MUST delete the outgoing SAs while processing the request and the incoming SAs while processing the response." Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "Note that Message IDs are cryptographically protected and provide protection against message replays. In the unlikely event that Message IDs grow too large to fit in 32 bits, the IKE_SA MUST be closed." Section 2.2 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "The management interface by which the Shared Secret is provided MUST accept ASCII strings of at least 64 octets and MUST NOT add a null terminator before using them as shared secrets. It MUST also accept a HEX encoding of the Shared Secret." Section 2.15 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview.
"IKEv2 simplifies this situation by requiring that ECN be usable in the outer IP headers of all tunnel-mode IPsec SAs created by IKEv2. Specifically, tunnel encapsulators and decapsulators for all SAs created by IKEv2 MUST support the ECN full-functionality option for tunnels specified in [RFC3168] and MUST implement the tunnel encapsulation and decapsulation processing specified in [RFC4301] to prevent discarding of ECN congestion indications." Section 3.6 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "MUST be capable of being configured to send and accept the first two Hash and URL formats (with HTTP URLs)." Section 3.6 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview.
[RFC4306] IKEv2 SHOULD / SHOULD NOT implementation notes RFC Requirement RFC 4306 Section Compliance statement "The initiator SHOULD repeat the request, but now with a KEi payload from the group the responder selected." Section 1.3 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "…regard connections as anomalous and audit their existence should they persist." Section 1.4 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "IKEv2 implementations SHOULD be of the maximum UDP message size supported." Section 2 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 closed
received a response to its CREATE_CHILD_SA request, it SHOULD interpret that as a likely packet loss and retransmit the CREATE_CHILD_SA request." Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "If an error occurs outside the context of an IKE request (e.g., the node is getting ESP messages on a nonexistent SPI), the node SHOULD initiate an INFORMATIONAL exchange with a Notify payload describing the problem." Section 2.21 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "A node SHOULD treat such a message (and also a network message like ICMP destination unreachable) as a hint that there might be problems with SAs to that IP address and SHOULD initiate a liveness test for any such IKE_SA. An implementation SHOULD limit the frequency of such tests." Section 2.21 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016
Technical Preview. "There are cases where a NAT box decides to remove mappings that are still alive (for example, the keepalive interval is too long, or the NAT box is rebooted). To recover in these cases, hosts that are not behind a NAT SHOULD send all packets (including retransmission packets) to the IP address and port from the last valid authenticated packet from the other end." Section 2.23 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "To assure maximum interoperability, implementations MUST be to send at one of ID_IPV4_ADDR, ID_FQDN, ID_RFC822_ADDR, or ID_KEY_ID, and MUST be configurable to accept all of these types. Implementations SHOULD be capable of generating and accepting all of these types." Section 3.5 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "Implementations SHOULD be capable of being configured to send and accept Raw RSA keys." Section 3.6 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1,
and Windows Server 2016 Technical Preview. "To prevent this, the initiator MAY be willing to accept multiple responses to its message, treat each as potentially legitimate, respond to it, and then discard all the invalid connections when it receives a valid cryptographically protected response to any one of its requests." Section 2.4 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "The responder in that case MAY reject the message by sending another response with a new cookie or it MAY keep the old value of <secret> around for a short time and accept cookies computed from either one." Section 2.6 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "An implementation MAY refuse all CREATE_CHILD_SA requests within an IKE_SA." Section 2.8 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows
8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "An initiator MAY send a dummy message on a newly created SA if it has no messages queued in order to assure the responder that the initiator is ready to receive messages." Section 2.8 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "If more than one subset is acceptable but their union is not, the responder MUST accept some subset and MAY include a Notify payload of type ADDITIONAL_TS_POSSIBLE to indicate that the initiator might want to try again." Section 2.9 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "CP(CFG_REQUEST) MUST contain at least an INTERNAL_ADDRESS attribute (either IPv4 or IPv6) but MAY contain any number of additional attributes the initiator wants returned in the response." Section 2.19 Not supported in Windows 7, Windows Server 2008 R2,
8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "NAT_DETECTION_DESTINATION_IP: Alternately, it MAY reject the connection attempt if NAT traversal is not supported." Section 3.10.11 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "HTTP_CERT_LOOKUP_SUPPORTED: This notification MAY be included in any message that can include a CERTREQ payload and indicates that the sender is capable of looking up certificates on an HTTP-based URL." Section 3.10.11 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "The CFG_REPLY Configuration Payload MAY return that value, or a new one. It MAY also add new attributes and not include some requested ones. Requestors MUST ignore returned attributes that they Section 3.15 Not supported in Windows 7, Windows Server 2008 R2,
do not recognize. Some attributes MAY be multi-valued, in which case multiple attribute values of the same type are sent and/or returned." Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. "INTERNAL_IP4_ADDRESS, INTERNAL_IP6_ADDRESS: With IPv6, a requestor MAY supply the low-order address bytes it wants to use. Multiple internal addresses MAY be requested by requesting multiple internal address attributes." Section 3.15.1 Not supported in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. <2> Section 1.3: IKE extensions by operating system cross-reference. Implemented in Windows NT 4.0 operating system, Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. The following tables describe the extensions that each release supports. The IKE proposal for Encapsulating Security Payload (ESP) and Authentication Headers (AH) is deprecated in the Windows 7 implementation of IKE version 2 but supported by IKE version 1 in Windows NT 4.0, Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview. IKE extension Windows NT 4.0 (with additional download) Windows 2000 Windows 2000 SP4 post-SP4 rollup NAT-T X X
IKE fragmentation X CGA authentication Fast failover Negotiation discovery Reliable delete X IKE extension XP XP SP2 Server 2003 Vista and Server 2008 Windows 7 and Windows Server 2008 R2 Windows 8, Windows Server 2012, Windows 8.1, and Windows Server 2012 R2 Windows 10, and Windows Server 2016 Technical Preview NAT-T X X X X X X IKE X X X X X X CGA X X X X Fast failover X X X X X X Negotiation discovery X X X X Reliable delete X X X X X X X IKEv2 SA Correlation X X X IKEv2 Attributes X X X Denial of Service protection X X X X X X X Dead Peer Detection X * X Xbox Multiplayer Gaming X on
Default 768-bit MODP group (as specified in [RFC2409]) X X X X X X Alternate 1,024-bit MODP (as specified in [RFC2409]) X X X X X X 2,048-bit MODP group (as specified in ) X X X X ECP256 (as specified in ) X X X ECP384 (as specified in [ECP]) X X X Authentication algorithm Windows 2000 Windows XP Windows Server 2003 Windows and Windows Server 2008 Windows 7 and Windows Server 2008 R2 Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview NULL (as specified in ) X X X X X X HMAC-SHA1-96 (for more information, see ) X X X X X X HMAC-MD5-96 (as specified in ) X X X X X X
AES-MAC (for more information, see ) X X SHA-256 (for more information, see ) X X Encryption algorithm Windows 2000 Windows XP Windows Server 2003 Windows Vista and Windows Server 2008 Windows 7 and Windows Server 2008 R2 Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 Technical Preview NULL (as specified in [RFC2410]) X X X X X X DES-CBC (for more information, see ) X X X X X X 3DES-CBC (as specified in ) X X X X X X
Timers Added section with content for Windows 10 and Windows Server 2016 Technical Preview. Y New content added. Initialization Added section with content for Windows 10 and Windows Server 2016 Technical Preview. Y New content added. Higher-Layer Triggered Events Added section with content for Windows 10 and Windows Server 2016 Technical Preview. Y New content added. Message Processing Events and Sequencing Rules Added section with content for Windows 10 and Windows Server 2016 Technical Preview. Y New content added. Microsoft Xbox One 2013 Vendor ID Added section with content for Windows 10 and Windows Server 2016 Technical Preview. Y New content Xbox IKEv2 Negotiation Vendor ID Added section with content for Windows 10 and Windows Server 2016 Y New content added.
Technical Preview. Timer Events Added section with content for Windows 10 and Windows Server 2016 Technical Preview. Y New content added. Other Local Events Added section with content for Windows 10 and Windows Server 2016 Technical Preview. Y New content added. Security Realm ID (IKEv2) Vendor IDs Details Added section with content for Windows 10 and Windows Server 2016 Technical Preview. Y New content added. Abstract Data Added section with content for Windows 10 and Windows Server 2016 Technical Preview. Y New content added. Timers Added section with content for Windows 10 and Windows Server 2016 Technical Preview. Y New content Initialization Added section with content for Windows 10 and Windows Y New content added.
Server 2016 Technical Preview. Higher-Layer Triggered Events Added section with content for Windows 10 and Windows Server 2016 Technical Preview. Y New content added. Message Processing Events and Sequencing Rules Added section with content for Windows 10 and Windows Server 2016 Technical Preview. Y New content added. IKE_SA_INIT Messages Added section with content for Windows 10 and Windows Server 2016 Technical Preview. Y New content added. IKE_SA_AUTH and CREATE_CHILD_SA Messages section with content for Windows 10 and Windows Server 2016 Technical Preview. Y New content added. Timer Events Added section with content for Windows 10 and Windows Server 2016 Technical Preview. Y New content Local Events Added section with content for Windows 10 and Windows Y New content added.
Server 2016 Technical Preview. Appendix A: Product Behavior Updated the product applicability list and product behavior notes to include Windows 10 operating system. Y Content update. 6 Appendix A: Product Behavior Updated the product behavior notes to include Windows Server 2016 Technical Preview operating system. Y Product behavior note updated.
Index A Abstract data model CGA authentication ( 28, 39) 42 56 28 fast failover client ( 28, 42) fast failover server ( 28, 43) IKE fragmentation ( 28, 34) NAT traversal ( 28, 32) negotiation discovery ( 28, 48) reliable delete ( 28, 52) 43 18 22 22 14 C 19 CGA authentication abstract data model ( 28, 39) 39 39 41 40 38 18 18 40 40 40 40 40 41 40 41 39 91 Client 42 42 overview ( 28, 41) 42 26 26 26 26 D Data model - abstract CGA authentication ( 28, 39) 42 56 28 fast failover client ( 28, 42) fast failover server ( 28, 43) IKE fragmentation ( 28, 34) NAT traversal ( 28, 32) negotiation discovery ( 28, 48) reliable delete ( 28, 52) 43 54 16 abstract data ( 28, 56) 56 56 57 56 55 56 56 57 56 57 56 E 20 68 F 15 Fast failover client abstract data model ( 28, 42) 43 42 42 43 42 41 receiving message #1 ( 42, 42) 42 43 42 Fast failover server abstract data model ( 28, 43) 44 43 44 44 43 44 44 44 44 43 19 21
33 33 33 33 32 20 20 20 15 abstract data ( 28, 48) 49 49 52 51 44 51 51 51 52 51 52 49 68 70 11 25 23 23 25 O Other local events 44 49 13 13 P Packets 50 49 70 18 18 18 18 18 18 71 Protocol 30 29 31 30 30 31 29 Protocol Details 28 Q 43 43 R 11 12 11 18 15 abstract data model ( 28, 52) 54 53 53 54 53 52 receiving message #1 ( 53, 54) 53 55 54 53 17 S 53 Security 70 70 70 27 Sequencing rules 40 56 42 44 36 33 51 30 53 Server 43 43 44 overview ( 28, 43) 44 43 55 19 Syntax 21 20 20 20