IPSEC enablement for OSPFv2 with IPv4 to allow for stronger authentication required by the US Government.

Currently, the OSPF Neighbor peering for our US Government contracts leverage MD5 today.  We have an open audit finding stating ---> Since MD5 is vulnerable to 'birthday' attacks and may be compromised, routing protocol authentication must use FIPS 140-2 validated algorithms and modules to encrypt the authentication key. <---- All US Government contract vendors have or will soon have this audit finding.

In discussing with IBM developer Mike Fox, our current option would be to migrate to IPv6 and use IPSEC.  This is a 'heavy lift' and neither the mainframe team nor the network team are in a position to perform this task in a timely fashion.  It was suggested that we open this 'Idea' and have this evaluated for relevancy. 

Ideally, it would benefit 'us' (ALL vendors servicing the US Government contracts) as we are not in a position to deploy IPv6 quickly or in the near future but need to comply with the current audit finding and requirements.

We believe securing the OSPF neighbor links with IPSEC should work for IPv4 in the same way as it does for IPv6.

We understand that there are reports of users who have cobbled together configurations to allow IPSEC to work at securing OSPF neighbor links.  However, this non-recommended/non-supported configuration is not a road we are willing to traverse.

Thanks for the consideration and feel free to reach out with any questions you might have.

Mike