How to configure and verify OSPF3 authentication

The following restrictions apply to IPsec authentication for OSPFv3:

• Dynamic Internet Key Exchange (IKE) security associations (SAs) are not supported.
• Only IPsec transport mode is supported. In transport mode, only the payload (the data you transfer) of the IP packet is encrypted and/or authenticated. Tunnel mode is not supported.
• Because only bidirectional manual SAs are supported, all OSPFv3 peers must be configured with the same IPsec SA. You configure a manual bidirectional SA at the [edit security ipsec] hierarchy level.
• You must configure the same IPsec SA for all virtual links with the same remote endpoint address

IPSec Authentication for OSPFv3 

Lab set-up details:

Topology:

router ---- ae0 ------router2

Configuration snippet:

root@router# show | display set | match sa-for-ospfv3

set security ipsec security-association sa-for-ospfv3 mode transport

set security ipsec security-association sa-for-ospfv3 manual direction bidirectional protocol ah

set security ipsec security-association sa-for-ospfv3 manual direction bidirectional spi 256

set security ipsec security-association sa-for-ospfv3 manual direction bidirectional authentication algorithm hmac-sha-256

set security ipsec security-association sa-for-ospfv3 manual direction bidirectional authentication key ascii-text "$9$gS4UHQz69A0QF1hSrLXDikqT3/CABEleWx-wXxmf5T3nSrlvX7VwYaGDsYz39A0OVws2GDjHqm5QGU"

set routing-instances TEST protocols ospf3 area 0.0.0.0 interface ae0.0 ipsec-sa sa-for-ospfv3

root@router# show routing-instances TEST | display set 
set routing-instances TEST protocols ospf3 area 0.0.0.0 interface ae0.0 interface-type p2p
set routing-instances TEST protocols ospf3 area 0.0.0.0 interface ae0.0 ipsec-sa sa-for-ospfv3

Verification:

root@router# run show security ipsec control-plane-security-associations detail

 Direction: Inbound, SA Name: sa-for-ospfv3,

 Protocol: AH, Authentication: hmac-sha256-128, Encryption: none

 SPI: 100, AUX-SPI: 0,

 Mode: Transport, Type: Manual,

 ID: 1,

 Direction: Outbound, SA Name: sa-for-ospfv3,

 Protocol: AH, Authentication: hmac-sha256-128, Encryption: none

 SPI: 100, AUX-SPI: 0,

 Mode: Transport, Type: Manual,

 ID: 2,

root@router# run show ospf3 interface instance TEST

Interface         State Area          DR ID         BDR ID        Nbrs

ae0.0           PtToPt 0.0.0.0       0.0.0.0       0.0.0.0          1

root@router# run show ospf3 neighbor instance TEST detail               

ID             Interface            State   Pri Dead

192.168.1.2 ae0.0              Full    128   34

 Neighbor-address fe80::1a2a:d3ff:fee5:7b2a

 Area 0.0.0.0, opt 0x13, OSPF3-Intf-Index 1

 DR-ID 0.0.0.0, BDR-ID 0.0.0.0

 Up 00:17:15, adjacent 00:17:14

root@router# run show route protocol ospf3

TEST.inet6.0: 35 destinations, 49 routes (28 active, 0 holddown, 13 hidden)

+ = Active Route, - = Last Active, * = Both

ff02::5/128      *[OSPF3/10] 2d 22:25:10, metric 1

                     MultiRecv

https://www.juniper.net/documentation/us/en/software/junos/ospf/topics/topic-map/configuring-ospf-authentication.html#id-understanding-ospfv3-authentication