Configuring IPsec on an OSPFv3 interface

IPsec can be configured to secure communications on an OSPFv3 interface.

For IPsec to work, the IPsec configuration must be the same on all the routers to which an interface connects.

Currently certain keyword parameters must be entered though only one keyword choice is possible for that parameter. For example, the only authentication algorithm is HMAC-SHA1-96, but you must nevertheless enter the sha1 keyword for this algorithm. Also, although ESP is currently the only authentication protocol, you must enter the esp keyword.

Note: Ensure that OSPFv3 areas are assigned. All device interfaces must be assigned to one of the defined areas on an OSPFv3 router. When an interface is assigned to an area, all corresponding subnets on that interface are automatically included in the assignment.
  1. Enter the configure terminal command to access global configuration mode. 
    device# configure terminal
  2. Enter the interface command and specify an interface. 
    device(config)# interface ve 1
  3. Enter the ipv6 ospf area command to assign a specified area to the interface. 
    device(config-vif-1)# ipv6 ospf area 0
  4. Enter ipv6 ospf authentication ipsec spi value esp sha1 and specify a 40-character hexadecimal key. 
    device(config-vif-1)# ipv6 ospf authentication ipsec spi 512 esp sha1 abcef12345678901234fedcba098765432109876
    IPsec is configured on the specified interface with a security parameter index (SPI) value of 512, and the Encapsulating Security Payload (ESP) protocol is selected. Secure Hash Algorithm 1 (SHA-1) authentication is enabled.

The following example enables ESP and SHA-1 on a specified OSPFv3 virtual Ethernet (VE) interface. 

device# configure terminal
device(config)# interface ve 1
device(config-vif-1)# ipv6 ospf area 0
device(config-vif-1)# ipv6 ospf authentication ipsec spi 512 esp sha1 abcef12345678901234fedcba098765432109876
Parent topic: IPsec for OSPFv3