Administrator Guide

• ESP with non-null encryption is supported for full condentiality.
• 3DES, DES, AES-CBC, and NULL encryption algorithms are supported; encrypted and unencrypted keys are supported.
NOTE: To encrypt all keys on a router, use the service password-encryption command in Global Conguration mode.
However, this command does not provide a high level of network security. To enable key encryption in an IPsec security policy at
an interface or area level, specify 7 for [key-encryption-type] when you enter the ipv6 ospf authentication
ipsec
or ipv6 ospf encryption ipsec command.
• To congure an IPsec security policy for authenticating or encrypting OSPFv3 packets on a physical, port-channel, or VLAN interface
or OSPFv3 area, perform any of the following tasks:
• Conguring IPsec Authentication on an Interface
• Conguring IPsec Encryption on an Interface
• Conguring IPsec Authentication for an OSPFv3 Area
• Conguring IPsec Encryption for an OSPFv3 Area
• Displaying OSPFv3 IPsec Security Policies
Conguring IPsec Authentication on an Interface
To congure, remove, or display IPsec authentication on an interface, use the following commands.
Prerequisite: Before you enable IPsec authentication on an OSPFv3 interface, rst enable IPv6 unicast routing globally, congure an IPv6
address and enable OSPFv3 on the interface, and assign it to an area (refer to Conguration Task List for OSPFv3 (OSPF for IPv6)).
The SPI value must be unique to one IPsec security policy (authentication or encryption) on the router. Congure the same authentication
policy (the same SPI and key) on each OSPFv3 interface in a link.
• Enable IPsec authentication for OSPFv3 packets on an IPv6-based interface.
INTERFACE mode
ipv6 ospf authentication {null | ipsec spi number {MD5 | SHA1} [key-encryption-type] key}
• null: causes an authentication policy congured for the area to not be inherited on the interface.
• ipsec spi number: the security policy index (SPI) value. The range is from 256 to 4294967295.
• MD5 | SHA1: species the authentication type: Message Digest 5 (MD5) or Secure Hash Algorithm 1 (SHA-1).
• key-encryption-type: (optional) species if the key is encrypted. The valid values are 0 (key is not encrypted) or 7 (key is
encrypted).
• key: species the text string used in authentication. All neighboring OSPFv3 routers must share key to exchange information. For
MD5 authentication, the key must be 32 hex digits (non-encrypted) or 64 hex digits (encrypted). For SHA-1 authentication, the key
must be 40 hex digits (non-encrypted) or 80 hex digits (encrypted).
• Remove an IPsec authentication policy from an interface.
no ipv6 ospf authentication ipsec spi number
• Remove null authentication on an interface to allow the interface to inherit the authentication policy congured for the OSPFv3 area.
no ipv6 ospf authentication null
• Display the conguration of IPsec authentication policies on the router.
show crypto ipsec policy
• Display the security associations set up for OSPFv3 interfaces in authentication policies.
show crypto ipsec sa ipv6
Conguring IPsec Encryption on an Interface
To congure, remove, or display IPsec encryption on an interface, use the following commands.
Prerequisite: Before you enable IPsec encryption on an OSPFv3 interface, rst enable IPv6 unicast routing globally, congure an IPv6
address and enable OSPFv3 on the interface, and assign it to an area (refer to Conguration Task List for OSPFv3 (OSPF for IPv6)).
Open Shortest Path First (OSPFv2 and OSPFv3)
651