Applying ipsec policies for ospfv3, Configuration prerequisites, Configuration guidelines – H3C Technologies H3C SecPath F1000-E User Manual
Page 789: Configuration procedure
764
Applying IPsec policies for OSPFv3
To protect routing information and defend attacks, OSPFv3 can authenticate protocol packets by using
an IPsec policy.
Outbound OSPFv3 packets carry the Security Parameter Index (SPI) defined in the relevant IPsec policy.
A device uses the SPI carried in a received packet to match against the configured IPsec policy. If they
match, the device accepts the packet; otherwise, it discards the packet and will not establish a neighbor
relationship with the sending device.
You can configure an IPsec policy for an area, an interface or a virtual link.
•
To implement area-based IPsec protection, you need to configure the same IPsec policy on the
routers in the target area.
•
To implement interface-based IPsec protection, you need to configure the same IPsec policy on the
interfaces between two neighboring routers.
•
To implement virtual link-based IPsec protection, you need to configure the same IPsec policy on the
two routers connected over the virtual link.
If an interface and its area each have an IPsec policy configured, the interface uses its own IPsec policy.
If a virtual link and area 0 each have an IPsec policy configured, the virtual link uses its own IPsec policy.
Configuration prerequisites
Before you apply an IPsec policy for OSPFv3, complete following tasks.
•
Create an IPsec proposal.
•
Create an IPsec policy.
For more information about IPsec policy configuration, see VPN Configuration Guide.
Configuration guidelines
An IPsec policy used for OSPFv3 can only be in manual mode. For more information, see VPN
Configuration Guide.
Configuration procedure
To apply an IPsec policy in an area:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter OSPFv3 view.
ospfv3 [ process-id ]
N/A
3.
Enter OSPF area view.
area area-id
N/A
4.
Apply an IPsec policy in the
area.
enable ipsec-policy policy-name
Not configured by default.
To apply an IPsec policy on an interface:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter interface view.
interface interface-type interface-number
N/A
- H3C SecPath F5000-A5 Firewall H3C SecPath F1000-A-EI H3C SecPath F1000-E-SI H3C SecPath F1000-S-AI H3C SecPath F5000-S Firewall H3C SecPath F5000-C Firewall H3C SecPath F100-C-SI H3C SecPath F1000-C-SI H3C SecPath F100-A-SI H3C SecBlade FW Cards H3C SecBlade FW Enhanced Cards H3C SecPath U200-A U200-M U200-S H3C SecPath U200-CA U200-CM U200-CS H3C SecBlade LB Cards H3C SecPath L1000-A Load Balancer