I'm getting a little confused in understanding the differences in IPSec in IPv4 and IPv6…
Are the principles of IPsec the same in v6, but instead of it being optional it is now mandatory for it to be included?
Is IPSec "built in" to v6 or does it need to be included through the extension headers? (Authentication header + Encapsulation Security Payload)
Best Answer
I was confused for a long time by sources which said that IPsec was "mandatory in IPv6" or "built in to IPv6". I think the answer you're looking for is:
Any implementation of IPv6 is required to support IPsec when IPsec is requested. However, it is not mandatory for IPsec to be enabled in every single IPv6 connection. It won't be enabled unless the communicating parties choose to use it.
Unfortunately many sources simply state "IPsec is mandatory in IPv6" leading people to think it is always turned on in IPv6. (That is, indeed, the most natural interpretation of that statement.)
(In any case, that's out of date anyway since RFC 6434 now says only that IPv6 "should" support IPsec: https://www.rfc-editor.org/rfc/rfc6434 However, that's not the point of confusion here; the issue is that even when the spec did say "IPv6 requires IPsec", that meant it had to be supported, not that it had to be enabled in every connection.)