Changes to IKE for the Solaris 10 Release

Since the Solaris 9 release, IKE includes the following functionality:

• IKE can be used to automate key exchange for IPsec over IPv6 networks. For more information, see Key Management With IKE.

  ---

  Note - IKE cannot be used to manage keys for IPsec in a non-global zone.

  ---

• Public key operations in IKE can be accelerated by a Sun Crypto Accelerator 1000 board or a Sun Crypto Accelerator 4000 board. The operations are offloaded to the board. The offloading accelerates encryption, thereby reducing demands on operating system resources. For more information, see IKE and Hardware Acceleration. For procedures, see Configuring IKE to Find Attached Hardware (Task Map).

• Public key certificates, private keys, and public keys can be stored on a Sun Crypto Accelerator 4000 board. For more information on key storage, see IKE and Hardware Storage.

• IKE can be used to automate key exchange for IPsec from behind a NAT box. The traffic must use an IPv4 network. Also, the NAT-traversing IPsec ESP keys cannot be accelerated by hardware. For more information, see IPsec and NAT Traversal. For procedures, see Configuring IKE for Mobile Systems (Task Map).

• Retransmission parameters and packet time out parameters have been added to the /etc/inet/ike/config file. These parameters tune the IKE Phase 1 (Main Mode) negotiation to handle network interference, heavy network traffic, and interoperation with platforms that have different implementations of the IKE protocol. For details about the parameters, see the ike.config(4) man page. For procedures, see Changing IKE Transmission Parameters (Task Map).