Ok, I have found how to use the basic AES_128_CCM() function to encrypt data for the ZigBee network payload.
To encrypt use:
AES_128_CCM(
pointer_to_payload,
length_of_payload,
pointer_to_network_aux_header,
length_of_network_aux_header,
pointer_to_nonce,
size_of_nonce,
pointer_to_aes_128_key,
pointer_to_payload,
pointer_to_payload + length_of_network_aux_header + length_of_payload,
security_level,
gSecLib_CCM_Encrypt_c);
To decrypt:
AES_128_CCM(
pointer_to_payload,
length_of_payload - length_of_mic,
pointer_to_nwk_aux_header,
length_of_nwk_aux_header,
pointer_to_nonce,
length_of_nonce,
pointer_to_aes_128_key,
pointer_to_payload,
pointer_to_payload + length_of_nwk_aux_header + length_of_payload - length_of_mic,
security_level,
gSecLib_CCM_Decrypt_c);