Configuring IPsec on OSPFv3 Virtual Links

IP Security (IPsec) can be configured for virtual links.
An OSPFv3 virtual link must be configured.

Currently certain keyword parameters must be entered though only one keyword choice is possible for that parameter. For example, the only authentication algorithm is HMAC-SHA1-96, but you must nevertheless enter the sha1 keyword for this algorithm. Also, although ESP is currently the only authentication protocol, you must enter the esp keyword.

The virtual link IPsec security associations (SAs) and policies are added to all interfaces of the transit area for the outbound direction. For the inbound direction, IPsec SAs and policies for virtual links are added to the global database.

  1. Enter the configure terminal command to access global configuration mode. 
    device# configure terminal
  2. Enter the ip router-id command to specify the router ID. 
    device(config)# ip router-id 10.1.1.1
  3. Enter the ipv6 router ospf command to enter OSPFv3 configuration mode and enable OSPFv3 on the device. 
    device(config)# ipv6 router ospf
  4. Enter area virtual-link authentication ipsec spi value esp sha1 no-encrypt key, specifying an area address and the ID of the OSPFv3 device at the remote end of the virtual link. 
    device(config-ospf6-router)# area 1 virtual-link 10.1.1.1 authentication ipsec spi 512 esp sha1 no-encrypt 1134567890223456789012345678901234567890
    IPsec is configured on the specified virtual link in OSPF area 1.The device ID associated with the virtual link neighbor is 10.1.1.1, the SPI value is 512, and the Encapsulating Security Payload (ESP) protocol is selected. Secure Hash Algorithm 1 (SHA-1) authentication is enabled. The 40-character key is not encrypted in show command displays.

The following example configures IPsec on an OSPFv3 area. 

device# configure terminal
device(config)# ip router-id 10.1.1.1
device(config)# ipv6 router ospf
device(config-ospf6-router)# area 1 virtual-link 10.1.1.1 authentication ipsec spi 512 esp sha1 no-encrypt 1134567890223456789012345678901234567890
Parent topic: IPsec for OSPFv3