Port SERVICEACCESS - IPSEC

Port for opening IPSEC-protected connections that can be used by other ports

This port requires a PCAP driver to be installed.

Stimulation

This port has no stimulus capabilities.

Name

Available if

Default value

Valid values

Type

Description

Network interface card

[ONLINE]

string

Used network interface card

MAC address ❲client❳

‘02:00:4C:4F:4F:50’

string

String (format: 02:00:4C:4F:4F:50), ‘default’ if the adapter MAC address should be used

IP address ❲client❳

string

IP address to be used as a client. It must be located in the same subnet as the IP address of the device under test, and must not be equal to the IP address of another participant or the IP address which the operating system assigned to the selected network interface.

Gateway address

string

IP address, leave empty if no gateway is needed

Subnet mask / prefix length

‘default’

string

For IPv4 addresses a subnet mask or prefix length can be given (format: ‘255.255.255.0’ or ‘24’). ‘default’ uses the default subnet mask of the network class of IP address (client).

For IPv6 only a prefix length is accepted and the value ‘default’ is not supported.

VLAN ID

0

int

ID with which VLAN packets should be tagged. (0 -> VLAN is not used)

Certificates ecu.test

string

The certificate or certificates to use for identifying ecu.test. Separate with | if there are multiple certificates.

Private key

string

Private key of the certificate used by ecu.test

root certificate

string

Root certificate for authentication of the remote peer’s certificate

Algorithms for IKEv2 protocol

‘[ENCR_AES_CBC:256, AUTH_HMAC_SHA2_384_192, PRF_HMAC_SHA2_384, DH_GROUP_20]’

string

List of algorithms to use for the IKEv2 protocol. The syntax and a list of all supported algorithms are described in the help file (Tool tracetronic: Ethernet).

Algorithms for Authentication Headers

‘[AUTH_AES_CMAC_96, ESN]’

string

List of algorithms/modes to use for Authentication Headers. The syntax and a list of all supported algorithms are described in the help file (Tool tracetronic: Ethernet).

Authentication Method

‘ECDSA_384’

[‘RSA’, ‘PSK’, ‘DSS’, ‘ECDSA_256’, ‘ECDSA_384’, ‘ECDSA_512’, ‘DIGITAL_SIGNATURE’]

string

Method used for authentication of the exchanged certificates. Only takes effect if ecu.test acts as initiator.

MTU

576

int

Default value 576 according to RFC 7383, section 2.5.1.

Do not stop IKEv2

☐

bool

IKEv2 stays active beyond test case execution.

InitRekeying

Exchanges new keys for the specified session

Parameterization

Parameter

Name

Available if

Default value

Valid values

Type

Description

Protocol

‘AH’

[‘AH’, ‘IKE’]

string

Protocol whose key pairs should be renewed

SessionId

int

ID of an previously opened session

SendLivenessRequest

Actively sends a liveness request to the remote party

Parameterization

Parameter

Name

Available if

Default value

Valid values

Type

Description

SessionId

int

ID of an previously opened session

ShutdownConnection

Closes the specified session

Parameterization

Parameter

Name

Available if

Default value

Valid values

Type

Description

SessionId

int

ID of an previously opened session

StartAhManipulation

Starts an IPSEC AH manipulation (s. Header-Manipulation). The parameter value None is default and represents no manipulation. Parameters with the suffix “Flags” are not AH content. They are used to determine the type of manipulation. The valid values for this are in the parameter-specific description.

Parameterization

Parameter

Name

Available if

Default value

Valid values

Type

Description

ICVFlags

int

AH: ICV Flags: None = no manipulation, 1 = set invalid ICV

NextHeader

int

AH: 8 Bit Next Header

PayloadLen

int

AH: 8-bit payload length in 4-octets minus 2

Reserved

ByteStream

AH: 16-bit reserved area (default 0x0000)

SessionId

int

ID of an previously opened session

SNFlags

int

AH: Sequence Number Flags: None = SNStart is absolute, 1 = SNStart is relative to current SN

SNStart

int

AH: 32 Bit Sequence Number Start is applied once after StartAhManipulation. See SNFlags.

SNStep

int

AH: Sequence Number Step is applied to each additional packet after the initial packet.

SPI

int

AH: 32-bit Security Parameters Index

StartIkeManipulation

Starts an IKE manipulation (s. IKE-Manipulation).

Parameterization

Parameter

Name

Available if

Default value

Valid values

Type

Description

Manipulator

object

A ByteStream or a custom manipulation object that is dynamically applied to IKE packets to be sent (s. IKE Manipulation).

StartupConnection

Starts initialization and authentication according to IKEv2 protocol with the specified remote station

Parameterization

Parameter

Name

Available if

Default value

Valid values

Type

Description

AhAlgorithms

string

List of algorithms/modes to use for Authentication Headers. The syntax and a list of all supported algorithms are described in the help file (Tool tracetronic: Ethernet). An empty string will default to the TBC option.

AuthType

[‘RSA’, ‘PSK’, ‘DSS’, ‘ECDSA_256’, ‘ECDSA_384’, ‘ECDSA_512’, ‘DIGITAL_SIGNATURE’]

string

Method used for authentication of the exchanged certificates. Only takes effect if ecu.test acts as initiator. An empty string will default to the TBC option.

Cert

string

The certificate or certificates to use for identifying ecu.test. Separate with | if there are multiple certificates. An empty string will default to the TBC option.

DpdDelay

0

int

Time (in seconds) to wait after the last received message from the remote party until a liveness request is sent. Delay 0 means: no dead peer detection

IkeAlgorithms

string

List of algorithms to use for the IKEv2 protocol. The syntax and a list of all supported algorithms are described in the help file (Tool tracetronic: Ethernet). An empty string will default to the TBC option.

LocalIp

string

Differing client IP address. Used to override the TBC “IP address (client)” option. An empty string will default to the TBC option.

Mtu

int

MTU for packets. If None, the value from the TBC is used.

PrivateKey

string

Private key of the certificate which should be used by ecu.test. An empty string will default to the TBC option.

RootCert

string

Root certificate for authentication of the remote party’s certificate. An empty string will default to the TBC option.

SourceIpRange

string

Eigener IP-Adressbereich, in dem IPsec angewendet werden soll

SourcePortRange

‘1-499, 501-65535’

string

Eigener Portbereich in dem IPsec angewendet werden soll

TargetIp

string

Remote IP address

TargetIpRange

string

IP-Adressbereich der Gegenstelle, in dem IPsec angewendet werden soll

TargetPortRange

‘1-499, 501-65535’

string

Portbereich der Gegenstelle, in dem IPsec angewendet werden soll

Timeout

5

int

Timeout (in seconds) waiting for incoming messages

Return value

Name

Available if

Default value

Valid values

Type

Description

SessionId

int

ID of an previously opened session

StopAhManipulation

Stops an IPSEC-AH manipulation (s. Header Manipulation).

Parameterization

Parameter

Name

Available if

Default value

Valid values

Type

Description

SessionId

int

ID of an previously opened session

StopIkeManipulation

Stops the IKE manipulation (s. IKE-Manipulation).

WaitForConnectionStartup

Waits for the specified remote site to attempt to start initialization and authentication according to the IKEv2 protocol

Parameterization

Parameter

Name

Available if

Default value

Valid values

Type

Description

AhAlgorithms

string

List of algorithms/modes to use for Authentication Headers. The syntax and a list of all supported algorithms are described in the help file (Tool tracetronic: Ethernet). An empty string will default to the TBC option.

AuthType

[‘RSA’, ‘PSK’, ‘DSS’, ‘ECDSA_256’, ‘ECDSA_384’, ‘ECDSA_512’, ‘DIGITAL_SIGNATURE’]

string

Method used for authentication of the exchanged certificates. Only takes effect if ecu.test acts as initiator. An empty string will default to the TBC option.

Cert

string

The certificate or certificates to use for identifying ecu.test. Separate with | if there are multiple certificates. An empty string will default to the TBC option.

DpdDelay

0

int

Time (in seconds) to wait after the last received message from the remote party until a liveness request is sent. Delay 0 means: no dead peer detection

IkeAlgorithms

string

List of algorithms to use for the IKEv2 protocol. The syntax and a list of all supported algorithms are described in the help file (Tool tracetronic: Ethernet). An empty string will default to the TBC option.

LocalIp

string

Differing client IP address. Used to override the TBC “IP address (client)” option. An empty string will default to the TBC option.

Mtu

int

MTU for packets. If None, the value from the TBC is used.

PrivateKey

string

Private key of the certificate which should be used by ecu.test. An empty string will default to the TBC option.

RootCert

string

Root certificate for authentication of the remote party’s certificate. An empty string will default to the TBC option.

SourceIpRange

string

Eigener IP-Adressbereich, in dem IPsec angewendet werden soll

SourcePortRange

‘1-499, 501-65535’

string

Eigener Portbereich in dem IPsec angewendet werden soll

TargetIp

string

Remote IP address

TargetIpRange

string

IP-Adressbereich der Gegenstelle, in dem IPsec angewendet werden soll

TargetPortRange

‘1-499, 501-65535’

string

Portbereich der Gegenstelle, in dem IPsec angewendet werden soll

Timeout

5

int

Timeout (in seconds) waiting for incoming messages

Return value

Name

Available if

Default value

Valid values

Type

Description

SessionId

int

ID of an previously opened session

WaitForRekeying

Waits for the receiver of the specified session to start negotiating new keys

Parameterization

Parameter

Name

Available if

Default value

Valid values

Type

Description

SessionId

int

ID of an previously opened session

TimeToWait

10

int

Timeout (in seconds) waiting for receiver to initiate the exchange of new keys