When an IKE negotiation is started, the KeyExchangePolicy statement is searched to locate a matching KeyExchangeRule statement for the negotiation. When this KeyExchangeRule statement is located, the local and remote security endpoint identities are not known with certainty, so this KeyExchangeRule statement is considered tentative until the local and remote identities are known. Then a new search for a KeyExchangeRule statement is performed to locate the final rule.

The policy on the final KeyExchangeRule statement must be consistent with the policy chosen for the Security Association. For IKEv1, see the information about ISAKMP main mode limitations in z/OS Communications Server: IP Diagnosis Guide for more information about IKEv1. For IKEv2, see the information about key exchange limitations in z/OS Communications Server: IP Diagnosis Guide for more information about IKEv2.