R0106-HP MSR Router Series Security Configuration Guide(V7)

279
SA duration (kilobytes/sec): 3000/28800
SA remaining duration (kilobytes/sec): 2300/797
Max received sequence-number: 1
Anti-replay check enable: N
Anti-replay window size:
UDP encapsulation used for NAT traversal: N
Status: active
[Outbound ESP SAs]
SPI: 3840956402 (0xe4f057f2)
Transform set: ESP-ENCRYPT-AES-CBC-128 ESP-AUTH-SHA1
SA duration (kilobytes/sec): 3000/28800
SA remaining duration (kilobytes/sec): 2312/797
Max sent sequence-number: 1
UDP encapsulation used for NAT traversal: N
Status: active
Configuring IPsec for RIPng
Network requirements
As shown in Figure 83, Router A, Router B, and Router C learn IPv6 routes through RIPng.
Establish an IPsec tunnel between the routers to protect the RIPng packets transmitted in between. Specify
the security protocol as ESP, the encryption algorithm as 128-bit AES, and the authentication algorithm as
HMAC-SHA1 for the IPsec tunnel.
Figure 83 Network diagram
Requirements analysis
1. Configure basic RIPng.
For more information about RIPng configurations, see Layer 3—IP Routing Configuration Guide.
2. Configure an IPsec profile.
{ The IPsec profiles on all the routers must have IPsec transform sets that use the same security
protocol, authentication and encryption algorithms, and encapsulation mode.
{ The SPI and key configured for the inbound SA and those for the outbound SA must be the same
on each router.
{ The SPI and key configured for the SAs on all the routers must be the same.
3. Apply the IPsec profile to a RIPng process or to an interface.
Configuration procedure
1. Configure Router A:
# Configure IPv6 addresses for interfaces. (Details not shown.)
# Configure basic RIPng.