<div>Hi</div>
<div> </div>
<div>I am facing a issue with using strongswan on a GW with PPPoE-IPv6 address (which is a dynamic ipv6 address..keeps changing). The setup is as below:</div>
<div> </div>
<div>IPv6-PC1-------[lan]-GW1-[pppoe-ipv6-wan-ip]-----------[pppoe-ipv6]-IPv6-PPPoE-Server/Router-[static-ipv6-addr]-------[static-ipv6-wan-addr]-GW2-[lan]--------IPv6-PC2<br></div>
<div> </div>
<div>- The ipsec tunnel is to be established between GW1 and GW2---all end-to-end IPv6 (and with combination of IPv4 n/w in LAN too) </div>
<div> </div>
<div>- The setup with static-ipv6 ipsec-tunnel works (and also with ipv4 over ipv6 and vice-versa)</div>
<div> </div>
<div>- The interface config on GW1 (the DUT for me here) is as below:</div>
<div> </div>
<div>**********************************************************************</div>
<div><a href="mailto:root@evm1gw:/">root@evm1gw:/</a># ifconfig<br>ath0 Link encap:Ethernet HWaddr 00:03:7F:0B:E6:A4 <br> inet addr:192.168.3.1 Bcast:192.168.3.255 Mask:255.255.255.0<br> inet6 addr: fe80::203:7fff:fe0b:e6a4/64 Scope:Link<br>
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br> RX packets:0 errors:0 dropped:0 overruns:0 frame:0<br> TX packets:0 errors:0 dropped:7 overruns:0 carrier:0<br> collisions:0 txqueuelen:1000 <br>
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)</div>
<div>eth0 Link encap:Ethernet HWaddr 00:11:21:23:32:21 <br> inet6 addr: fe80::211:21ff:fe23:3221/64 Scope:Link<br> inet6 addr: fec0::eec8/120 Scope:Site<br> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br>
RX packets:216 errors:0 dropped:0 overruns:0 frame:0<br> TX packets:118 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0 txqueuelen:1000 <br> RX bytes:18552 (18.1 KiB) TX bytes:4726 (4.6 KiB)<br>
Interrupt:53 </div>
<div>eth1 Link encap:Ethernet HWaddr 00:AA:BB:CC:DD:EE <br> inet addr:169.254.0.1 Bcast:169.254.255.255 Mask:255.255.0.0<br> inet6 addr: fe80::2aa:bbff:fecc:ddee/64 Scope:Link<br> UP BROADCAST RUNNING NOARP MTU:1500 Metric:1<br>
RX packets:23 errors:0 dropped:1 overruns:0 frame:0<br> TX packets:14 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0 txqueuelen:0 <br> RX bytes:652 (652.0 B) TX bytes:626 (626.0 B)<br>
Interrupt:1 </div>
<div>eth2 Link encap:Ethernet HWaddr 00:2A:2B:2C:2D:2E <br> inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0<br> inet6 addr: 2007:ac11:a65:db4::1/64 Scope:Global<br> inet6 addr: fe80::22a:2bff:fe2c:2d2e/64 Scope:Link<br>
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br> RX packets:0 errors:0 dropped:0 overruns:0 frame:0<br> TX packets:17 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0 txqueuelen:1000 <br>
RX bytes:0 (0.0 B) TX bytes:1474 (1.4 KiB)<br> Interrupt:55 </div>
<div>lo Link encap:Local Loopback <br> inet addr:127.0.0.1 Mask:255.0.0.0<br> inet6 addr: ::1/128 Scope:Host<br> UP LOOPBACK RUNNING MTU:16436 Metric:1<br> RX packets:0 errors:0 dropped:0 overruns:0 frame:0<br>
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0 txqueuelen:0 <br> RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)</div>
<div>ppp0 Link encap:Point-to-Point Protocol <br> inet6 addr: 2003::e9f9:a139:8d82:8ebd/64 Scope:Global<br> inet6 addr: fe80::e9f9:a139:8d82:8ebd/10 Scope:Link<br> UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1<br>
RX packets:114 errors:0 dropped:0 overruns:0 frame:0<br> TX packets:6 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0 txqueuelen:3 <br> RX bytes:9860 (9.6 KiB) TX bytes:250 (250.0 B)</div>
<div>wifi0 Link encap:UNSPEC HWaddr 00-03-7F-0B-E6-A4-00-00-00-00-00-00-00-00-00-00 <br> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1<br> RX packets:0 errors:0 dropped:0 overruns:0 frame:0<br>
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0<br> collisions:0 txqueuelen:1000 <br> RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)<br> Interrupt:68 Memory:d0340000-d0350000 </div>
<div><a href="mailto:root@evm1gw:/">root@evm1gw:/</a># ip -6 route add default dev ppp0<br><a href="mailto:root@evm1gw:/">root@evm1gw:/</a># <br><a href="mailto:root@evm1gw:/">root@evm1gw:/</a># <br><a href="mailto:root@evm1gw:/">root@evm1gw:/</a># ip -6 route<br>
2003::/64 dev ppp0 proto kernel metric 256 expires 85995sec mtu 1492 advmss 1432 hoplimit 4294967295<br>2007:ac11:a65:db4::/64 dev eth2 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit 4294967295<br>fe80::/64 dev ppp0 proto kernel metric 256 mtu 1492 advmss 1432 hoplimit 4294967295<br>
fe80::/64 dev eth0 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit 4294967295<br>fe80::/64 dev eth2 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit 4294967295<br>fe80::/64 dev ath0 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit 4294967295<br>
fe80::/64 dev eth1 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit 4294967295<br>fe80::/10 dev ppp0 metric 1 mtu 1492 advmss 1432 hoplimit 4294967295<br>fe80::/10 dev ppp0 proto kernel metric 256 mtu 1492 advmss 1432 hoplimit 4294967295<br>
fec0::ee00/120 dev eth0 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit 4294967295<br>default dev ppp0 metric 1024 mtu 1492 advmss 1432 hoplimit 4294967295<br><a href="mailto:root@evm1gw:/">root@evm1gw:/</a># <br>
</div>
<div><a href="mailto:root@evm1gw:/">root@evm1gw:/</a># ping6 2003::1<br>PING 2003::1 (2003::1): 56 data bytes<br>64 bytes from 2003::1: icmp6_seq=0 ttl=64 time=2.7 ms<br>^C<br>--- 2003::1 ping statistics ---<br>1 packets transmitted, 1 packets received, 0% packet loss<br>
round-trip min/avg/max = 2.7/2.7/2.7 ms<br><a href="mailto:root@evm1gw:/">root@evm1gw:/</a># <br><a href="mailto:root@evm1gw:/">root@evm1gw:/</a># ping6 2006::3<br>PING 2006::3 (2006::3): 56 data bytes<br>64 bytes from 2006::3: icmp6_seq=0 ttl=63 time=3.9 ms<br>
64 bytes from 2006::3: icmp6_seq=1 ttl=63 time=3.2 ms<br>************************************************************************</div>
<div> </div>
<div>The ipsec.conf on GW1 is as below:</div>
<div> </div>
<div>***********************************************</div>
<div>gw1:/etc# cat ipsec.conf<br># /etc/ipsec.conf - strongSwan IPsec configuration file</div>
<div>config setup<br> strictcrlpolicy=no<br> crlcheckinterval=180<br> plutostart=yes<br> charonstart=yes<br> nat_traversal=yes</div>
<div>conn %default<br> ikelifetime=60m<br> keylife=30m<br> rekeymargin=3m<br> keyingtries=1<br> mobike=no</div>
<div>conn gwtunnel1<br> left=%defaultroute<br> leftsubnet=2007:ac11:0a65:db4::/64<br> right=2006::3<br> rightsubnet=2007:ac12:0a64:db1::/64<br> authby=rsasig<br> leftcert=evm1gwcertnew.cer<br>
leftid="/C=IN/ST=AP/L=HYD/O=Mind Inc/OU=QA/CN=evm1gw/emailAddress=postma<br><a href="mailto:ster@mind.com">ster@mind.com</a>"<br> rightid="/C=IN/ST=AP/L=HYD/O=DVTTEST/OU=QA/CN=<a href="http://dvtpc2.dvttest.com/emailAd">dvtpc2.dvttest.com/emailAd</a><br>
<a href="mailto:dress=postmaster@dvttest.com">dress=postmaster@dvttest.com</a>"<br> type=tunnel<br> keyexchange=ikev2<br> pfs=no<br> auto=route<br>#</div>
<div>*************************************************************</div>
<div> </div>
<div>- Now, when i try to start ipsec using the command "ipsec start" or "ipsec start --nofork" i get the following errors and the ipsec is not started on GW1</div>
<div> </div>
<div>**********************************</div>
<div><a href="mailto:root@evm1gw:/etc">root@evm1gw:/etc</a># vi ipsec.conf [J<br><a href="mailto:root@evm1gw:/etc">root@evm1gw:/etc</a># ipsec start --nofork[J<br>Starting strongSwan 4.3.6 IPsec [starter]...<br>no default route - cannot cope with %defaultroute!!!<br>
# default route not known: left=%defaultroute<br> bad argument value in conn 'gwtunnel1'<br>### 1 parsing error (0 fatal) ###<br>starter_start_pluto entered<br>Pluto initialized<br>Starting IKEv1 pluto daemon (strongSwan 4.3.6) THREADS VENDORID<br>
pluto (9182) started after 20 ms<br>00[DMN] Starting IKEv2 charon daemon (strongSwan 4.3.6)<br>loaded plugins: blowfish random x509 pubkey pkcs1 pgp dnskey pem openssl hmac <br> including NAT-Traversal patch (Version 0.6c)<br>
Using Linux 2.6 IPsec interface code<br>loading ca certificates from '/etc/ipsec.d/cacerts'<br> loaded ca certificate from '/etc/ipsec.d/cacerts/certnew.cer'<br>loading aa certificates from '/etc/ipsec.d/aacerts'<br>
loading ocsp certificates from '/etc/ipsec.d/ocspcerts'<br>Changing to directory '/etc/ipsec.d/crls'<br> loaded crl from 'certcrl.crl'<br>loading attribute certificates from '/etc/ipsec.d/acerts'<br>
listening for IKE messages<br>adding interface ath0/ath0 <a href="http://192.168.3.1:500">192.168.3.1:500</a><br>adding interface ath0/ath0 <a href="http://192.168.3.1:4500">192.168.3.1:4500</a><br>adding interface eth1/eth1 <a href="http://169.254.0.1:500">169.254.0.1:500</a><br>
adding interface eth1/eth1 <a href="http://169.254.0.1:4500">169.254.0.1:4500</a><br>adding interface eth2/eth2 <a href="http://192.168.1.1:500">192.168.1.1:500</a><br>adding interface eth2/eth2 <a href="http://192.168.1.1:4500">192.168.1.1:4500</a><br>
adding interface lo/lo <a href="http://127.0.0.1:500">127.0.0.1:500</a><br>adding interface lo/lo <a href="http://127.0.0.1:4500">127.0.0.1:4500</a><br>adding interface ppp0/ppp0 2003::e9f9:a139:8d82:8ebd:500<br>adding interface eth0/eth0 fec0::eec8:500<br>
adding interface lo/lo ::1:500<br>adding interface eth2/eth2 2007:ac11:a65:db4::1:500<br>loading secrets from "/etc/ipsec.secrets"<br>00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'<br>00[CFG] loaded ca certificate "CN=dvttestca" from '/etc/ipsec.d/cacerts/certnew.cer'<br>
00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'<br>00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'<br>00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'<br>
00[CFG] loading crls from '/etc/ipsec.d/crls'<br>00[CFG] loaded crl from '/etc/ipsec.d/crls/certcrl.crl'<br>00[CFG] loading secrets from '/etc/ipsec.secrets'<br> loaded private key from 'evm1gwkey.pem'<br>
00[CFG] loaded RSA private key from '/etc/ipsec.d/private/evm1gwkey.pem'<br>00[DMN] loaded plugins: blowfish random x509 pubkey pkcs1 pgp dnskey pem openssl hmac kernel-pfkey stroke updown <br>00[JOB] spawning 16 worker threads<br>
charon (9183) started after 860 ms<br>^Cshutting down<br>forgetting secrets<br>shutting down interface eth2/eth2 2007:ac11:a65:db4::1<br>shutting down interface lo/lo ::1<br>shutting down interface eth0/eth0 fec0::eec8<br>
shutting down interface ppp0/ppp0 2003::e9f9:a139:8d82:8ebd<br>shutting down interface lo/lo 127.0.0.1<br>shutting down interface lo/lo 127.0.0.1<br>shutting down interface eth2/eth2 192.168.1.1<br>shutting down interface eth2/eth2 192.168.1.1<br>
shutting down interface eth1/eth1 169.254.0.1<br>shutting down interface eth1/eth1 169.254.0.1<br>shutting down interface ath0/ath0 192.168.3.1<br>shutting down interface ath0/ath0 192.168.3.1<br>pluto stopped after 20 ms<br>
00[DMN] signal of type SIGINT received. Shutting down<br>00[DMN] thread 0 received 4<br>C library does not support backtrace().<br>00[DMN] killing ourself, received critical signal<br>charon stopped after 200 ms<br>ipsec starter stopped<br>
<a href="mailto:root@evm1gw:/etc">root@evm1gw:/etc</a># <br><a href="mailto:root@evm1gw:/etc">root@evm1gw:/etc</a># <br>***************************************************************************</div>
<div> </div>
<div>- So next, if i change the "ipsec.conf" to below (by copying manually the pppoe-ipv6 address assigned to this GW1 everytime i reboot or if the ip address changes) </div>
<div> </div>
<div>************************************</div>
<div>
<div>conn gwtunnel1<br> left=2003::e9f9:a139:8d82:8ebd<br> leftsubnet=2007:ac11:0a65:db4::/64<br> right=2006::3<br> rightsubnet=2007:ac12:0a64:db1::/64<br> authby=rsasig<br> leftcert=evm1gwcertnew.cer<br>
leftid="/C=IN/ST=AP/L=HYD/O=Mind Inc/OU=QA/CN=evm1gw/emailAddress=postma<br><a href="mailto:ster@mind.com">ster@mind.com</a>"<br> rightid="/C=IN/ST=AP/L=HYD/O=DVTTEST/OU=QA/CN=<a href="http://dvtpc2.dvttest.com/emailAd">dvtpc2.dvttest.com/emailAd</a><br>
<a href="mailto:dress=postmaster@dvttest.com">dress=postmaster@dvttest.com</a>"<br> type=tunnel<br> keyexchange=ikev2<br> pfs=no<br> auto=route<br>#</div></div>
<div> </div>
<div>**************************************************</div>
<div> </div>
<div>-and once again start ipsec. It works now</div>
<div> </div>
<div>So in summary the "%defaultroute" keyword does not seem to work for IPv6-PPPoE or IPv6 dynamic connections as it does for IPv4</div>
<div> </div>
<div>So is this a design issue in strongswan?</div>
<div> </div>
<div>Please note: the version iam using is 4.3, but i have run a check using 4.5 too and i guess the issue is also observed in all versions higher than 4.3 too.</div>
<div> </div>
<div>regards</div>
<div>rajiv</div>
<div> </div>
<div> </div>
<div> </div>
<div><br> </div>