Switching IPsec from IPv4 to IPv6
-
I have an existing IKEv2 IPsec tunnel which works great. The "Remote Gateway" is the public IPv4 address of each pfSense appliance and "Internet Protocol" is set to IPv4. When I change the "Remote Gateway" to the IPv6 address (and also updated the "Internet Protocol" setting), the tunnel seemingly successfully establishes, but no packets come back. Both pfSense devices look like the screenshot below, a ton of bytes/packets out, but 0 coming in. Even a simple ICMP ping from either side can't make it through. When I switch the settings back, everything resumes. Any ideas?
-
Okay, figured out my own issue. ISP is blocking protocol 50. It's allowed via IPv4, but blocked in IPv6. (Weird, right??) Anyway, forced both sides to use NAT-T, and now the connection works without issue.
-
@KStarRunner So out of curiosity what does this exercise get you? You were working just fine with IPv4 right? What is the point of moving it to IPv6? Is your public IPv4 going away?
-
@johnpoz Correct. CGNAT is being rolled out, so I’m trying to switch anything that might be affected to v6.
