Okay,
now we're going to hop in the lab one more time so that we can
configure IPsec using the VTIs that I talked about earlier.
We're going to only be using IPsec in this solution,
and remember that reachability is key.
I've provided the configurations that we're using in this module so that
you can follow along and see them working yourself.
We're using IPv6 OSPF routing for our WAN links just like we did
earlier in the modules using OSPF for IPv4.
First, we'll configure the connections.
Then, we'll send traffic through it.
And then finally, we'll analyze the packets and show how it was working.
Let's get into it.
Before we get into the tunnel configurations here,
remember,
we need to make sure those base configurations are
loaded for the IPv6 routes to be shared.
Reachability via IPv6 is key to this lab scenario,
and it won't work unless we have all of the routes being advertised.
I'm issuing the show ipv6 route and the show ipv6 interface brief
command on both routers to confirm the reachability.
The 2000:1 and the 3000:1 addresses are the source and destination
addresses that we'll be using and will make the tunnel interfaces
the same CCCC:1 addresses as before.
This will help us keep straight what device and
interfaces we have communicating.
As you can see,
we have valid routes to the IPv6 interfaces on each of the routers,
so we should be good to go with this.
Pulling up the configuration,
this is fairly basic and very similar to what we've been using.
We have our ISAKMP and IPsec configurations with one difference
here being the address for the ISAKMP key.
We're allowing any again, but it needs to be in the form of the IPv6 addresses.
Moving into the tunnel configurations,
we have the same configurations here as well,
but it's all based on IPv6 now instead of IPv4 since
we're doing the IPv6-to-IPv6 tunnels.
Let me go ahead and turn on the capture before we
copy-paste them into the routers.
Okay, I have them all in here, and ISAKMP is turned on.
Looks like the tunnel interface is up too!
Doing a ping test of the tunnel interface on the other side, we're good to go!
Now, checking the IPsec SAs for IPv6 here,
we can see some differences than what we had previously in the IPv4 sections.
The peers and addresses are all different because they're in the IPv6 format.
We also have the SAs created in both directions since they're unidirectional,
and we're using both AH and ESP in this configuration,
which is different than before when we were using just one or the other.
Looking at the isakmp sa show command, we see that they are good and active.
Going in and stopping the capture,
I'll name this one IPv6 to IPv6 IPsec PCAP and pull it up
so that we can see what's going on.
Looking at the ISAKMP exchanges,
this is pretty much the exact same flow as what we've seen previously.
The exception is the addresses.
They're now IPv6 addresses.
The IKEv1 modes are still sending all of the information in
the exchanges that we saw before and made the SAs with the
information within the proposals.
After they're all set up and ready to go,
we see our ESP packets coming across and can't see
any of the data going in them. This stuff is really cool, isn't it?