[strongSwan] Windows 7 IKEv2 VPN virtual IP issue
Far.Runner
far.runner at gmail.com
Thu Apr 18 23:57:19 CEST 2013
Hi,
I am trying setup an IKEv2 VPN between windows 7 and strongswan, it is
dual-stack over v4 VPN. and strongswan assign virutal v4 and v6
address to windows 7. following is the ipsec.conf, I am using
certificate authentication.
config setup
conn %default
ikelifetime=600m
keylife=200m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
mobike=no
esp=aes128-sha1
ike=aes128-sha1-modp1024
conn rw
left=10.1.1.1
leftsubnet=172.16.1.0/24,2001:AAAA::0/64
leftcert=segwcert.pem
right=%any
rightsourceip=10.3.0.0/28,2001:BBBB::/120
auto=add
Tunnel was created successfully, and v4 is also working fine, I can
ping 172.16.1.0 from windows 7. but v6 doesn't work.
C:\Users\test>ipconfig
Windows IP Configuration
PPP adapter ub-x:
Connection-specific DNS Suffix . :
IPv6 Address. . . . . . . . . . . : 2001:bbbb::1
Link-local IPv6 Address . . . . . : fe80::1%25
IPv4 Address. . . . . . . . . . . : 10.3.0.1
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . : 0.0.0.0
Ethernet adapter Local Area Connection 2:
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::bc1e:daf3:afa9:406b%14
IPv4 Address. . . . . . . . . . . : 10.1.1.3
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
C:\Users\test>route print -6
===========================================================================
Interface List
25...........................ub-x
14...08 00 27 e5 80 23 ......Intel(R) PRO/1000 MT Desktop Adapter #2
11...08 00 27 3d e0 6f ......Intel(R) PRO/1000 MT Desktop Adapter
1...........................Software Loopback Interface 1
12...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
13...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
===========================================================================
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
25 266 2001:bbbb::/64 On-link
25 266 2001:bbbb::1/128 On-link
11 266 fe80::/64 On-link
14 266 fe80::/64 On-link
25 266 fe80::/64 On-link
25 266 fe80::1/128 On-link
14 266 fe80::bc1e:daf3:afa9:406b/128
On-link
11 266 fe80::bd24:3eb0:86df:e3da/128
On-link
1 306 ff00::/8 On-link
11 266 ff00::/8 On-link
14 266 ff00::/8 On-link
25 266 ff00::/8 On-link
===========================================================================
Persistent Routes:
As you could see windows 7 has got the virtual v6 address:
2001:bbbb::1, however the v6 route table doesn't have any default
route or route the leftsubnet: 2001:AAAA::/64. so when I tried to ping
2001:AAAA::1, I got this:
C:\Users\test>ping 2001:aaaa::1
Pinging 2001:aaaa::1 with 32 bytes of data:
PING: transmit failed. General failure.
PING: transmit failed. General failure.
PING: transmit failed. General failure.
My initial thought was this might related to windows 7 doesn't
receives RA from strongswan, but Could strongswan or linux send RA
over an IPsec tunnel? I don't have radvd installed on the linux box,
so can't test it. just wonder has anybody have the successful
experience to make this work?
More information about the Users
mailing list