IPSec
Security Gateway Example
First, Zealand needs to be configured as a gateway. Do the following commands on Zealand:
Command 1 and 2 create the two prefixes on the different interfaces. Note your interfaces may not be 5 and 6. Use the Ethernet interfaces of the gateway. Command 3 and 4 make the interfaces advertising and forwarding. After executing the above commands, Zealand forwards traffic from one subnet to the other. Hornet can ping6 Alcuin.
Alcuin and Hornet now have prefix configured for their Ethernet interfaces and routes. Hornet has the following routes in the routing table (ipv6 rt):
Route 1 says, "for anything to this prefix it is on link." Route 2 says, "for anything to this prefix send to the link-local address of Zealand." Zealand then forwards the packet to the other side.
Now that Zealand is configured as a forwarding security gateway, add the following IPSec configurations:
To stop Zealand from acting as a gateway, first disable forwarding and advertising with the following commands on Zealand:
The machines still have routes and prefixes configured due to the previous router advertisements. It is not necessary to remove them since they will timeout. But, you can remove them as follows.
To remove the routes from Zealand do the following commands on Zealand:
To remove the prefixes from Zealand do the following commands on Zealand:
The prefixes and routes will still be configure on Alcuin and Hornet and are removed by doing the same commands shown for Zealand.