Ipsec For Ipv6 Routing Protocols; Protocols And Standards; Configuring Ipsec For Ipv6 Routing Protocols; Configuring An Ipsec Proposal - HP 3600 v2 Series Security Configuration Manual

IPsec for IPv6 routing protocols

You can use IPsec to protect routing information and defend against attacks for these IPv6 routing
protocols: The 3600 v2 EI switches support using IPsec for OSPFv3, IPv6 BGP, and RIPng; the 3600 v2
SI switches only support using IPsec for RIPng.
IPsec enables these IPv6 routing protocols to encapsulate outbound protocol packets and de-encapsulate
inbound protocol packets with the AH or ESP protocol. If an inbound protocol packet is not IPsec
protected, or fails to be de-encapsulated, for example, due to decryption or authentication failure, the
routing protocol discards that packet.
You must manually configure SA parameters in an IPsec policy for IPv6 routing protocols. The IKE key
exchange mechanism is applicable only to one-to-one communications. IPsec cannot implement
automatic key exchange for one-to-many communications on a broadcast network, where routers must
use the same SA parameters (SPI and key) to process packets for a routing protocol.

Protocols and standards

Protocols and standards relevant to IPsec are as follows:
• RFC 2401, Security Architecture for the Internet Protocol
RFC 2402, IP Authentication Header
•
RFC 2406, IP Encapsulating Security Payload
•
RFC 4552, Authentication/Confidentiality for OSPFv3
•

Configuring IPsec for IPv6 routing protocols

The following is the generic configuration procedure for configuring IPsec for IPv6 routing protocols:
Configure an IPsec proposal to specify the security protocols, authentication and encryption
1.
algorithms, and encapsulation mode.
Configure a manual IPsec policy to specify the keys and SPI.
2.
Apply the IPsec policy to an IPv6 routing protocol.
3.
Complete the following tasks to configure IPsec for IPv6 routing protocols:
Task

Configuring an IPsec proposal

Configuring an IPsec policy
Applying an IPsec policy to an IPv6 routing
protocol
Configuring an IPsec proposal
An IPsec proposal, part of an IPsec policy or an IPsec profile, defines the security parameters for IPsec SA
negotiation, including the security protocol, the encryption and authentication algorithms, and the
encapsulation mode.
Follow these steps to configure an IPsec proposal:
Remarks
Required
Required
Required
See Layer 3—IP Routing Configuration Guide.
264