F3726, F3211, F3174, R5135, R3816-HP Firewalls and UTM Devices Network Management Configuration Guide-6PW100
776
289B
Applying IPsec policies for OSPFv3
To protect routing information and defend attacks, OSPFv3 can authenticate protocol packets by using
an IPsec policy.
Outbound OSPFv3 packets carry the Security Parameter Index (SPI) defined in the relevant IPsec policy.
A device uses the SPI carried in a received packet to match against the configured IPsec policy. If they
match, the device accepts the packet. Otherwise, it discards the packet and will not establish a neighbor
relationship with the sending device.
You can configure an IPsec policy for an area, an interface, or a virtual link.
• To implement area-based IPsec protection, configure the same IPsec policy on the routers in the
target area.
• To implement interface-based IPsec protection, configure the same IPsec policy on the interfaces
between two neighboring routers.
• To implement virtual link-based IPsec protection, configure the same IPsec policy on the two routers
connected over the virtual link.
If an interface and its area each have an IPsec policy configured, the interface uses its own IPsec policy.
If a virtual link and area 0 each have an IPsec policy configured, the virtual link uses its own IPsec policy.
1735BConfiguration prerequisites
Before applying an IPsec policy for OSPFv3, complete the following tasks:
• Create an IPsec proposal.
• Create an IPsec policy.
For more information about IPsec policy configuration, see Security Configuration Guide.
1736BConfiguration procedure
An IPsec policy used for OSPFv3 can only be in manual mode. For more information, see VPN
Configuration Guide
To apply an IPsec policy in an area:
Ste
p
Command
Remarks
1168. Enter system view. system-view N/A
1169. Enter OSPFv3 view.
ospfv3 [ process-id ] N/A
1170. Enter OSPF area view.
area area-id N/A
1171. Apply an IPsec policy in the
area.
enable ipsec-policy policy-name Not configured by default.
To apply an IPsec policy on an interface:
Ste
p
Command
Remarks
1172. Enter system view. system-view N/A
1173. Enter interface view.
interface interface-type
interface-number
N/A
1174. Apply an IPsec policy on
the interface.
ospfv3 ipsec-policy policy-name
[ instance instance-id ]
Not configured by default.