Dell Force10 Z9000 FTOS Configuration Guide for Z9000 System - Page 662

www.dell.com | support.dell.com To configure IPsec authentication on an interface, enter the following command: Command Syntax ipv6 ospf authentication {null | ipsec spi number {MD5 | SHA1} [key-encryption-type] key} Command Mode Usage INTERFACE Enable IPsec authentication for OSPFv3 packets on an IPv6-based interface, where: null causes an authentication policy configured for the area to not be inherited on the interface. ipsec spi number is the Security Policy index (SPI) value. Range: 256 to 4294967295. MD5 | SHA1 specifies the authentication type: Message Digest 5 (MD5) or Secure Hash Algorithm 1 (SHA-1). key-encryption-type (optional) specifies if the key is encrypted. Valid values: 0 (key is not encrypted) or 7 (key is encrypted). key specifies the text string used in authentication. All neighboring OSPFv3 routers must share the same key to exchange information. For MD5 authentication, the key must be 32 hex digits (non-encrypted) or 64 hex digits (encrypted). For SHA-1 authentication, the key must be 40 hex digits (non-encrypted) or 80 hex digits (encrypted). An SPI value must be unique to one IPsec security policy (authentication or encryption) on the router. You must configure the same authentication policy (same SPI and key) on each OSPFv3 interface in a link. To remove an IPsec authentication policy from an interface, enter the no ipv6 ospf authentication ipsec spi number command. To remove null authentication on an interface to allow the interface to inherit the authentication policy configured for the OSPFv3 area, enter the no ipv6 ospf authentication null command. To display the configuration of IPsec authentication policies on the router, enter the show crypto ipsec policy command. To display the security associations set up for OSPFv3 interfaces in authentication policies, enter the show crypto ipsec sa ipv6 command. Configuring IPsec Encryption on an Interface Prerequisite: Before you enable IPsec encryption on an OSPFv3 interface, you must first enable IPv6 unicast routing globally, configure an IPv6 address and enable OSPFv3 on the interface, and assign it to an area (see Configuration Task List for OSPFv3 (OSPF for IPv6)). 662 | Open Shortest Path First (OSPFv2 and OSPFv3)