[strongSwan] ipv6 support

Yong Choo yhc at alcatel-lucent.com
Thu Mar 4 18:04:25 CET 2010


Hi all,
We are trying to use the StrongSwan (4.3.3) in IPv6 env but getting two 
"errors": (errors are in 'bold face').
Any help would be appreciated!

- We are using 'preshared key'
- The ipsec.conf is a very simple one as the following: (We used the 
same format for IPv4 which worked, of course the ip address was in IPv4 
format)
  (Also I tried to add interfaces="ipsec0=eth2.10" for our environment 
in the 'setup' section)
- strongswan.conf is empty

config setup
        plutostart=no

conn %default
        ikelifetime=60m
        keylife=20m
        rekeymargin=3m
        keyingtries=1
        keyexchange=ikev2
        authby=secret

conn net-enb12
        left=fd00::410:172:21:10:12
        right=fd00::410:172:21:10:181
        auto=add





==== ERRORS ===

1) 'ipsec start' (regardless whether I add 'interfaces=

Starting strongSwan 4.3.3 IPsec [starter]...
*no default route - cannot cope with %defaultroute!!!*


2) 'ipsec up net-enb12':

initiating IKE_SA net-enb12[1] to fd00::410:172:21:10:181
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
sending packet: from fd00::410:172:21:10:12[500] to fd00::410:172:21:10:181[500]
received packet: from fd00::410:172:21:10:181[500] to fd00::410:172:21:10:12[500]
parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
authentication of 'fd00::410:172:21:10:12' (myself) with pre-shared key
establishing CHILD_SA net-enb12
generating IKE_AUTH request 1 [ IDi IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(MULT_AUTH) ]
sending packet: from fd00::410:172:21:10:12[4500] to fd00::410:172:21:10:181[4500]
received packet: from fd00::410:172:21:10:181[4500] to fd00::410:172:21:10:12[4500]
parsed IKE_AUTH response 1 [ IDr AUTH SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_4_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) ]
authentication of 'fd00::410:172:21:10:181' with pre-shared key successful
scheduling reauthentication in 3347s
maximum IKE_SA lifetime 3527s
IKE_SA net-enb12[1] established between fd00::410:172:21:10:12[fd00::410:172:21:10:12]...fd00::410:172:21:10:181[fd00::410:172:21:10:181]
*received netlink error: Protocol not supported (93)
unable to add SAD entry with SPI c4b1352e
received netlink error: Protocol not supported (93)
unable to add SAD entry with SPI c6b13641
unable to install inbound and outbound IPsec SA (SAD) in kernel*


     




More information about the Users mailing list