Brocade Virtual ADX Switch and Router Guide (Supporting ADX v03.1.00) - Manual (Page 184)

170 Brocade Virtual ADX Switch and Router Guide
53-1003246-01
Enabling OSPFv3
7
IPsec for OSPFv3
This section describes the implementation of Internet Protocol Security (IPsec) for securing OSPFv3
traffic. For background information and configuration steps, refer to
“Configuring IPsec for OSPFv3”
on page 171.
IPsec is available for OSPFv3 traffic only and only for packets that are “for-us.” A for-us packet is
addressed to one of the IPv6 addresses on the Virtual ADX device or to an IPv6 multicast address
(ff02::5 for IPv6 (all SPF/link state routers, also known as All SPF Routers) and ff02::6 for IPv6 (all
Designated Routers, All DR Routers)). Packets that are just forwarded by the line card do not
receive IPsec scrutiny.
Virtual ADX devices support the following components of IPsec for IPv6-addressed packets:
• Authentication through Encapsulating Security Payload (ESP) in transport mode
• HMAC-SHA1-96 as the authentication algorithm
• Manual configuration of keys
• Configurable rollover timer
IPsec can be enabled on the following logical entities:
• Interface
• Area
• Virtual Links
With respect to traffic classes, this implementation of IPsec uses a single security association (SA)
between the source and destination to support all traffic classes and so does not differentiate
between the different classes of traffic that the DSCP bits define.
Instructions for configuring IPsec on these entities appear in “Configuring IPsec for OSPFv3” on
page 171.
IPsec on a virtual link is a global configuration. Interface and area IPsec configurations are more
granular.
Among the entities that can have IPsec protection, the interfaces and areas can overlap. The
interface IPsec configuration takes precedence over the area IPsec configuration when an area
and an interface within that area use IPsec. Therefore, if you configure IPsec for an interface and
an area configuration also exists that includes this interface, the interface’s IPsec configuration is
used by that interface. However, if you disable IPsec on an interface, IPsec is disabled on the
interface even if the interface has its own, specific authentication. Refer to
“Disabling IPsec on an
interface” on page 173.
For IPsec, the system generates two types of databases. The security association database (SAD)
contains a security association for each interface or one global database for a virtual link. Even if
IPsec is configured for an area, each interface that uses the area’s IPsec still has its own security
association in the SAD. Each SA in the SAD is a generated entry that is based on your specifications
of an authentication protocol (ESP in the current release), destination address, and a security
policy index (SPI). The SPI number is user-specified according to the network plan. Consideration
for the SPI values to specify must apply to the whole network.
The system-generated security policy databases (SPDs) contain the security policies against which
the system checks the for-us packets. For each for-us packet that has an ESP header, the
applicable security policy in the security policy database (SPD) is checked to see if this packet
complies with the policy. The IPsec task drops the non-compliant packets. Compliant packets
continue on to the OSPFv3 task.