Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I'm getting a little confused in understanding the differences in IPSec in IPv4 and IPv6...
Are the principles of IPsec the same in v6, but instead of it being optional it is now mandatory for it to be included?
Is IPSec "built in" to v6 or does it need to be included through the extension headers? (Authentication header + Encapsulation Security Payload)
I was confused for a long time by sources which said that IPsec was "mandatory in IPv6" or "built in to IPv6". I think the answer you're looking for is:
Any implementation of IPv6 is required to support IPsec when IPsec is requested. However, it is not mandatory for IPsec to be enabled in every single IPv6 connection. It won't be enabled unless the communicating parties choose to use it.
Unfortunately many sources simply state "IPsec is mandatory in IPv6" leading people to think it is always turned on in IPv6. (That is, indeed, the most natural interpretation of that statement.)
(In any case, that's out of date anyway since RFC 6434 now says only that IPv6 "should" support IPsec: https://www.rfc-editor.org/rfc/rfc6434 However, that's not the point of confusion here; the issue is that even when the spec did say "IPv6 requires IPsec", that meant it had to be supported, not that it had to be enabled in every connection.)
IPsec was originally planned as part of the next-generation IP (IPv6), but security quickly became very important, and IPsec was designed as the Internet security protocol for both IPv4 and IPv6 (RFC 1825, Security Architecture for the Internet Protocol, later obsoleted by RFC 2401, Security Architecture for the Internet Protocol, later obsoleted by RFC 4301, Security Architecture for the Internet Protocol). Since IPv4 was already defined, IPsec is basically bolted on (IPSec packets are payload), but IPv6 was still being defined, and IPsec is a integral part of IPv6. From the beginning, IPv6 has had the AH and ESP extension headers, something not really possible with IPv4.
It took longer than originally planned for IPv6 to start being used, and nodes began to use IPsec in applications for IPv4. The way applications use IPsec with IPv4 (simply as payload for IPv4 or IPv6 packets, or as tunnels where the entire packet is encrypted as payload of the encapsulating packet) can also be used with IPv6; it is really network protocol independent.
As IPv6 came along, the way IPsec is implemented has not really changed, and the implementation using extension headers hasn't really materialized. One exception is OSPFv3. As IPv6 overtakes IPv4, we may see the way IPsec (or its descendants) used move to IPv6 packet headers, or it may remain implemented as it is today.
