VoIP and IPv6 with IPsec

Question

I had some basic questions about VoIP in a IPv6 architecture, right now I'm running VoIP in a v4 architecture, and I was thinking about to change everything to v6.

my questions are not that practical but I would like to understand it well.

Question 1:

if i had internet full v6 or v4 and that I enable IPsec on my v6 router do I still need a VPN through the internet ? because my routers will anyway exchange their pub/priv key or their certificate to ensure the communication.

Question 2:

If the answer to question 1 is yes then I only have two advantages to put my VoIP architecture to IPv6 the second advantage for me is the NAT which I will not have anymore.

I know that right now I should anyway still use things like NAT-PT, Tunnelling and so one but in full v6 are their any other advantages ?

Thank you

Answer 1

The disadvantage to switching over to IPv6 is that practically no one else is using it. Sure it's the future but your IPv6 packets would get not get routed. It would be the ultimate in security.

Currently, you would have to go through an IPv6 tunnel.

OK. Your questions.

Q1: No, IPv6 has built-in encryption. No need for VPN but you could still use VPN if you are paranoid.

Q2: IPv6 encryption specifies a rather weak cipher (last I heard). Hopefully, it will be replaced by a much stronger one. A VPN would still be necessary if you are paranoid.

Answer 2

This answer is incorrect for several reasons:

1 -- IPv6 does NOT have built-in encryption. It has dedicated space in the packet for IPSec exchange, but it does not automatically imply the traffic is encrypted. You still need to setup IPSec as you would for ipv4.

2 -- The cipher is chosen at the time of negotiation by your IPSec configuration, it is NOT a part of the IPv6 specification. You run whatever cipher your IPSec stack supports.