IPSec Security Gateway Example

 

First, Zealand needs to be configured as a gateway. Do the following commands on Zealand:

  1. ipv6 rtu 3ffe:1a01:4:1::/64 6 life 7200 pub
  2. ipv6 rtu 3ffe:1a01:4:2::/64 5 life 7200 pub
  3. ipv6 ifc 6 forw adv
  4. ipv6 ifc 5 forw adv

Command 1 and 2 create the two prefixes on the different interfaces. Note your interfaces may not be 5 and 6. Use the Ethernet interfaces of the gateway. Command 3 and 4 make the interfaces advertising and forwarding. After executing the above commands, Zealand forwards traffic from one subnet to the other. Hornet can ping6 Alcuin.

Alcuin and Hornet now have prefix configured for their Ethernet interfaces and routes. Hornet has the following routes in the routing table (ipv6 rt):

  1. 3ffe:1a01:4:2::/64 -> 4 pref 1 (lifetime <less than 7200s>)
  2. 3ffe:1a01:4:1::/64 -> 4/fe80::2a0:c9ff:fe77:cb83 pref 16 (lifetime <less than 7200s>)

Route 1 says, "for anything to this prefix it is on link." Route 2 says, "for anything to this prefix send to the link-local address of Zealand." Zealand then forwards the packet to the other side.

Now that Zealand is configured as a forwarding security gateway, add the following IPSec configurations:

Alcuin SPD and SAD.
Hornet SPD and SAD.
Zealand SPD and SAD.
Keys: AlcZea.key, ZeaAlc.key, AlcHor.key, HorAlc.key

To stop Zealand from acting as a gateway, first disable forwarding and advertising with the following commands on Zealand:

  1. ipv6 ifc 6 -forw -adv
  2. ipv6 ifc 5 -forw -adv

The machines still have routes and prefixes configured due to the previous router advertisements. It is not necessary to remove them since they will timeout. But, you can remove them as follows.

To remove the routes from Zealand do the following commands on Zealand:

  1. ipv6 rtu 3ffe:1a01:4:1::/64 6 life 0
  2. ipv6 rtu 3ffe:1a01:4:2::/64 5 life 0

To remove the prefixes from Zealand do the following commands on Zealand:

  1. ipv6 adu 6/3ffe:1a01:4:1:2e0:b8ff:fe11:169d life 0
  2. ipv6 adu 5/3ffe:1a01:4:2:2a0:c9ff:fe77:cb83 life 0

The prefixes and routes will still be configure on Alcuin and Hornet and are removed by doing the same commands shown for Zealand.