1

I had some basic questions about VoIP in a IPv6 architecture, right now I'm running VoIP in a v4 architecture, and I was thinking about to change everything to v6.

my questions are not that practical but I would like to understand it well.

Question 1:

if i had internet full v6 or v4 and that I enable IPsec on my v6 router do I still need a VPN through the internet ? because my routers will anyway exchange their pub/priv key or their certificate to ensure the communication.

Question 2:

If the answer to question 1 is yes then I only have two advantages to put my VoIP architecture to IPv6 the second advantage for me is the NAT which I will not have anymore.

I know that right now I should anyway still use things like NAT-PT, Tunnelling and so one but in full v6 are their any other advantages ?

Thank you

Improve this question

2 Answers 2

Reset to default
1

The disadvantage to switching over to IPv6 is that practically no one else is using it. Sure it's the future but your IPv6 packets would get not get routed. It would be the ultimate in security.

Currently, you would have to go through an IPv6 tunnel.

OK. Your questions.

Q1: No, IPv6 has built-in encryption. No need for VPN but you could still use VPN if you are paranoid.

Q2: IPv6 encryption specifies a rather weak cipher (last I heard). Hopefully, it will be replaced by a much stronger one. A VPN would still be necessary if you are paranoid.

Improve this answer
2
  • RFC 4835 (tools.ietf.org/html/rfc4835) defines the ciphers used for IPSec. Which ciphers a specific IPv6 stack supports can vary.
    – sysadmin1138 ♦
    Jan 3, 2011 at 3:01
  • Out of curiosity, how can they vary?
    – Allen
    Jan 4, 2011 at 0:00
2

This answer is incorrect for several reasons:

1 -- IPv6 does NOT have built-in encryption. It has dedicated space in the packet for IPSec exchange, but it does not automatically imply the traffic is encrypted. You still need to setup IPSec as you would for ipv4.

2 -- The cipher is chosen at the time of negotiation by your IPSec configuration, it is NOT a part of the IPv6 specification. You run whatever cipher your IPSec stack supports.

Improve this answer
1
  • we've got a miscommunication here on account of everyone using "encryption" where they mean "encryption capability" or "data confidentiality". IPv6 implicitly supports IPSec, which has the capability to provide data confidentiality through encryption; like any other data security it must be explicitly configured. The IPSec, and by extension IPv6, support authentication only configurations, where data is not encrypted. Thus is it possible to enable IPSec without data confidentiality. The available cyphers are RFC specifications for standards compliant implementations.
    – Chris S
    May 9, 2011 at 14:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .