Brocade Communications Systems ICX 7250 series, Configuration Manual

Page: 267 / 483

Configuring IPsec on OSPFv3 virtual links
IP Security (IPsec) can be configured for virtual links.
An OSPFv3 virtual link must be configured.
Currently certain keyword parameters must be entered though only one keyword choice is possible for that parameter. For example, the
only authentication algorithm is HMAC-SHA1-96, but you must nevertheless enter the
sha1 keyword for this algorithm. Also, although
ESP is currently the only authentication protocol, you must enter the esp keyword.
The virtual link IPsec security associations (SAs) and policies are added to all interfaces of the transit area for the outbound direction. For
the inbound direction, IPsec SAs and policies for virtual links are added to the global database.
1. Enter the configure terminal command to access global configuration mode.
device# configure terminal
2. Enter the ip router-id command to specify the router ID.
device(config)# ip router-id 10.1.1.1
3. Enter the ipv6 router ospf command to enter OSPFv3 configuration mode and enable OSPFv3 on the device.
device(config)# ipv6 router ospf
4. Enter area virtual-link authentication ipsec spi value esp sha1 no-encrypt key , specifying an area address and the ID of the
OSPFv3 device at the remote end of the virtual link..
device(config-ospf6-router)# area 1 virtual-link 10.1.1.1 authentication ipsec spi 512 esp sha1 no-
encrypt 1134567890223456789012345678901234567890
IPsec is configured on the specified virtual link in OSPF area 1.The device ID associated with the virtual link neighbor is
10.1.1.1, the SPI value is 512, and the Encapsulating Security Payload (ESP) protocol is selected. Secure Hash Algorithm 1
(SHA-1) authentication is enabled. The 40-character key is not encrypted in
show command displays.
The following example configures IPsec on an OSPFv3 area.
device# configure terminal
device(config)# ip router-id 10.1.1.1
device(config)# ipv6 router ospf
device(config-ospf6-router)# area 1 virtual-link 10.1.1.1 authentication ipsec spi 512 esp sha1 no-encrypt
1134567890223456789012345678901234567890
Specifying the key rollover timer
The key rollover timer can be configured so that rekeying takes place on all the nodes at the same time and the security parameters are
consistent across all the nodes.
1. Enter the configure terminal command to access global configuration mode.
device# configure terminal
2. Enter the ip router-id command to specify the router ID.
device(config)# ip router-id 10.11.12.13
3. Enter the ipv6 router ospf command to enter OSPFv3 router configuration mode and enable OSPFv3 on the device.
device(config)# ipv6 router ospf
Configuring OSPFv3
Brocade FastIron Layer 3 Routing Configuration Guide
53-1003903-04 267