LAB 14 / 20

OSPFv3 Dual-Stack — IPv6 Backbone Routing

OSPFv3IPv6Dual-StackIPsec Auth

Active Nodes

14 OSPFV3 IPV6 OSPFv3 IPv6 — Active: CORE-1,CORE-2,CORE-3,CORE-4,EDGE-1,EDGE-4 See master topology for full 20-router diagram Active Nodes: CORE-1,CORE-2,CORE-3,CORE-4,EDGE-1,EDGE-4 OSPFv3 IPv6 CORE-1,CORE-2,CORE-3,CORE-4,EDGE-1,EDGE-4 Refer to lab.html for complete step-by-step configuration and verification commands for each active router Active Zone Inactive (dimmed) Ioannis (John) Alexander Konstas

Active routers: CORE-1, CORE-2, CORE-3, CORE-4, EDGE-1, EDGE-4

Key Concepts

OSPFv3 vs OSPFv2 Differences

OSPFv3 runs directly over IPv6, using link-local addresses for neighbor discovery and adjacency formation. Unlike OSPFv2 where you specify networks in the routing process, OSPFv3 is configured per-interface with ipv6 ospf PROCESS area AREA. OSPFv3 introduces two new LSA types: Type-8 (Link LSA — link-local address and prefix list per link) and Type-9 (Intra-Area-Prefix LSA — carries IPv6 prefixes that were carried in Type-1/2 in OSPFv2). Router and Network LSAs in OSPFv3 carry no address information — only topology.

OSPFv3 Authentication with IPsec

OSPFv3 uses IPsec AH (Authentication Header) for authentication instead of the MD5 field built into OSPFv2 headers. Configuration: area 0 authentication ipsec spi SPI sha1 KEY under the IPv6 OSPF process. All routers in the area must use the same SPI (Security Parameter Index) and key. IPsec AH verifies the entire OSPFv3 packet authenticity without encryption. Using ESP instead would add encryption, but is rarely needed for routing protocol authentication.

Dual-Stack Operation

On each backbone interface, both OSPFv2 (for IPv4) and OSPFv3 (for IPv6) adjacencies form independently. The routers maintain two separate OSPF databases and two separate routing tables. BFD applies to both — configure ipv6 ospf bfd per interface for OSPFv3 BFD. The LDP transport for 6PE remains IPv4-based: IPv6 labels are exchanged via the IPv4 LDP session, so the P routers do not need IPv6 routing — only PE routers need OSPFv3 for IPv6 prefix exchange.

OSPFv3 Configuration

CORE-1OSPFv3 area 0 with IPsec auth
ipv6 unicast-routing

interface Loopback0
 ipv6 address 2001:db8:ff:1::1/128
 ipv6 ospf 1 area 0

interface GigabitEthernet0/0
 ipv6 address 2001:db8:0:12::1/64
 ipv6 ospf 1 area 0
 ipv6 ospf bfd

ipv6 router ospf 1
 router-id 10.255.1.1
 area 0 authentication ipsec spi 256 sha1 1234567890ABCDEF1234567890ABCDEF12345678
 passive-interface Loopback0

Verification

show ipv6 ospf neighbor
Expected: OSPFv3 neighbors in FULL state. Neighbor address shows link-local address (FE80::/10). Separate adjacencies from OSPFv2.
show ipv6 route ospf
Expected: IPv6 loopback prefixes (2001:db8:ff::/48 range) visible via OSPFv3. P2P link prefixes (2001:db8:0::/48) as connected.
show ipv6 ospf database
Expected: OSPFv3 LSA types 1, 8, 9 present. No IPv4 address information in LSAs (major difference from OSPFv2).
ping ipv6 2001:db8:ff:1::4 source 2001:db8:ff:1::1
Expected: IPv6 end-to-end reachability across CORE routers. Success = 5/5.

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.

Initial Configs — Load These First
⬇ CORE-1-initial.cfg ⬇ CORE-2-initial.cfg ⬇ CORE-3-initial.cfg ⬇ CORE-4-initial.cfg