Example: Configuring IPsec for RIPng
Network configuration
As shown in Figure 119, Switch A, Switch B, and Switch C learn IPv6 routes through RIPng.
Establish an IPsec tunnel between the switches to protect the RIPng packets transmitted in between. Specify the security protocol as ESP, the encryption algorithm as 128-bit AES, and the authentication algorithm as HMAC-SHA1 for the IPsec tunnel.
Figure 119: Network diagram
Requirements analysis
To meet the network configuration requirements, perform the following tasks:
Configure basic RIPng.
For more information about RIPng configurations, see Layer 3—IP Routing Configuration Guide.
Configure an IPsec profile.
The IPsec profiles on all the switches must have IPsec transform sets that use the same security protocol, authentication and encryption algorithms, and encapsulation mode.
The SPI and key configured for the inbound SA and those for the outbound SA must be the same on each switch.
The SPI and key configured for the SAs on all the switches must be the same.
Apply the IPsec profile to a RIPng process or to an interface.
Procedure
Configure Switch A:
# Configure IPv6 addresses for interfaces. (Details not shown.)
# Configure basic RIPng.
<SwitchA> system-view [SwitchA] ripng 1 [SwitchA-ripng-1] quit [SwitchA] interface vlan-interface 100 [SwitchA-Vlan-interface100] ripng 1 enable [SwitchA-Vlan-interface100] quit
# Create and configure the IPsec transform set named tran1.
[SwitchA] ipsec transform-set tran1 [SwitchA-ipsec-transform-set-tran1] encapsulation-mode transport [SwitchA-ipsec-transform-set-tran1] protocol esp [SwitchA-ipsec-transform-set-tran1] esp encryption-algorithm aes-cbc-128 [SwitchA-ipsec-transform-set-tran1] esp authentication-algorithm sha1 [SwitchA-ipsec-transform-set-tran1] quit
# Create and configure the IPsec profile named profile001.
[SwitchA] ipsec profile profile001 manual [SwitchA-ipsec-profile-manual-profile001] transform-set tran1 [SwitchA-ipsec-profile-manual-profile001] sa spi outbound esp 123456 [SwitchA-ipsec-profile-manual-profile001] sa spi inbound esp 123456 [SwitchA-ipsec-profile-manual-profile001] sa string-key outbound esp simple abcdefg [SwitchA-ipsec-profile-manual-profile001] sa string-key inbound esp simple abcdefg [SwitchA-ipsec-profile-manual-profile001] quit
# Apply the IPsec profile to RIPng process 1.
[SwitchA] ripng 1 [SwitchA-ripng-1] enable ipsec-profile profile001 [SwitchA-ripng-1] quit
Configure Switch B:
# Configure IPv6 addresses for interfaces. (Details not shown.)
# Configure basic RIPng.
<SwitchB> system-view [SwitchB] ripng 1 [SwitchB-ripng-1] quit [SwitchB] interface vlan-interface 200 [SwitchB-Vlan-interface200] ripng 1 enable [SwitchB-Vlan-interface200] quit [SwitchB] interface vlan-interface 100 [SwitchB-Vlan-interface100] ripng 1 enable [SwitchB-Vlan-interface100] quit
# Create and configure the IPsec transform set named tran1.
[SwitchB] ipsec transform-set tran1 [SwitchB-ipsec-transform-set-tran1] encapsulation-mode transport [SwitchB-ipsec-transform-set-tran1] protocol esp [SwitchB-ipsec-transform-set-tran1] esp encryption-algorithm aes-cbc-128 [SwitchB-ipsec-transform-set-tran1] esp authentication-algorithm sha1 [SwitchB-ipsec-transform-set-tran1] quit
# Create and configure the IPsec profile named profile001.
[SwitchB] ipsec profile profile001 manual [SwitchB-ipsec-profile-manual-profile001] transform-set tran1 [SwitchB-ipsec-profile-manual-profile001] sa spi outbound esp 123456 [SwitchB-ipsec-profile-manual-profile001] sa spi inbound esp 123456 [SwitchB-ipsec-profile-manual-profile001] sa string-key outbound esp simple abcdefg [SwitchB-ipsec-profile-manual-profile001] sa string-key inbound esp simple abcdefg [SwitchB-ipsec-profile-manual-profile001] quit
# Apply the IPsec profile to RIPng process 1.
[SwitchB] ripng 1 [SwitchB-ripng-1] enable ipsec-profile profile001 [SwitchB-ripng-1] quit
Configure Switch C:
# Configure IPv6 addresses for interfaces. (Details not shown.)
# Configure basic RIPng.
<SwitchC> system-view [SwitchC] ripng 1 [SwitchC-ripng-1] quit [SwitchC] interface vlan-interface 200 [SwitchC-Vlan-interface200] ripng 1 enable [SwitchC-Vlan-interface200] quit
# Create and configure the IPsec transform set named tran1.
[SwitchC] ipsec transform-set tran1 [SwitchC-ipsec-transform-set-tran1] encapsulation-mode transport [SwitchC-ipsec-transform-set-tran1] protocol esp [SwitchC-ipsec-transform-set-tran1] esp encryption-algorithm aes-cbc-128 [SwitchC-ipsec-transform-set-tran1] esp authentication-algorithm sha1 [SwitchC-ipsec-transform-set-tran1] quit
# Create and configure the IPsec profile named profile001.
[SwitchC] ipsec profile profile001 manual [SwitchC-ipsec-profile-manual-profile001] transform-set tran1 [SwitchC-ipsec-profile-manual-profile001] sa spi outbound esp 123456 [SwitchC-ipsec-profile-manual-profile001] sa spi inbound esp 123456 [SwitchC-ipsec-profile-manual-profile001] sa string-key outbound esp simple abcdefg [SwitchC-ipsec-profile-manual-profile001] sa string-key inbound esp simple abcdefg [SwitchC-ipsec-profile-manual-profile001] quit
# Apply the IPsec profile to RIPng process 1.
[SwitchC] ripng 1 [SwitchC-ripng-1] enable ipsec-profile profile001 [SwitchC-ripng-1] quit
Verifying the configuration
After the configuration is completed, Switch A, Switch B, and Switch C learn IPv6 routing information through RIPng. IPsec SAs are set up successfully on the switches to protect RIPng packets. This example uses Switch A to verify the configuration.
# Display the RIPng configuration. The output shows that IPsec profile profile001 has been applied to RIPng process 1.
[SwitchA] display ripng 1
RIPng process : 1
Preference : 100
Checkzero : Enabled
Default Cost : 0
Maximum number of load balanced routes : 8
Update time : 30 secs Timeout time : 180 secs
Suppress time : 120 secs Garbage-Collect time : 120 secs
Update output delay: 20(ms) Output count: 3
Graceful-restart interval: 60 secs
Triggered Interval : 5 50 200
Number of periodic updates sent : 186
Number of triggered updates sent : 1
IPsec profile name: profile001
# Display the established IPsec SAs.
[SwitchA] display ipsec sa
-------------------------------
Global IPsec SA
-------------------------------
-----------------------------
IPsec profile: profile001
Mode: Manual
-----------------------------
Encapsulation mode: transport
[Inbound ESP SA]
SPI: 123456 (0x3039)
Connection ID: 90194313219
Transform set: ESP-ENCRYPT-AES-CBC-128 ESP-AUTH-SHA1
No duration limit for this SA
[Outbound ESP SA]
SPI: 123456 (0x3039)
Connection ID: 64424509441
Transform set: ESP-ENCRYPT-AES-CBC-128ESP-AUTH-SHA1
No duration limit for this SA