Detections
Analytics

3.1.1.3 OSPFv3 Area Authentication and Encryption with IPsec

Information

OSPFv3 neighbors may use interface-level authentication. An alternative method might be used toprovide encryption, or authentication, or both for an entire OSPFv3 area using the IPsec protocol, whichautomatically applies the configured methods to all member interfaces.There are two IPsec encapsulation types supported on AOS-CX to secure OSPFv3 areas:

 - IPv6 authentication header (AH), which adds an IPv6 authentication header to OSPFv3 packets.
 - Encrypted Security Payload (ESP), which provides both authentication and encryption for OSPFv3 packets.

The implementation of OSPFv3 (Open Shortest Path First version 3) Area Authentication and Encryption using IPsec is essential for enhancing the security of routing protocols in modern networks. OSPFv3 is widely used in IPv6 environments, and its reliance on trust between routers makes it vulnerable to attacks such as unauthorized route injection, replay attacks, or data interception. By integrating IPsec for authentication and encryption, network administrators can ensure that OSPFv3 exchanges are securely transmitted, protecting the integrity and confidentiality of routing information. This added layer of security prevents malicious actors from compromising the routing infrastructure, thereby maintaining the reliability and performance of the network.

Solution

IPsec authentication and encryption are configured from the OSPFv3 router process context. Bothauthentication and encryption require a specified Security Policy Index (SPI), which is an integer valuebetween 256 and 4,294,967,295; this value is used on each OSPFv3 router in the secured area to matcha configured IPsec authentication and/or encryption policy. Each OSPFv3 IPsec policy on a switch mustuse a different SPI value, and the SPI value (as well as authentication, or encryption keys, or both) must match across all OSPFv3 neighbor interfaces using that policy within the secured area.To configure AH authentication for OSPFv3 area 1, specify the SPI, authentication method (md5 or sha1),key type (plaintext, hex-string, or ciphertext) and the key string itself. If a key type and string are not specified, the user is prompted to enter a plaintext key interactively:

switch(config)router ospfv3 <process-ID>
switch(config-ospfv3-<process>)# area 1 authentication ipsec spi 1024 sha1
Enter the IPsec authentication key: *******
Re-Enter the IPsec authentication key: ********

To configure ESP encryption for area 1, specify the SPI, authentication method, authentication key typeand string, encryption type (3des, aes, des, or null), key type, and encryption key string. If the encryption type and key string are not specified, you are prompted to enter a plaintext key interactively. If the authentication key type and string are not specified, you are prompted to enter both a plaintext authentication key as well as the desired encryption type and plaintext key.

switch(config)router ospfv3 <process-ID>
switch(config-ospfv3-<process>)# area 1 encryption ipsec spi 1024 sha1
Enter the IPsec authentication key: *******
Re-Enter the IPsec authentication key: *******
Enter the IPsec encryption type (3des/aes/des/null)? aes
Enter the IPsec encryption key: ****************
Re-Enter the IPsec encryption key: ****************

Depending on the selected encryption type, a plaintext or hexadecimal encryption key must be set to aspecific length as mentioned below:

 - 3DES:
 - Hexadecimal: 48 digits
 - Plaintext: 24 characters

 - DES:
 - Hexadecimal: 16 digits
 - Plaintext: 8 characters

 - AES:
 - Hexadecimal: 32, 48, or 64 digits
 - Plaintext: 16, 24, or 32 characters

For AES encryption, the specified key lengths correspond to AES128, AES192, or AES256, respectively;the type of the key that will be used is automatically determined by the length of the entered encryptionkey. AOS-CX recommends using AES over DES or 3DES as it is stronger.

Impact:

The use of IPsec for OSPFv3 authentication and encryption significantly strengthens the security posture of networks by safeguarding routing updates in transit. This ensures that only authorized routers can participate in OSPFv3 exchanges and that all routing information remains confidential and tamper-proof. As a result, the risk of routing table manipulation, traffic redirection, and denial of service attacks is greatly reduced. Furthermore, the adoption of IPsec aligns with organizational compliance requirements and best practices for securing IPv6 networks, mitigating vulnerabilities associated with unprotected routing protocols. Ultimately, this approach enhances network stability, reduces downtime, and fosters trust in critical communication infrastructure.

See Also

https://workbench.cisecurity.org/benchmarks/24202

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: ArubaOS

Control ID: c906dd718b463f7f6d5c1995a4aaa626f03102c042674b3b59b50cff71f3fe3b