264
IPsec for IPv6 routing protocols
You can use IPsec to protect routing information and defend against attacks for these IPv6 routing
protocols: The 3600 v2 EI switches support using IPsec for OSPFv3, IPv6 BGP, and RIPng; the 3600 v2
SI switches only support using IPsec for RIPng.
IPsec enables these IPv6 routing protocols to encapsulate outbound protocol packets and de-encapsulate
inbound protocol packets with the AH or ESP protocol. If an inbound protocol packet is not IPsec
protected, or fails to be de-encapsulated, for example, due to decryption or authentication failure, the
routing protocol discards that packet.
You must manually configure SA parameters in an IPsec policy for IPv6 routing protocols. The IKE key
exchange mechanism is applicable only to one-to-one communications. IPsec cannot implement
automatic key exchange for one-to-many communications on a broadcast network, where routers must
use the same SA parameters (SPI and key) to process packets for a routing protocol.
Protocols and standards
Protocols and standards relevant to IPsec are as follows:
• RFC 2401, Security Architecture for the Internet Protocol
• RFC 2402, IP Authentication Header
• RFC 2406, IP Encapsulating Security Payload
• RFC 4552, Authentication/Confidentiality for OSPFv3
Configuring IPsec for IPv6 routing protocols
The following is the generic configuration procedure for configuring IPsec for IPv6 routing protocols:
1. Configure an IPsec proposal to specify the security protocols, authentication and encryption
algorithms, and encapsulation mode.
2. Configure a manual IPsec policy to specify the keys and SPI.
3. Apply the IPsec policy to an IPv6 routing protocol.
Complete the following tasks to configure IPsec for IPv6 routing protocols:
Task Remarks
Configuring an IPsec proposal Required
Configuring an IPsec policy Required
Applying an IPsec policy to an IPv6 routing
protocol
Required
See Layer 3—IP Routing Configuration Guide.
Configuring an IPsec proposal
An IPsec proposal, part of an IPsec policy or an IPsec profile, defines the security parameters for IPsec SA
negotiation, including the security protocol, the encryption and authentication algorithms, and the
encapsulation mode.
Follow these steps to configure an IPsec proposal:
To Next Page
Loading...
Need help?
General