Hi.
On 06.09.2013 22:47, Thomas Johnson wrote:
I'm looking around, and not seeing anything online regarding how to
protect BIRD OSPFv3 with IPSec (at least on FreeBSD). I am able to
configure IPSec transport mode to protect unicast traffic between
routers; but multicast traffic is still transmitted without AH.
A number of sources seem to be setting up a GRE/IPSec tunnel between
routers, and running OSPF on that interface, facilitating multicast
traffic. That seems counter to performance though, wouldn't data
traffic then [needlessly] use the tunnel? Another thought I had was to
configure all OSPF interfaces as NBMA, making OSPF traffic easier to
protect.
If you are running ospf inside your own network then there is probably
no need to encrypt it with ipsec. If you are running ospf in a WAN
environment, you probaby run it inside gre/gif tunnels (which you use
for some sort of VPNs), then their traffic should be encrypted too.
I definitely cannot imagine an environment with IPSEC encrypting ospf,
but without any sort of VPN and any other VPNed traffic. Cisco/Juniper
equipment also can run an ipsec tunnel in a form of an interface capable
running dynamic routing protocols (for same purpose as the gre/gif in
FreeBSD). Linux is capable of this too, as I heard. FreeBSD cannot do
this; so far noone seems to be interested in implementing this.
Eugene.
