11/30/2007 3.0.3 Editorial Changed language and formatting in the technical content. 1/25/2008 4.0 Major Updated and revised the technical content. 3/14/2008 4.0.1 Editorial Changed language and formatting in the technical content. 5/16/2008 4.0.2 Editorial Changed language and formatting in the technical content. 6/20/2008 5.0 Major Updated and revised the technical content. 7/25/2008 6.0 Major Updated and revised the technical content. 8/29/2008 6.1 Minor Clarified the meaning of the technical content. 10/24/2008 6.2 Clarified the meaning of the technical content. 12/5/2008 7.0 Updated and revised the technical content. 1/16/2009 8.0 Major Updated and revised
formatting of the technical content. 3/25/2011 18.1 None No changes to the meaning, language, or formatting of the technical content. 5/6/2011 18.1 None No changes to the meaning, language, or formatting of the technical content. 6/17/2011 18.2 Clarified the meaning of the technical content. 9/23/2011 18.2 None No changes to the meaning, language, or formatting of the technical content. 12/16/2011 19.0 Updated and revised the technical content. 3/30/2012 19.0 None No changes to the meaning, language, or formatting of the technical content. 7/12/2012 19.1 Clarified the meaning of the technical content.
10/25/2012 19.1 None No changes to the meaning, language, or formatting of the technical content. 1/31/2013 20.0 Major Updated and revised the technical content. 8/8/2013 21.0 Updated and revised the technical content. 11/14/2013 21.0 None No changes to the meaning, language, or formatting of the technical content. 2/13/2014 22.0 Major Updated and revised the technical content. 5/15/2014 22.0 None No changes to the meaning, language, or formatting of the technical content. 6/30/2015 23.0 Major Significantly changed the technical content. 10/16/2015 23.0 None No changes to the meaning, language, or formatting of the
ensure that the corresponding IKE (MM) policy is associated with the same security realm ID. If the message from the initiator for negotiating the child SA does not have an "MSFT IPsec Security Realm Id" vendor ID, but the parent IKE SA is associated to a security realm policy, then this message will be discarded by the responder and the child SA negotiation will fail. Note that for rekeying IKE and child IPsec SAs, CREATE_CHILD_SA messages are used, and the security realm vendor ID is used in a manner that is similar to that in the preceding paragraphs. Timer Events None. Other Local Events None.
request for for it has already issued a delete request, it MUST delete the outgoing SAs while processing the request and the incoming SAs while processing the response." 2000 Professional through Windows and Windows 2000 Server through Windows Server 2008. "Note that Message IDs are cryptographically protected and provide protection against message replays. In the unlikely event that Message IDs grow too large to fit in 32 bits, the IKE_SA MUST be closed." Section 2.2 Supported in Windows 2000 Professional through Windows Vista and Windows 2000 Server through Windows Server 2008. "The management interface by which the Shared Secret is provided MUST accept ASCII strings of at least 64 octets and MUST NOT add a null terminator before using them as shared secrets. It MUST also accept a HEX encoding of the Shared Secret." Section 2.15 Supported in Windows 2000 Professional through Windows Vista and Windows 2000 Server through Windows Server 2008. "IKEv2 simplifies this situation by requiring that ECN be usable in the outer IP headers of all tunnel-mode SAs created by IKEv2. Specifically, tunnel encapsulators Section 3.6 Supported in Windows 2000 Professional through Windows Vista and Windows 2000 Server through Windows
"…regard connections as anomalous and audit their existence should they persist." Section 1.4 Supported in Windows 2000 Professional through Windows Vista and Windows 2000 Server through Windows Server 2008. "IKEv2 implementations SHOULD be of the maximum UDP message size supported." Section 2 Supported in Windows 2000 Professional through Windows Vista and Windows 2000 Server through Windows Server 2008. "An endpoint supporting a window size greater than one SHOULD be capable of processing incoming requests out of to maximize performance in the event of network failures or packet reordering." Section 2.4 Supported in Windows 2000 Professional through Windows and Windows 2000 Server through Windows Server 2008. "An endpoint SHOULD suspect that the other endpoint has failed based on routing information and initiate a request to see whether the other endpoint is alive." Section 2.4 Supported in Windows 2000 Professional through Windows Vista and Windows 2000 Server through Windows Server 2008. "…implementations SHOULD reject as invalid a message with those Section 2.5 Supported in Windows 2000 Professional closed
payloads in any other order." through Windows Vista and Windows 2000 Server through Windows Server 2008. "Implementations SHOULD support in-place rekeying of SAs." Section 2.8 Supported in Windows 2000 Professional through Windows and Windows 2000 Server through Windows Server 2008. "If redundant SAs are created though such a collision, the SA created with the lowest of the four used in the two exchanges SHOULD be by the endpoint that created it." Section 2.8 Supported in Windows 2000 Professional through Windows Vista and Windows 2000 Server through Windows Server 2008. "If an initiator receives a message on an SA for which it has not received a response to its CREATE_CHILD_SA request, it SHOULD interpret that as a likely packet loss and retransmit the CREATE_CHILD_SA request." Section 2.8 Supported in Windows 2000 Professional through Windows and Windows 2000 Server through Windows Server 2008. "If an error occurs outside the context of an IKE request (e.g., the node is getting ESP messages on a nonexistent SPI), the node SHOULD Section 2.21 Supported in Windows 2000 Professional through Windows Vista and Windows
initiate an INFORMATIONAL exchange with a Notify payload describing the problem." 2000 Server through Windows Server 2008. "A node SHOULD treat such a message (and also a network message like ICMP destination unreachable) as a hint that there might be problems with SAs to that IP address and SHOULD initiate a liveness test for any such IKE_SA. An implementation SHOULD limit the frequency of such tests." Section 2.21 Supported in Windows 2000 Professional through Windows Vista and Windows 2000 Server through Windows Server 2008. "There are cases where a box decides to remove mappings that are still alive (for example, the keepalive interval is too long, or the NAT box is rebooted). To recover in these cases, hosts that are not behind a NAT SHOULD send all packets (including retransmission packets) to the IP address and port from the last valid authenticated packet from the other end." Section 2.23 Supported in Windows 2000 Professional through Windows Vista and Windows 2000 Server through Windows Server 2008. "To assure maximum interoperability, implementations MUST be to send at one of ID_IPV4_ADDR, ID_FQDN, ID_RFC822_ADDR, or ID_KEY_ID, and Section 3.5 Supported in Windows 2000 Professional through Windows Vista and Windows 2000 Server through Windows
IKE extension Windows NT 4.0 operating system (with additional download) Windows 2000 operating system Windows 2000 operating system Service Pack 4 (SP4) post-SP4 rollup NAT-T X X IKE fragmentation X authentication Fast failover Reliable delete X IKE extension XP XP system Service Pack 2 (SP2) Server 2003 Vista and Server 2008 Windows 7 and Windows Server 2008 R2 Windows 8, Windows Server 2012, Windows 8.1, and Windows Server 2012 R2 Windows 10 and Windows Server 2016 NAT-T X X X X X X IKE X X X X X X CGA X X X X Fast failover X X X X X X Negotiation discovery X X X X Reliable delete X X X X X X X IKEv2 SA Correlation X X X IKEv2 Attributes X X X Denial of Service protection X X X X X X X Dead Peer Detection X * X
Xbox Multiplayer Gaming Vendor IDs X Security Realm (IKEv2) Vendor IDs X <3> Section 1.3.8: The IKE/AuthIP Coexistence extension is not implemented in Windows 2000, Windows XP and Windows Server 2003. <4> Section 1.7: The following table lists the algorithms that are implemented in each Windows version. Authentication method Windows 2000 Windows XP Windows Server 2003 Windows Vista and Windows Server 2008 Windows 7 and Windows Server 2008 R2 Windows 8 and later, and Windows Server 2012 and later Pre-shared key (as specified in ) X X X X X X RSA signature (as specified in [RFC2409]) X X X X X X Kerberos using -API (as specified in ) X X X X X X CGA (as specified in ) X X X <5> Section 1.7: The following tables list the cryptographic parameters that are implemented in each Windows version.
Windows 2000 Windows XP Windows Server 2003 Windows Vista and Windows Server 2008 Windows 7 and Windows Server 2008 R2 Windows 8 and later, and Windows Server 2012 and later Default 768-bit MODP group [RFC2409] X X X X X X Alternate 1,024-bit MODP group [RFC2409] X X X X X X 2,048-bit MODP group X X X X ECP256 ) X X X ECP384 (as specified in [ECP] X X X Authentication algorithm Windows 2000 Windows XP Windows Server 2003 Windows Vista and Windows Server 2008 Windows 7 and Windows Server 2008 R2 Windows 8 and later, and Windows Server 2012 and later NULL X X X X X X HMAC-SHA1-96 X X X X X X HMAC-MD5-96 X X X X X X AES-MAC X X SHA-256 X X
Windows 8.1 00 00 00 09 Windows Server 2012 R2 00 00 00 09 Windows 10 00 00 00 09 Windows Server 2016 00 00 00 09 Common name String representation Wire representation (MD5 hash of string) Version Microsoft implementation Windows 2000 "MS NT5 ISAKMPOAKLEY" + version number 2 1E 2B 51 69 05 99 1C 7D 7C 96 FC BF B5 87 E4 61 00 00 00 02 Windows 2000 Microsoft implementation Windows XP "MS NT5 ISAKMPOAKLEY" + version number 3 1E 2B 51 69 05 99 1C 7D 7C 96 FC BF B5 87 E4 61 00 00 00 03 Windows XP Microsoft implementation Windows Server 2003 "MS NT5 ISAKMPOAKLEY" + version number 4 1E 2B 51 69 05 99 1C 7D 7C 96 FC BF B5 87 E4 61 00 00 00 04 Windows Server 2003 Microsoft implementation Windows "MS NT5 ISAKMPOAKLEY" + version number 5 1E 2B 51 69 05 99 1C 7D 7C 96 FC BF B5 87 E4 61 00 00 00 05 Windows Vista Microsoft implementation Windows Server 2008 "MS NT5 ISAKMPOAKLEY" + version number 6 1E 2B 51 69 05 99 1C 7D 7C 96 FC BF B5 87 E4 61 00 00 00 06 Windows Server 2008 Microsoft implementation Windows 7 "MS NT5 ISAKMPOAKLEY" + version number 7 1E 2B 51 69 05 99 1C 7D 7C 96 FC BF B5 87 E4 61 00 00 00 07 Windows 7 Microsoft implementation Windows Server 2008 R2 "MS NT5 ISAKMPOAKLEY" + version number 8 1E 2B 51 69 05 99 1C 7D 7C 96 FC BF B5 87 E4 61 00 00 00 08 Windows Server 2008 R2 Microsoft implementation Windows 8 "MS NT5 ISAKMPOAKLEY" + version number 9 1E 2B 51 69 05 99 1C 7D 7C 96 FC BF B5 87 E4 61 00 00 00 09 Windows 8 Microsoft implementation Windows Server 2012 "MS NT5 ISAKMPOAKLEY" + version number 9 1E 2B 51 69 05 99 1C 7D 7C 96 FC BF B5 87 E4 61 00 00 00 09 Windows Server 2012
Index A Abstract data model CGA authentication ( 29, 39) 42 57 29 fast failover client ( 29, 42) fast failover server ( 29, 44) IKE fragmentation ( 29, 35) NAT traversal ( 29, 33) negotiation discovery ( 29, 49) reliable delete ( 29, 53) 44 19 23 23 15 C 20 CGA authentication abstract data model ( 29, 39) 40 40 42 41 38 19 19 41 41 41 41 41 42 41 42 40 89 Client 42 43 overview ( 29, 42) 43 26 26 27 27 D Data model - abstract CGA authentication ( 29, 39) 42 57 29 fast failover client ( 29, 42) fast failover server ( 29, 44) IKE fragmentation ( 29, 35) NAT traversal ( 29, 33) negotiation discovery ( 29, 49) reliable delete ( 29, 53) 44 55 16 abstract data model ( 29, 57) 58 57 59 58 56 58 58 58 58 59 57 E 21 70 F 16 Fast failover client abstract data model ( 29, 42) 44 43 43 44 43 42 receiving message #1 ( 43, 43) 43 44 43 Fast failover server abstract data model ( 29, 44) 45 44 45 45 44 45 45 45 45 44 20 22 15 G 9 H triggered events 40
58 43 45 36 33 50 30 54 I 23 23 15 abstract data model ( 29, 35) 38 38 36 36 38 36 34 36 37 37 36 38 36 22 22 IKE MM SA negotiation ( 33, 36, 40, 43, 45) 17 72 51 72 13 Initialization 40 43 57 43 44 36 50 30 54 44 33 9 L Local events 42 59 44 45 38 34 53 32 56 M Message processing 41 58 43 45 36 33 52 31 receiving message #1 ( 33, 36, 41, 43, 43, 45, 52, 55, 55, 58) receiving message #2 ( 34, 37, 41, 45, 52, 58) receiving message #3 ( 41, 58) 41 receiving message #5 ( 41, 52) receiving message #6 ( 42, 53) receiving messages ( 34, 37) 55 Messages 23 26 27 23 22 21 21 26 24 28 21 21 N NAT traversal abstract data model ( 29, 33) 33 33 34 33 overview ( 14, 32) 21 33 34 34 33 34 33 21 21 21 16 abstract data model ( 29, 49) 50 50 53 52 45 52 52 52 53 52 53 50