F5BigIkePeer

F5BigIkePeer is a Custom Resource Definition (CRD) that configures an Internet Protocol Security (IPsec) tunnel on F5 BIG-IP Next Cloud-Native Network Function (CNF). The CR defines the IKE Phase 1 negotiation parameters (proposals, authentication, lifetime), one or more IPsec policies with Phase 2 proposals, and traffic selectors that determine which traffic is routed through the IPsec tunnel.

Use the F5BigIpsecIkePeer CR to:

• Establish an IKE connection with a remote peer using certificate-based (X.509) or preshared key (PSK) authentication.

• Configure IKE Phase 1 cryptographic proposals including integrity, encryption, pseudo-random function (PRF), and Diffie-Hellman (DH) group algorithms.

• Define one or more IPsec policies with Phase 2 proposals for tunnel encryption and integrity.

• Specify traffic selectors that filter source and destination traffic for the IPsec tunnel.

• Configure Dead Peer Detection (DPD) intervals and IKE security association lifetimes.

CR parameters

The sections and list of parameters to define the F5BigIkePeer CR.

metadata

Parameter	Description
name	The name of the IKE peer configuration.
namespace	Specifies the Kubernetes namespace in which the IKE peer will be installed.

spec

The following fields are required: name, remoteAddress, local, remote, ipsecPolicies.

Parameter	Description	Default
name string	The name of the IKE peer configuration object used for identification. Must match the pattern ^[0-9a-zA-Z._-]*$. Length: 1–255 characters. You must specify this parameter.
remoteAddress string	The remote peer IP address for the IKE connection. Accepts IPv4 or IPv6 format. Maximum length: 45 characters. You must specify this parameter.
lifetime integer	The length of time, in minutes, before the IKE Security Association (SA) expires. Valid range: 1–4294967295.	1440
dpdDelay integer	The amount of time, in seconds, allowed between two Dead Peer Detection (DPD) proof-of-liveness requests. Valid range: 0–4294967295.	30

spec.proposals[]

Defines the list of IKE Phase 1 cryptographic algorithm proposals for key exchange and authentication. Each entry in the proposals array defines a single proposal containing integrity, encryption, Pseudo-Random Function (PRF), and DH group algorithms.

Parameter	Description	Default
integrity string	The integrity algorithm used for IKE authentication during Phase 1 negotiation. Allowed values: md5, sha1, sha256, sha384, sha512, aes-gcm128, aes-gcm192, aes-gcm256.	sha512
encryption string	The encryption algorithm used for IKE Phase 1 SA negotiation. Allowed values: des, 3des, aes128, aes192, aes256, aes-gcm128, aes-gcm192, aes-gcm256.	aes256
prf string	The Pseudo-Random Function (PRF) algorithm used to derive keying material for all cryptographic functions. Allowed values: sha1, sha256, sha384, sha512.	sha512
dhGroup string	The Diffie-Hellman (DH) group for IKE Phase 1 and Phase 2 negotiations. Allowed values: none, ecp256, ecp384, ecp521, modp768, modp1024, modp1536, modp2048, modp3072, modp4096, modp6144, modp8192.	modp2048

spec.local

Defines the local peer’s IKE authentication, including identity, method, and credentials. The following fields are required: id, auth.

Parameter	Description	Default
id string	The local peer's IKE identity presented for authentication. Accepts an IPv4 address, IPv6 address, or Fully Qualified Domain Name (FQDN). Length: 1–255 characters. You must specify this parameter.
auth string	The authentication method for the local peer in IKE negotiation. Allowed values: certificate, presharedkey. You must specify this parameter.

spec.local.certificateSecretRef

References a Kubernetes secret that contains the local peer’s certificate, private key, and optional passphrase. Required when local.auth is set to certificate.

Parameter	Description	Default
name string	The name of the Kubernetes secret containing the local peer's certificate, private key, and optional passphrase. Must match the pattern ^[0-9a-zA-Z.\-_]*$. Length: 1–255 characters. You must specify this parameter.
certificate string	The key name in the secret for the local peer certificate. Must match the pattern ^[0-9a-zA-Z.\-_]*$. Maximum length: 255 characters.	"tls.crt"
privateKey string	The key name in the secret for the private key. Must match the pattern ^[0-9a-zA-Z.\-_]*$. Maximum length: 255 characters.	"tls.key"
keyPassphrase string	The key name in the secret for the passphrase. Required only if the private key is encrypted. Must match the pattern ^[0-9a-zA-Z.\-_]*$. Maximum length: 255 characters.	""

spec.remote

Defines the remote peer’s identity and authentication credentials. The following fields are required: id, auth.

Parameter	Description	Default
id string	The remote peer's IKE identity presented for authentication. Accepts an IPv4 address, IPv6 address, or FQDN. Length: 1–255 characters. You must specify this parameter.
auth string	The authentication method for remote peer verification. Allowed values: certificate, presharedkey. You must specify this parameter.

spec.remote.secretRef

References a Kubernetes secret that contains the remote peer’s credentials. The secret contents depend on the authentication method:

• When remote.auth is certificate: the secret contains a Certificate Authority (CA) certificate.

• When remote.auth is presharedkey: the secret contains a pre-shared key.

Parameter	Description	Default
name string	The name of the Kubernetes secret containing the remote peer credentials (CA certificate or pre-shared key). Must match the pattern ^[0-9a-zA-Z.\-_]*$. Length: 1–255 characters. You must specify this parameter.
caCertificate string	The key name for the CA certificate in the secret. Used when remote.auth is certificate. Must match the pattern ^[0-9a-zA-Z.\-_]*$. Maximum length: 255 characters.	"ca.crt"
presharedKey string	The key name for the pre-shared key in the secret. Used when remote.auth is presharedkey. Must match the pattern ^[0-9a-zA-Z.\-_]*$. Maximum length: 255 characters.	"psk"

spec.ipsecPolicies[]

Defines the list of IPsec policies that control how the BIG-IP system protects data-plane traffic. At least one IPsec policy is required. Each policy is uniquely identified by name.

The following fields are required: name, localAddress, remoteAddress, trafficSelectors.

Parameter	Description	Default
name string	The name of the IPsec policy. Must match the pattern ^[/0-9a-zA-Z._-]*$. Length: 1–255 characters. You must specify this parameter.
description string	An optional description for this IPsec policy. Maximum length: 512 characters.	""
mode string	The IPsec tunnel processing mode. Allowed value: tunnel.	"tunnel"
protocol string	The IPsec protocol. Encapsulating Security Payload (ESP) provides encryption and authentication. Allowed value: esp. Authentication Header (AH) is not supported.	"esp"
localAddress string	The local endpoint IP address of the IPsec tunnel. Accepts IPv4 or IPv6 format. Maximum length: 45 characters. You must specify this parameter.
remoteAddress string	The remote endpoint IP address of the IPsec tunnel. Accepts IPv4 or IPv6 format. Maximum length: 45 characters. You must specify this parameter.
lifetime integer	The length of time, in minutes, before the IPsec SA expires. Valid range: 0–4294967295.	1440

spec.ipsecPolicies[].proposals[]

Defines the list of IPsec Phase 2 cryptographic algorithm proposals for tunnel encryption and integrity.

Parameter	Description	Default
integrity string	The integrity algorithm for IPsec Phase 2 authentication and data integrity verification. Allowed values: sha1, sha256, sha384, sha512, aes-gcm128, aes-gcm192, aes-gcm256, aes-gmac128, aes-gmac192, aes-gmac256.	sha512
encryption string	The encryption algorithm for IPsec Phase 2 SA data protection. Allowed values: null, 3des, aes128, aes192, aes256, aes-gcm128, aes-gcm192, aes-gcm256, aes-gmac128, aes-gmac192, aes-gmac256.	aes256
dhGroup string	The Diffie-Hellman (DH) group for IPsec Phase 2 Perfect Forward Secrecy (PFS) key exchange negotiation. Allowed values: none, modp768, modp1024, modp1536, modp2048, modp3072, modp4096, modp6144, modp8192.	modp2048

Note: The IPsec policy proposals support additional algorithms compared to the IKE proposals, including aes-gmac128, aes-gmac192, aes-gmac256 for integrity and a null option for encryption (authentication-only mode).

spec.ipsecPolicies[].trafficSelectors[]

Defines the list of traffic selectors that control which traffic flows through the IPsec tunnel. At least one traffic selector is required per policy. Each traffic selector is uniquely identified by name.

The following fields are required: name, sourceAddress, destinationAddress.

Parameter	Description	Default
name string	The name of the traffic selector. The traffic selector is a packet filter that defines the source and destination IP addresses for application traffic destined for the IPsec tunnel. Must match the pattern ^[/0-9a-zA-Z._-]*$. Length: 1–255 characters. You must specify this parameter.
description string	An optional description for this traffic selector. Maximum length: 512 characters.	""
sourceAddress string	The host or network IP address from which the application traffic originates. Accepts IPv4, IPv4 with CIDR subnet, IPv6, or IPv6 with prefix length. Maximum length: 49 characters. You must specify this parameter.
sourcePort integer	The source port number used by the application traffic for IPsec traffic selection matching. Valid range: 0–65535.	0
destinationAddress string	The host or network IP address to which the application traffic is destined. Accepts IPv4, IPv4 with CIDR subnet, IPv6, or IPv6 with prefix length. Maximum length: 49 characters. You must specify this parameter.
destinationPort integer	The destination port number used by the application traffic for IPsec traffic selection matching. Valid range: 0–65535.	0
protocol string	The network protocol for this traffic selector. Accepts a protocol name (all, tcp, udp, icmp) or an IANA protocol number (0–254).	"all"

IPsec supported algorithms

This section lists the encryption and authentication algorithms supported for Internet Protocol Security (IPsec) on F5 BIG-IP Next Cloud-Native Network Function (CNF) 2.4.

Authentication algorithms

Authentication algorithms verify the integrity of data packets and ensure they have not been changed in transit.

Algorithm	Value in CR	Description
MD5	md5	Message Digest 5; provides basic 128-bit integrity checking
SHA-1	sha1	Secure Hash Algorithm 1; produces a 160-bit hash for integrity verification
SHA-256	sha256	Secure Hash Algorithm 2; produces a 256-bit hash for integrity verification
SHA-384	sha384	Secure Hash Algorithm 2; produces a 384-bit hash for integrity verification
SHA-512	sha512	Secure Hash Algorithm 2; produces a 512-bit hash for integrity verification
AES-GCM-128	aes-gcm128	AES Galois/Counter Mode with a 128-bit key; provides authenticated encryption (AEAD)
AES-GCM-192	aes-gcm192	AES Galois/Counter Mode with a 192-bit key; provides authenticated encryption (AEAD)
AES-GCM-256	aes-gcm256	AES Galois/Counter Mode with a 256-bit key; provides authenticated encryption (AEAD)

Encryption algorithms

Encryption algorithms protect the confidentiality of data packets by scrambling their contents.

Algorithm	Value in CR	Description
DES	des	Data Encryption Standard; uses a 56-bit key for symmetric encryption
3DES	3des	Triple DES; applies DES three times with a 168-bit effective key for stronger encryption
AES-128	aes128	Advanced Encryption Standard with a 128-bit key for symmetric encryption
AES-192	aes192	Advanced Encryption Standard with a 192-bit key for symmetric encryption
AES-256	aes256	Advanced Encryption Standard with a 256-bit key for symmetric encryption
AES-GCM-128	aes-gcm128	AES Galois/Counter Mode with a 128-bit key; provides encryption and integrity in a single operation (AEAD)
AES-GCM-192	aes-gcm192	AES Galois/Counter Mode with a 192-bit key; provides encryption and integrity in a single operation (AEAD)
AES-GCM-256	aes-gcm256	AES Galois/Counter Mode with a 256-bit key; provides encryption and integrity in a single operation (AEAD)

Note

AES-GCM algorithms provide both encryption and authentication (also known as Authenticated Encryption with Associated Data, or AEAD). When you use an AES-GCM algorithm for encryption, you do not need to specify a separate integrity algorithm.

Peer authentication methods

Peer authentication methods verify the identity of the remote peer during IKEv2 negotiation.

Method	Value in CR	Description
Pre-Shared Key (PSK)	presharedkey	Both peers share a secret key configured in advance
Certificate	certificate	Authentication uses RSA public/private key pairs and X.509 certificates

Diffie-Hellman groups

Diffie-Hellman (DH) groups define the key exchange strength for IKE Phase 1 and Phase 2 negotiations. Higher group numbers provide stronger security but require more computational resources.

Group	Value in CR	Description
ECP 256-bit	ecp256	Elliptic Curve Diffie-Hellman (ECDH) with a 256-bit prime; provides strong key exchange with shorter keys
ECP 384-bit	ecp384	ECDH with a 384-bit prime; provides stronger key exchange than ECP 256
ECP 521-bit	ecp521	ECDH with a 521-bit prime; provides the highest elliptic curve key strength available
MODP 768-bit	modp768	Modular Exponentiation (MODP) with a 768-bit prime; provides minimal key exchange strength
MODP 1024-bit	modp1024	MODP with a 1024-bit prime; provides basic key exchange strength
MODP 1536-bit	modp1536	MODP with a 1536-bit prime; provides moderate key exchange strength
MODP 2048-bit	modp2048	MODP with a 2048-bit prime; provides standard key exchange strength suitable for most deployments
MODP 3072-bit	modp3072	MODP with a 3072-bit prime; provides enhanced key exchange strength
MODP 4096-bit	modp4096	MODP with a 4096-bit prime; provides high key exchange strength for sensitive environments
MODP 6144-bit	modp6144	MODP with a 6144-bit prime; provides very high key exchange strength
MODP 8192-bit	modp8192	MODP with an 8192-bit prime; provides the highest MODP key exchange strength available

IPsec protocol

Protocol	Value in CR	Description
Encapsulating Security Payload (ESP)	esp	Provides encryption, authentication, and integrity for data packets

Prerequisites

Ensure you have:

• Installed the CNF Controller Pods.

• A Linux based workstation.

• For certificate authentication: Kubernetes Secrets containing the local peer certificate/key and the remote peer CA certificate in the same namespace.

• For preshared key authentication: a Kubernetes Secret containing the preshared key in the same namespace.

• Network connectivity between the local and remote tunnel endpoints.

CR Example

• IPsec tunnel with certificate authentication

  apiVersion: "k8s.f5net.com/v1"
  kind: F5BigIkePeer
  metadata:
    name: "ipsec-peer-cert"
    namespace: "cnf-gateway"
  spec:
    name: "ike-peer-west"
    remoteAddress: "203.0.113.1"
    lifetime: 1440
    dpdDelay: 30
    proposals:
      - integrity: "sha256"
        encryption: "aes256"
        prf: "sha256"
        dhGroup: "modp2048"
    local:
      id: "10.10.10.1"
      auth: "certificate"
      certificateSecretRef:
        name: "ike-local-cert"
        certificate: "tls.crt"
        privateKey: "tls.key"
    remote:
      id: "203.0.113.1"
      auth: "certificate"
      secretRef:
        name: "ike-remote-ca"
        caCertificate: "ca.crt"
    ipsecPolicies:
      - name: "ipsec-policy-1"
        localAddress: "10.10.10.1"
        remoteAddress: "203.0.113.1"
        proposals:
          - integrity: "sha256"
            encryption: "aes256"
            dhGroup: "modp2048"
        trafficSelectors:
          - name: "ts-all-traffic"
            sourceAddress: "10.0.0.0/8"
            destinationAddress: "172.16.0.0/12"
  

• IPsec tunnel with preshared key authentication

  apiVersion: "k8s.f5net.com/v1"
  kind: F5BigIkePeer
  metadata:
    name: "ipsec-peer-psk"
    namespace: "cnf-gateway"
  spec:
    name: "ike-peer-east"
    remoteAddress: "198.51.100.1"
    lifetime: 720
    dpdDelay: 15
    proposals:
      - integrity: "sha512"
        encryption: "aes256"
        prf: "sha512"
        dhGroup: "modp4096"
    local:
      id: "gw.example.com"
      auth: "presharedkey"
    remote:
      id: "peer.example.com"
      auth: "presharedkey"
      secretRef:
        name: "ike-psk-secret"
        presharedKey: "psk"
    ipsecPolicies:
      - name: "ipsec-policy-psk"
        localAddress: "10.10.10.1"
        remoteAddress: "198.51.100.1"
        trafficSelectors:
          - name: "ts-web"
            sourceAddress: "10.10.10.0/24"
            destinationAddress: "192.168.1.0/24"
            protocol: "tcp"
            destinationPort: 443
  

• IPsec tunnel with multiple policies and traffic selectors

  apiVersion: "k8s.f5net.com/v1"
  kind: F5BigIkePeer
  metadata:
    name: "ipsec-peer-multi"
    namespace: "cnf-gateway"
  spec:
    name: "ike-peer-multi-policy"
    remoteAddress: "192.0.2.1"
    local:
      id: "10.10.10.1"
      auth: "certificate"
      certificateSecretRef:
        name: "ike-local-cert"
    remote:
      id: "192.0.2.1"
      auth: "certificate"
      secretRef:
        name: "ike-remote-ca"
    ipsecPolicies:
      - name: "policy-mgmt"
        description: "Management traffic"
        localAddress: "10.10.10.1"
        remoteAddress: "192.0.2.1"
        lifetime: 480
        proposals:
          - integrity: "sha384"
            encryption: "aes192"
            dhGroup: "modp3072"
        trafficSelectors:
          - name: "ts-ssh"
            sourceAddress: "10.10.10.0/24"
            destinationAddress: "192.0.2.0/24"
            protocol: "tcp"
            destinationPort: 22
          - name: "ts-snmp"
            sourceAddress: "10.10.10.0/24"
            destinationAddress: "192.0.2.0/24"
            protocol: "udp"
            destinationPort: 161
      - name: "policy-data"
        description: "Application data traffic"
        localAddress: "10.10.10.1"
        remoteAddress: "192.0.2.1"
        trafficSelectors:
          - name: "ts-app"
            sourceAddress: "10.10.0.0/16"
            destinationAddress: "172.16.0.0/12"
  

• IPsec tunnel with IPv6

  apiVersion: "k8s.f5net.com/v1"
  kind: F5BigIkePeer
  metadata:
    name: "ipsec-peer-v6"
    namespace: "cnf-gateway"
  spec:
    name: "ike-peer-v6"
    remoteAddress: "2001:db8:100::1"
    local:
      id: "2001:db8::1"
      auth: "presharedkey"
    remote:
      id: "2001:db8::1"
      auth: "presharedkey"
      secretRef:
        name: "ike-psk-v6"
    ipsecPolicies:
      - name: "ipsec-v6"
        localAddress: "2001:db8::1"
        remoteAddress: "2001:db8:100::1"
        trafficSelectors:
          - name: "ts-v6"
            sourceAddress: "2001:db8:1::/48"
            destinationAddress: "2001:db8:2::/48"