Subject: [Ipsec] IPv6 with Ipsec and Racoon issue

From: "Philip Bellino" <[email-masked]>
Date: Tue, 15 May 2007 16:02:11 -0400

Hello,
Running ipsec-tools-0.6.7 on a Linux client and host.
I use Racoon with pre-shared keys and Security Policies with ESP/AHs
configured for IPv4 and IPv6.

There is no problem with IPv4.

I see a chicken and the egg problem with IPv6.

An ICMPv6 Neighbor Solicitation goes from Host A to Host B.  This is
o.k. because it is not subject to IPsec.
The ICMPv6 Neighbor Discovery from Host B is not o.k. because since
there exists a SP that requires ESP/AH, it triggers an SA negotiation.
So, it looks like a loop is created and the result is that it does not
work.

I have tried adding in:
spdadd ::/0 ::/0 icmp6 -P out none;
spdadd ::/0 ::/0 icmp6 -P in none;

And although the icmps are now not subject to IPsec, I still get the
"phase1 negotiation" failure  in Racoon.

The only way (besides not using Racoon and manually adding keyed SA's)
is the following:
1.  Stop the Racoon daemons flush/spdflush all the SAs and SPDs
2.  Issue a ping6.
3.  Re-issue the SPDs.
4.  Start Racoon.

Does anyone know of a permanent solution to this issue?

Thanks,
Phil Bellino

============================ 
Phil Bellino 
MRV Communications, Inc. 
Boston Product Division 
295 Foster St. 
Littleton,MA 01460 
Tel: (978)952-4807 
Email: [email-masked] 
============================ 

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Jari Arkko <[email-masked]>
Date: Wed, 16 May 2007 09:46:58 +0300

Philip,

> there exists a SP that requires ESP/AH, it triggers an SA negotiation.

I wrote a draft about this many, many years ago:

http://www.arkko.com/publications/draft-arkko-icmpv6-ike-effects-01.txt
http://www.arkko.com/publications/draft-arkko-manual-icmpv6-sas-01.txt

Basically, you need to set up specific policies to avoid running IPv6 ND
under IKE-negotiated SAs. An implementation that I had in the 1990s
did this automatically. Some other implementations that I know have
this hardcoded, too. Not sure what Racoon does, maybe you need to
specify policies manually.

The problems that we run into were also a reason for creating
SEND (RFC 3971) which is a non-IPsec based security mechanism
for ND.

Jari

---

From: Joy Latten <[email-masked]>
Date: Wed, 16 May 2007 10:56:21 -0500

> So, it looks like a loop is created and the result is that it does not

Yes, I recall having this same problem.
I suggest you try posting to the ipsec-tools mailing list too.

> spdadd ::/0 ::/0 icmp6 -P in none;

I tried this too without much success.
I am not sure why the above statement doesn't work, though, because
conceptually it should have.

Because I only wanted tcp and udp packets to have ipsec applied,
I found success by specifying policy for each upper layer protocol
rather than using keyword "any" for any protocol.
An example of my ipv6 ipsec policy,

spdadd -6 XX XX tcp
-P out ipsec
esp/transport//require;

spdadd -6 XX XX tcp
-P in ipsec
esp/transport//require;

spdadd -6 XX XX udp
-P out ipsec
esp/transport//require;

spdadd -6 XX XX udp
-P in ipsec
esp/transport//require;

Regards, 
Joy Latten