IPV6: OSPFv3 authentication:

IPV6: OSPFv3 authentication:

 ·         Let me take 2 routers to configure OSPFv3 authentication.

 R1---fa0/0--------------------fa0/0---R2

 R1(config)#int fa0/0

R1(config-if)#ipv6 address 2001:12::1/64

R1(config-if)#

R2(config)#int fa0/0

R2(config-if)#ipv6 address 2001:12::2/64

R2(config-if)#

 

Configuring OSPF:

 

R1(config)#ipv6 router ospf 1

R1(config-rtr)#int fa0/0

R1(config-if)#ipv6 ospf 1 area 0

R1(config-if)#int loop0

R1(config-if)#ipv6 ospf 1 area 0

R1(config-if)#

 

R2(config)#ipv6 router ospf 1

R2(config-rtr)#int fa0/0

R2(config-if)#ipv6 ospf 1 area 0

R2(config-if)#int loop0

R2(config-if)#ipv6 ospf 1 area 0

R2(config-if)#

 

·         Let me configure OSPFv3 authentication:

 

R1(config)#ipv6 router ospf 1

R1(config-rtr)# area 0 authentication ipsec spi 500 md5 1234567890ABCDEF1234567890ABCDEF

 

R2(config)#ipv6 router ospf 1

R2(config-rtr)#area 0 authentication ipsec spi 500 md5 1234567890ABCDEF1234567890ABCDEF

R2(config-rtr)#

 

Now, let me see if authentication is working:

 

R1#show ipv6 ospf int fa0/0

FastEthernet0/0 is up, line protocol is up

  Link Local Address FE80::C000:FFF:FE58:0, Interface ID 4

  Area 0, Process ID 1, Instance ID 0, Router ID 1.1.1.1

  Network Type BROADCAST, Cost: 10

  MD5 Authentication (Area) SPI 500, secure socket state UP (errors: 0)

  Transmit Delay is 1 sec, State BDR, Priority 1

  Designated Router (ID) 2.2.2.2, local address FE80::C001:FFF:FE58:0

  Backup Designated router (ID) 1.1.1.1, local address FE80::C000:FFF:FE58:0

  Flush timer for old DR LSA due in 00:00:11

  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

    Hello due in 00:00:01

  Index 1/1/1, flood queue length 0

  Next 0x0(0)/0x0(0)/0x0(0)

  Last flood scan length is 1, maximum is 2

  Last flood scan time is 0 msec, maximum is 0 msec

  Neighbor Count is 1, Adjacent neighbor count is 1

    Adjacent with neighbor 2.2.2.2  (Designated Router)

  Suppress hello for 0 neighbor(s)

R1#show ipv6 ospf nei

 

Neighbor ID     Pri   State           Dead Time   Interface ID    Interface

2.2.2.2           1   FULL/DR         00:00:34    4               FastEthernet0/0

R1#

 

R2#show ipv6 ospf int fa0/0

FastEthernet0/0 is up, line protocol is up

  Link Local Address FE80::C001:FFF:FE58:0, Interface ID 4

  Area 0, Process ID 1, Instance ID 0, Router ID 2.2.2.2

  Network Type BROADCAST, Cost: 10

  MD5 Authentication (Area) SPI 500, secure socket state UP (errors: 0)

  Transmit Delay is 1 sec, State DR, Priority 1

  Designated Router (ID) 2.2.2.2, local address FE80::C001:FFF:FE58:0

  Backup Designated router (ID) 1.1.1.1, local address FE80::C000:FFF:FE58:0

  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

    Hello due in 00:00:06

  Index 1/1/1, flood queue length 0

  Next 0x0(0)/0x0(0)/0x0(0)

  Last flood scan length is 0, maximum is 4

  Last flood scan time is 0 msec, maximum is 0 msec

  Neighbor Count is 1, Adjacent neighbor count is 1

    Adjacent with neighbor 1.1.1.1  (Backup Designated Router)

  Suppress hello for 0 neighbor(s)

R2#

R2#show ipv6 ospf nei

 

Neighbor ID     Pri   State           Dead Time   Interface ID    Interface

1.1.1.1           1   FULL/BDR        00:00:32    4               FastEthernet0/0

R2#

 

Observations:

·         Authentication is working and the OSPFv3 neighbor relationship is up.

 

·         Now, let me see OSPFv3 routing table:

 

R1#show ipv6 route ospf

IPv6 Routing Table - 7 entries

Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP

       U - Per-user Static route

       I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary

       O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2

       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2

O   2002:202:202:1::2/128 [110/10]

     via FE80::C001:FFF:FE58:0, FastEthernet0/0

R1#

R1#ping 2002:202:202:1::2

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:202:202:1::2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/16/56 ms

R1#

 

R2#show ipv6 route ospf

IPv6 Routing Table - 7 entries

Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP

       U - Per-user Static route

       I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary

       O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2

       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2

O   2002:101:101:1::1/128 [110/10]

     via FE80::C000:FFF:FE58:0, FastEthernet0/0

R2#

R2#ping 2002:101:101:1::1

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:101:101:1::1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/17/56 ms

R2#

 

Observation:

·         R1 and R2 are exchanging their loopback interfaces via OSPFv3 and ping is fine between them.

IPv6: Configuring Automatic 6to4 tunnels

IPv6: Configuring Automatic 6to4 tunnels

 

·         Automatic 6to4 tunnels are multipoint by default.

·         This is used for IPv6/IPv4

·         Only source is mentioned

·         Since the tunnel is automatic tunnel, we need not mention the tunnel destination.

·         Tunnel mode is set to ipv6ip 6to4

·         Tunnel interface is assigned with ipv6 address, which uses special addressing, 2002 followed by the translated IPv4 address of the interface on the router.

·         Let me take a small 3 roter topology for creating 6to4 tunnels:

Let me see the configs before creating tunnels:

 

R1(config-router)#do show run int fa0/0

Building configuration...

 

Current configuration : 94 bytes

!

interface FastEthernet0/0

 ip address 10.1.12.1 255.255.255.0

 duplex auto

 speed auto

end

 

R1(config-router)#do show run int loop0

Building configuration...

 

Current configuration : 63 bytes

!

interface Loopback0

 ip address 1.1.1.1 255.255.255.255

end

 

R1(config-router)#do show ip route ospf

     2.0.0.0/32 is subnetted, 1 subnets

O       2.2.2.2 [110/11] via 10.1.12.2, 00:14:32, FastEthernet0/0

     3.0.0.0/32 is subnetted, 1 subnets

O       3.3.3.3 [110/21] via 10.1.12.2, 00:14:32, FastEthernet0/0

     10.0.0.0/24 is subnetted, 2 subnets

O       10.1.23.0 [110/20] via 10.1.12.2, 00:14:32, FastEthernet0/0

R1(config-router)#do ping 3.3.3.3

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 8/28/72 ms

R1(config-router)#do ping 2.2.2.2

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/24/56 ms

R1(config-router)#

 

 

R2(config-router)#do show run int fa0/0

Building configuration...

 

Current configuration : 94 bytes

!

interface FastEthernet0/0

 ip address 10.1.12.2 255.255.255.0

 duplex auto

 speed auto

end

 

R2(config-router)#do show run int fa0/1

Building configuration...

 

Current configuration : 94 bytes

!

interface FastEthernet0/1

 ip address 10.1.23.2 255.255.255.0

 duplex auto

 speed auto

end

 

R2(config-router)#do show run int loop0

Building configuration...

 

Current configuration : 63 bytes

!

interface Loopback0

 ip address 2.2.2.2 255.255.255.255

end

 

R2(config-router)#do show ip route ospf

     1.0.0.0/32 is subnetted, 1 subnets

O       1.1.1.1 [110/11] via 10.1.12.1, 00:15:17, FastEthernet0/0

     3.0.0.0/32 is subnetted, 1 subnets

O       3.3.3.3 [110/11] via 10.1.23.3, 00:15:17, FastEthernet0/1

R2(config-router)#do ping 1.1.1.1

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/20/44 ms

R2(config-router)#do ping 3.3.3.3

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/25/68 ms

R2(config-router)#

 

 

R3(config-router)#do show run int fa0/1

Building configuration...

 

Current configuration : 94 bytes

!

interface FastEthernet0/1

 ip address 10.1.23.3 255.255.255.0

 duplex auto

 speed auto

end

 

R3(config-router)#do show run int loop0

Building configuration...

 

Current configuration : 63 bytes

!

interface Loopback0

 ip address 3.3.3.3 255.255.255.255

end

 

R3(config-router)#do show ip route ospf

     1.0.0.0/32 is subnetted, 1 subnets

O       1.1.1.1 [110/21] via 10.1.23.2, 00:22:13, FastEthernet0/1

     2.0.0.0/32 is subnetted, 1 subnets

O       2.2.2.2 [110/11] via 10.1.23.2, 00:22:13, FastEthernet0/1

     10.0.0.0/24 is subnetted, 2 subnets

O       10.1.12.0 [110/20] via 10.1.23.2, 00:22:13, FastEthernet0/1

R3(config-router)#

R3(config-router)#do ping 2.2.2.2

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/16/36 ms

R3(config-router)#do ping 1.1.1.1

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 8/31/64 ms

R3(config-router)#

 

·         Let me add ipv6 addresses to loop0 interfaces on all 3 routers:

 

R1(config)#ipv6 unicast-routing

R1(config)#int loop0

R1(config-if)#ipv6 address 2002:0101:0101:1::1/64

R1(config-if)#

 

Observation:

·         ipv6 address is determined as follows, 2002 followed by HEX of R1’s ipv4 loopback0 address, 1.1.1.1 in hex format is 0101:0101

 

R2(config-router)#ipv6 unicast-routing

R2(config)#int loop0

R2(config-if)#ipv6 address 2002:0202:0202:1::2/64

R2(config-if)#

 

Observation:

·         ipv6 address is determined as follows, 2002 followed by HEX of R2’s ipv4 loopback0 address, 2.2.2.2 in hex format is 0202:0202

 

R3(config-router)#ipv6 unicast-routing

R3(config)#int loop0

R3(config-if)#ipv6 address 2002:0303:0303:1::3/64

R3(config-if)#

 

Observation:

·         ipv6 address is determined as follows, 2002 followed by HEX of R3’s ipv4 loopback0 address, 3.3.3.3 in hex format 0303:0303

 

·         Now, let me create 6to4 tunnels to reach these newly added ipv6 interfaces:

 

R1(config)#int tun 1

R1(config-if)#ipv6 address 2002:0101:0101::1/64

R1(config-if)#tunnel source 1.1.1.1

R1(config-if)#tunnel mode ipv6ip 6to4

R1(config-if)#

*Mar  1 00:39:43.359: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up

R1(config-if)#

 

Observation:

·         ipv6 address is determined as follows, 2002 followed by HEX of R1’s ipv4 loopback0 address, 1.1.1.1 in hex format is 0101:0101

 

R2(config-if)#int tun1

R2(config-if)#ipv6 address 2002:0202:0202::2/64

R2(config-if)#tunnel source 2.2.2.2

R2(config-if)#tunnel mode ipv6ip 6to4

R2(config-if)#

*Mar  1 00:35:18.535: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up

R2(config-if)#

 

Observation:

·         ipv6 address is determined as follows, 2002 followed by HEX of R2’s ipv4 loopback0 address, 2.2.2.2 in hex format is 0202:0202

 

R3(config)#int tun1

R3(config-if)#ipv6 address 2002:0303:0303::3/64

R3(config-if)#tunnel source 3.3.3.3

R3(config-if)#tunnel mode ipv6ip 6to4

R3(config-if)#

*Mar  1 00:36:05.791: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up

R3(config-if)#

 

Observation:

·         ipv6 address is determined as follows, 2002 followed by HEX of R3’s ipv4 loopback0 address, 3.3.3.3 in hex format 0303:0303

 

·         Now, let me create default route pointing towards tunnel interface:

 

R1(config)#ipv6 route 2002::/16 tun1

R1(config)#

 

R2(config)#ipv6 route 2002::/16 tun1

R2(config)#

 

R3(config)#ipv6 route 2002::/16 tun1

R3(config)#

 

·         Now, let me check the connectivity:

 

R1(config)#do ping  2002:0202:0202::2

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:202:202::2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/25/44 ms

R1(config)#do ping 2002:0202:0202:1::2

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:202:202:1::2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 0/18/52 ms

R1(config)#do ping 2002:0303:0303::3

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:303:303::3, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 8/33/76 ms

R1(config)#do ping 2002:0303:0303:1::3

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:303:303:1::3, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 8/30/48 ms

R1(config)#

 

Observation:

·         R1 is able to ping R2’s tunnel interface and loopback0 interface

·         R1 is able to ping R3’s tunnel interface and loopback0 interface

 

 

R2(config)#do ping 2002:0101:0101::1

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:101:101::1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 0/20/52 ms

R2(config)#do ping 2002:0101:0101:1::1

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:101:101:1::1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/23/76 ms

R2(config)#do ping 2002:0303:0303::3

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:303:303::3, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/27/72 ms

R2(config)#do ping 2002:0303:0303:1::3

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:303:303:1::3, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/17/52 ms

R2(config)#

 

Observation:

·         R2 is able to ping R1’s tunnel interface and loopback0 interface

·         R2 is able to ping R3’s tunnel interface and loopback0 interface

 

R3(config)#do ping 2002:0101:0101::1

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:101:101::1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 8/32/84 ms

R3(config)#do ping 2002:0101:0101:1::1

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:101:101:1::1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 8/26/64 ms

R3(config)#do ping  2002:0202:0202::2

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:202:202::2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/24/76 ms

R3(config)#do ping 2002:0202:0202:1::2

 

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:202:202:1::2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/26/64 ms

R3(config)#

 

Observation:

·         R3 is able to ping R1’s tunnel interface and loopback0 interface

·         R3 is able to ping R2’s tunnel interface and loopback0 interface