TCP Keychain Options

The following commands are available only for TCP keychains:

• authentication-algorithm aes-128-cmac: Configures the AES-128-CMAC algorithm for TCP authentication. The authentication-algorithm hmac-sha-1 command is also supported. The no form of the command removes the configuration.
• accept-ao-mismatch: Determines whether the ICX device accepts or denies TCP segments received with a mismatch in TCP-AO support between the TCP peers. By default, mismatched segments are accepted. When you use the no form of the command to disable the option, TCP-AO packets with a mismatch are discarded. For example, if the authentication option (AO) is not configured for a particular TCP BGP/MSDP peer connection and the ICX device receives over that connection a segment from a peer with the authentication option set, the ICX device determines how the mismatch is handled based on the command option. If the ICX device has the no accept-ao-mismatch option configured, no session will be established with the peer.

• include-tcp-options: Determines whether all TCP options are included in the Message Authentication Code (MAC) calculation. By default, all TCP options are included. When the no form of the command is configured, only the TCP-AO option is included in the MAC calculation.

• send-id: Configures the identifier sent in an outgoing TCP segment. Valid decimal values are 0 through 255. The no form of the command removes the identifier.
• receive-id: Configures the identifier to be compared with the key identifier received in a TCP segment. Valid decimal values are 0 through 255. The no form of the command removes the identifier.