Configuring Ipsec For Ripng - HP VSR1000 Security Configuration Manual

Transform set: ESP-ENCRYPT-AES-CBC-128 ESP-AUTH-SHA1
SA duration (kilobytes/sec): 3000/28800
SA remaining duration (kilobytes/sec): 2300/797
Max received sequence-number: 1
Anti-replay check enable: N
Anti-replay window size:
UDP encapsulation used for NAT traversal: N
Status: active
[Outbound ESP SAs]
SPI: 3840956402 (0xe4f057f2)
Transform set: ESP-ENCRYPT-AES-CBC-128 ESP-AUTH-SHA1
SA duration (kilobytes/sec): 3000/28800
SA remaining duration (kilobytes/sec): 2312/797
Max sent sequence-number: 1
UDP encapsulation used for NAT traversal: N
Status: active

Configuring IPsec for RIPng

Network requirements
As shown in
Establish an IPsec tunnel between the routers to protect the RIPng packets transmitted in between. Specify
the security protocol as ESP, the encryption algorithm as 128-bit AES, and the authentication algorithm as
HMAC-SHA1 for the IPsec tunnel.
Figure 58 Network diagram
Configuration considerations
1. Configure basic RIPng.
For more information about RIPng configurations, see Layer 3—IP Routing Configuration Guide.
2. Configure an IPsec profile.
The IPsec profiles on all the routers must have IPsec transform sets that use the same security
protocol, authentication and encryption algorithms, and encapsulation mode.
The SPI and key configured for the inbound SA and those for the outbound SA must be the same
on each router.
The SPI and key configured for the SAs on all the routers must be the same.
3. Apply the IPsec profile to a RIPng process or to an interface.
Configuration procedure
1. Configure Router A:
# Configure IPv6 addresses for interfaces. (Details not shown.)
Figure 58, Router A, Router B, and Router C learn IPv6 routes through RIPng.
205