z/OS Communications Server: IP Messages Volume 2 (EZB, EZD)
Previous topic | Next topic | Contents | Contact z/OS | Library | PDF


EZD1911I

z/OS Communications Server: IP Messages Volume 2 (EZB, EZD)
SC27-3655-01

EZD1911I
FIPS140 support is enabled for the IKE daemon and no valid IpDataOffers were found in IpDynVpnAction ( IDVAname )

Explanation

This message is issued when the IKE daemon is enabled to support the Level 1 security requirements of Federal Information Processing Standard publication 140-2 (FIPS 140), and one or more IpDataOffer objects were omitted from the specified IpDynVpnAction object. If the IKE daemon is enabled for FIPS 140, the daemon omits IpDataOffer objects that use the DES, MD5, or AES_XCBC cryptographic algorithms, or Pfs with Diffe-Hellman groups 1, 2, or 5 from any proposal it builds.

In the message text:
IDVAname
The IpDynVpnAction name that is configured in the policy.

System action

The SA negotiation fails; the IKE daemon continues.

Operator response

Contact the system programmer.

System programmer response

If you want the IKE daemon to be enabled to support FIPS 140, ensure that at least one IpDataOffer object exists in the specified IpDynVpnAction object that does not contain any of the following:
  • HowToEncrypt DES
  • HowToAuth Hmac_MD5
  • HowToAuth AES128_XCBC_96
  • Pfs Group1, Group2, or Group5 (specified in the IpDataOffer's associated IpDynVpnAction)
  • InitiateWithPfs Group1, Group2, Group5 (specified in the IpDataOffer's associated IpDynVpnAction)
  • AcceptablePfs Group1, Group2, Group5 (specified in the IpDataOffer's associated IpDynVpnAction)

If you do not want the IKE daemon to be enabled to support FIPS 140, then configure FIPS140 No on the IkeConfig statement in the IKED configuration file and restart the IKE daemon.

See the information about Policy Agent and policy applications in z/OS Communications Server: IP Configuration Reference for more information about configuring policy.

User response

Not applicable.

Problem determination

Not applicable.

Source

z/OS® Communications Server TCP/IP: IKE daemon

Module

policy.cpp

Routing code

Not applicable.

Descriptor code

Not applicable.

Automation

Not applicable.

Example

EZD1911I FIPS140 support is enabled for the IKE daemon and no valid  IpDataOffers were found in 
         IpDynVpnAction ( TCS4_Vipa81-TCS7_Vipa81 )

Go to the previous page Go to the next page




Copyright IBM Corporation 1990, 2014