-contained actions MUST be subclasses of SAAction or instances of CompoundPolicyAction.
An SARule instance MUST contain at least one SACondition instance, as expressed by the [1..n] PartComponent cardinality on SAConditionInRule.
Each SARule in a valid PolicyGroup MUST have a unique associated priority number in PolicySetComponent.Priority to ensure deterministic rule ordering.
If a CredentialFilterEntry check fails during IKE negotiation, the IKE negotiation MUST be stopped and the triggering IKEAction is considered a failure.
In SARule subclass instances, the Mandatory property MUST be set to 'true' and SequencedActions MUST be set to 'mandatory' if those properties are present. PolicyDecisionStrategy must be set to 'FirstMatching'.
The ActionOrder property in PolicyActionInSARule MUST be unique within an SARule to guarantee deterministic execution order. Lower values have higher precedence (1 is highest); behavior when two actions share the same order value is undefined.
The wildcard matching mechanisms for PeerIDPayloadFilterEntry MUST be supported for all ID payload types supported by the local IKE entity. The '*' wildcard replaces 0 or more instances of any character within the constraints of MatchIdentityType.
CredentialFilterEntry matches IKE peer credentials (CredentialType: 1=X.509, 2=Kerberos) during phase 1. MatchFieldName names a certificate attribute (e.g., 'subjectName', 'issuerName', 'subjectAltName'); MatchFieldValue supports '*' wildcards on character boundaries. DistinguishedName values are stored as ordinary strings but must be DER-encoded at runtime before comparison.
IKEAction specifies IKE phase 1 negotiation parameters: ExchangeMode (1=base, 2=main, 4=aggressive), UseIKEIdentityType (per IKE DOI), VendorID payload value, and AggressiveModeGroupId. It is derived from IKENegotiationAction and carries phase 1-specific parameters alongside the inherited MinLifetimeSeconds, MinLifetimeKilobytes, and IdleDurationSeconds.
IKENegotiationAction provides three properties shared by all IKE/IPsec negotiation actions: MinLifetimeSeconds (minimum acceptable SA lifetime in seconds; 0=no minimum), MinLifetimeKilobytes (minimum kilobyte lifetime; 0=no minimum), and IdleDurationSeconds (inactivity timeout before SA deletion; 0=disable idle detection).
IKERule associates SAConditions and SAActions for IKE phase 1 negotiations. It adds IdentityContexts (string array), where multiple array entries are ORed, and within a single entry multiple context names are ANDed using '&&' syntax in alphabetical UCS-2 order, enabling selection of the appropriate IKE identity per VPN context.
IPsecAction is the abstract base for IPsecTransportAction and IPsecTunnelAction. Key properties: UsePFS (boolean), UseIKEGroup (reuse phase 1 DH group for phase 2 PFS), GroupId (16-bit; vendor range 32768–65535 requires VendorID), and Granularity (1=subnet, 2=address, 3=protocol, 4=port) controlling how the SA selector is derived from the triggering packet.
IPsecTunnelAction and PreconfiguredTunnelAction include DFHandling (16-bit): 1=copy DF bit from inner IP header to outer, 2=force outer DF=1, 3=clear outer DF=0. This controls fragmentation behavior for IPsec tunnel-mode encapsulation.
IPSOFilterEntry matches traffic using IP Security Options (RFC 1108) header fields: MatchConditionType selects ClassificationLevel (1) or ProtectionAuthority (2); MatchConditionValue MUST be a value from RFC 1108 (e.g., ClassificationLevel: TopSecret=61, Secret=90, Confidential=150, Unclassified=171). Used to adjust IPsec encryption strength according to traffic classification.
PeerIDPayloadFilterEntry filters on IKE ID payload values and applies only to IKERule responders: immediately in aggressive mode, delayed in main mode. MatchIdentityValue supports wildcards: '*@example.com' for user FQDNs, '*.example.com' for host FQDNs, 'cn=*,...' for DN patterns, CIDR notation (e.g., '193.190.125.0/24') and glob patterns for IP addresses.
PreconfiguredSAAction models manually keyed SAs. The SPI is stored in the TransformOfPreconfiguredAction association; the session key is stored in SharedSecret with protocol ('ESP-encrypt', 'ESP-auth', or 'AH') and RemoteID formatted as '<peer-IP>/<IN|OUT>/<SPI-hex>'. Although the class is concrete, PreconfiguredSAAction MUST NOT be instantiated directly; only PreconfiguredTransportAction and PreconfiguredTunnelAction may be used.
SACondition is the condition anchor for IKE and IPsec rules. Condition components that lack a corresponding runtime value are evaluated as TRUE, unless the protocol completed without providing the required information. Each SACondition MUST be associated with exactly one FilterList via FilterOfSACondition.
SARule is a concrete but non-instantiable base class for IKERule and IPsecRule. It carries the LimitNegotiation property (unsigned 16-bit integer: 1=initiator-only, 2=responder-only, 3=both) to constrain whether a rule applies to new phase 1 or phase 2 negotiations; the property is ignored during SA refresh when the selector matches an existing SA.
The DoPacketLogging property on SAAction, when set to true and propagated to an optional SADB field after SA creation, causes a log message to be generated each time that SA is used to process a packet. For SAStaticActions (bypass, discard, reject), the log is generated at action execution time rather than per-packet.
The IPsec Policy Model class hierarchy derives from PCIM/PCIMe and DMTF CIM. The top-level policy classes are SARule (base), IKERule, and IPsecRule. Action classes span SAStaticAction (IKERejectAction, IPsecBypassAction, IPsecDiscardAction, PreconfiguredSAAction) and SANegotiationAction (IKENegotiationAction → IKEAction, IPsecAction → IPsecTransportAction, IPsecTunnelAction). Transform classes are AHTransform, ESPTransform, and IPCOMPTransform.
AcceptCredentialFrom specifies which CredentialManagementServices (e.g., CAs, Kerberos KDCs) are trusted to certify peer credentials. If a peer's credential is not issued by a listed service or its trust hierarchy, the CredentialFilterEntry does not match, preventing unauthorized peers from satisfying policy conditions.