Table of Contents
Advertisement
Quick Steps for Configuring an IPsec Discard Policy
Quick Steps for Configuring an IPsec Discard
Policy
IPsec can be used for discarding IPv6 traffic as well as configuring encryption and authentication. For
discard policies, no rules, SAs or keys need to be defined.
1
Define the policy. The commands below use similar policy information as in the previous example but
the action has been changed to discard:
-> ipsec policy Discard_ALLoutMD5 source 664:1:1:1::199/64 destination
664:1:1:1::1/64 protocol any out discard admin-state enable
-> ipsec policy Discard_ALLinMD5 source 664:1:1:1::1/64 destination
664:1:1:1::199/64 protocol any in discard admin-state enable
2
Use the following show commands to verify the IPsec configuration:
-> show ipsec policy
-> show ipsec ipv6 statistics
IPsec Overview
IPsec provides protection to IPv6 traffic. To achieve this, IPsec provides security services for IPv6 pack-
ets at the network layer. These services include access control, data integrity, authentication, protection
against replay, and data confidentiality. IPsec enables a system to select the security protocols, encryption
and authentication algorithms, and use any cryptographic keys as required. IPsec uses the following two
protocols to provide security for an IPv6 datagram:
•
Encapsulating Security Payload (ESP) to provide confidentiality, data origin authentication and
connectionless integrity.
•
Authentication Header (AH) to provide connectionless integrity and data origin authentication for IPv6
datagrams and to provide optional protection against replay attacks. Unlike ESP, AH does not provide
confidentiality.
IPsec on an OmniSwitch operates in Transport mode. In transport mode only the payload of the IPv6
packet is encapsulated, and an IPsec header (AH or ESP) is inserted between the original IPv6 header and
the upper-layer protocol header. The figure below shows an IPv6 packet protected by IPsec in transport
mode.
page 14-4
OmniSwitch AOS Release 7 Network Configuration Guide
Configuring IPsec
March 2011
Advertisement
Table of Contents
