Ipsec ikev2
-
Hmmm.
Ipv4 tunnel works for me, but Ipv6 does not.
Rules are added, ipsec was restarted. Tracert shows traffic to go to pfsense and then it stops.? :)
-
Hmmm just found this on 2.2.6 box:
kernel: ip6_output (ipsec): error code 47This error does not appear on 2.3
-
Not sure, lots of other places your setup could have gone wrong with IPv6. All I know is that it works here when I tried it last. P2 established and traffic v6 was passing over the tunnel, so it's not likely to be a general IPv6+IPsec problem, but something more specific to your local network settings.
-
I know it`s old but still:
https://www.google.si/?gws_rd=ssl#q=kernel:+ip6_output+%28ipsec%29:+error+code+47BTW my IPv6 is configured just fine :)
-
And this: http://lists.freebsd.org/pipermail/freebsd-net/2013-February/034653.html
If I create IPv6 tunnel it works just fine, like IPv4… -
Not sure what to tell you other than to double check your work. It works fine here with IPv4 and IPv6 in a single IKEv2 tunnel:
[2.3-BETA][root@jack.dw.example.com]/root: ping -c 4 -S 192.168.43.1 10.7.0.1 PING 10.7.0.1 (10.7.0.1) from 192.168.43.1: 56 data bytes 64 bytes from 10.7.0.1: icmp_seq=0 ttl=64 time=0.855 ms 64 bytes from 10.7.0.1: icmp_seq=1 ttl=64 time=0.585 ms 64 bytes from 10.7.0.1: icmp_seq=2 ttl=64 time=0.673 ms 64 bytes from 10.7.0.1: icmp_seq=3 ttl=64 time=0.861 ms --- 10.7.0.1 ping statistics --- 4 packets transmitted, 4 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 0.585/0.744/0.861/0.119 ms [2.3-BETA][root@jack.dw.example.com]/root: ping6 -c 4 -S 2001:db8:1:eec0:20d:b9ff:fe33:f72 2001:db8:1:deb0::1 PING6(56=40+8+8 bytes) 2001:db8:1:eec0:20d:b9ff:fe33:f72 --> 2001:db8:1:deb0::1 16 bytes from 2001:db8:1:deb0::1, icmp_seq=0 hlim=64 time=1.439 ms 16 bytes from 2001:db8:1:deb0::1, icmp_seq=1 hlim=64 time=0.943 ms 16 bytes from 2001:db8:1:deb0::1, icmp_seq=2 hlim=64 time=0.956 ms 16 bytes from 2001:db8:1:deb0::1, icmp_seq=3 hlim=64 time=0.839 ms --- 2001:db8:1:deb0::1 ping6 statistics --- 4 packets transmitted, 4 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.839/1.044/1.439/0.232 ms: tcpdump -vvvni enc0 tcpdump: WARNING: enc0: no IPv4 address assigned tcpdump: listening on enc0, link-type ENC (OpenBSD encapsulated IP), capture size 65535 bytes 15:58:55.496876 (authentic,confidential): SPI 0xc0dbd04f: IP (tos 0x0, ttl 64, id 45404, offset 0, flags [none], proto ICMP (1), length 84) 192.168.43.1 > 10.7.0.1: ICMP echo request, id 16664, seq 0, length 64 15:58:55.496993 (authentic,confidential): SPI 0xc205845b: IP (tos 0x0, ttl 64, id 63546, offset 0, flags [none], proto ICMP (1), length 84, bad cksum d39b (->8cbd)!) 10.7.0.1 > 192.168.43.1: ICMP echo reply, id 16664, seq 0, length 64 15:58:56.498392 (authentic,confidential): SPI 0xc0dbd04f: IP (tos 0x0, ttl 64, id 38240, offset 0, flags [none], proto ICMP (1), length 84) 192.168.43.1 > 10.7.0.1: ICMP echo request, id 16664, seq 1, length 64 15:58:56.498436 (authentic,confidential): SPI 0xc205845b: IP (tos 0x0, ttl 64, id 38618, offset 0, flags [none], proto ICMP (1), length 84, bad cksum ef97 (->ee1d)!) 10.7.0.1 > 192.168.43.1: ICMP echo reply, id 16664, seq 1, length 64 15:58:57.557724 (authentic,confidential): SPI 0xc0dbd04f: IP (tos 0x0, ttl 64, id 28035, offset 0, flags [none], proto ICMP (1), length 84) 192.168.43.1 > 10.7.0.1: ICMP echo request, id 16664, seq 2, length 64 15:58:57.557766 (authentic,confidential): SPI 0xc205845b: IP (tos 0x0, ttl 64, id 41042, offset 0, flags [none], proto ICMP (1), length 84, bad cksum 1775 (->e4a5)!) 10.7.0.1 > 192.168.43.1: ICMP echo reply, id 16664, seq 2, length 64 15:58:58.563872 (authentic,confidential): SPI 0xc0dbd04f: IP (tos 0x0, ttl 64, id 43514, offset 0, flags [none], proto ICMP (1), length 84) 192.168.43.1 > 10.7.0.1: ICMP echo request, id 16664, seq 3, length 64 15:58:58.563914 (authentic,confidential): SPI 0xc205845b: IP (tos 0x0, ttl 64, id 32701, offset 0, flags [none], proto ICMP (1), length 84, bad cksum dafd (->53b)!) 10.7.0.1 > 192.168.43.1: ICMP echo reply, id 16664, seq 3, length 64 15:59:01.897952 (authentic,confidential): SPI 0xc0dbd04f: IP6 (hlim 64, next-header ICMPv6 (58) payload length: 16) 2001:db8:1:eec0:20d:b9ff:fe33:f72 > 2001:db8:1:deb0::1: [icmp6 sum ok] ICMP6, echo request, seq 0 15:59:01.898052 (authentic,confidential): SPI 0xc205845b: IP6 (hlim 64, next-header ICMPv6 (58) payload length: 16) 2001:db8:1:deb0::1 > 2001:db8:1:eec0:20d:b9ff:fe33:f72: [icmp6 sum ok] ICMP6, echo reply, seq 0 15:59:02.960706 (authentic,confidential): SPI 0xc0dbd04f: IP6 (hlim 64, next-header ICMPv6 (58) payload length: 16) 2001:db8:1:eec0:20d:b9ff:fe33:f72 > 2001:db8:1:deb0::1: [icmp6 sum ok] ICMP6, echo request, seq 1 15:59:02.960760 (authentic,confidential): SPI 0xc205845b: IP6 (hlim 64, next-header ICMPv6 (58) payload length: 16) 2001:db8:1:deb0::1 > 2001:db8:1:eec0:20d:b9ff:fe33:f72: [icmp6 sum ok] ICMP6, echo reply, seq 1 15:59:04.014537 (authentic,confidential): SPI 0xc0dbd04f: IP6 (hlim 64, next-header ICMPv6 (58) payload length: 16) 2001:db8:1:eec0:20d:b9ff:fe33:f72 > 2001:db8:1:deb0::1: [icmp6 sum ok] ICMP6, echo request, seq 2 15:59:04.014589 (authentic,confidential): SPI 0xc205845b: IP6 (hlim 64, next-header ICMPv6 (58) payload length: 16) 2001:db8:1:deb0::1 > 2001:db8:1:eec0:20d:b9ff:fe33:f72: [icmp6 sum ok] ICMP6, echo reply, seq 2 15:59:05.032436 (authentic,confidential): SPI 0xc0dbd04f: IP6 (hlim 64, next-header ICMPv6 (58) payload length: 16) 2001:db8:1:eec0:20d:b9ff:fe33:f72 > 2001:db8:1:deb0::1: [icmp6 sum ok] ICMP6, echo request, seq 3 15:59:05.032501 (authentic,confidential): SPI 0xc205845b: IP6 (hlim 64, next-header ICMPv6 (58) payload length: 16) 2001:db8:1:deb0::1 > 2001:db8:1:eec0:20d:b9ff:fe33:f72: [icmp6 sum ok] ICMP6, echo reply, seq 3And from "ipsec statusall" for good measure…
Connections: bypasslan: %any...%any IKEv1/2 bypasslan: local: uses public key authentication bypasslan: remote: uses public key authentication bypasslan: child: 192.168.43.0/24|/0 === 192.168.43.0/24|/0 PASS con1: 198.51.100.100...198.51.100.7 IKEv2, dpddelay=10s con1: local: [198.51.100.100] uses pre-shared key authentication con1: remote: [198.51.100.7] uses pre-shared key authentication con1: child: 192.168.43.0/24|/0 2001:db8:1:eec0::/60|/0 === 10.7.0.0/24|/0 2001:db8:1:deb0::/64|/0 TUNNEL, dpdaction=restart Shunted Connections: bypasslan: 192.168.43.0/24|/0 === 192.168.43.0/24|/0 PASS Routed Connections: con1{3}: ROUTED, TUNNEL, reqid 1 con1{3}: 192.168.43.0/24|/0 2001:db8:1:eec0::/60|/0 === 10.7.0.0/24|/0 2001:db8:1:deb0::/64|/0 Security Associations (1 up, 0 connecting): con1[1]: ESTABLISHED 5 minutes ago, 198.51.100.100[198.51.100.100]...198.51.100.7[198.51.100.7] con1[1]: IKEv2 SPIs: 77b4381031502095_i* 53b145c57a3f7c63_r, pre-shared key reauthentication in 7 hours con1[1]: IKE proposal: AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024 con1{2}: INSTALLED, TUNNEL, reqid 1, ESP SPIs: c205845b_i c0dbd04f_o con1{2}: AES_CBC_256/HMAC_SHA1_96, 1456 bytes_i, 3680 bytes_o, rekeying in 39 minutes con1{2}: 192.168.43.0/24|/0 === 2001:db8:1:deb0::/64|/0(granted that output looks a little funny, but it is there and working)
setkey -DP 192.168.43.0/24[any] 192.168.43.0/24[any] any in none created: Feb 1 15:58:32 2016 lastused: Feb 1 15:58:32 2016 lifetime: 9223372036854775807(s) validtime: 0(s) spid=8 seq=5 pid=93603 refcnt=1 10.7.0.0/24[any] 192.168.43.0/24[any] any in ipsec esp/tunnel/198.51.100.7-198.51.100.100/unique:1 created: Feb 1 15:58:32 2016 lastused: Feb 1 15:58:58 2016 lifetime: 9223372036854775807(s) validtime: 0(s) spid=10 seq=4 pid=93603 refcnt=1 2001:db8:1:deb0::/64[any] 2001:db8:1:eec0::/60[any] any in ipsec esp/tunnel/198.51.100.7-198.51.100.100/unique:1 created: Feb 1 15:58:32 2016 lastused: Feb 1 15:59:05 2016 lifetime: 9223372036854775807(s) validtime: 0(s) spid=12 seq=3 pid=93603 refcnt=1 192.168.43.0/24[any] 192.168.43.0/24[any] any out none created: Feb 1 15:58:32 2016 lastused: Feb 1 15:58:32 2016 lifetime: 9223372036854775807(s) validtime: 0(s) spid=7 seq=2 pid=93603 refcnt=1 192.168.43.0/24[any] 10.7.0.0/24[any] any out ipsec esp/tunnel/198.51.100.100-198.51.100.7/unique:1 created: Feb 1 15:58:32 2016 lastused: Feb 1 15:58:58 2016 lifetime: 9223372036854775807(s) validtime: 0(s) spid=9 seq=1 pid=93603 refcnt=1 2001:db8:1:eec0::/60[any] 2001:db8:1:deb0::/64[any] any out ipsec esp/tunnel/198.51.100.100-198.51.100.7/unique:1 created: Feb 1 15:58:32 2016 lastused: Feb 1 15:59:05 2016 lifetime: 9223372036854775807(s) validtime: 0(s) spid=11 seq=0 pid=93603 refcnt=1 -
Hmmmm… OK
Do you have any recommendations where to start looking?
I added firewall rules on IPSEC interfaces on both sides and set them to allow any any IPv6 for test purposes.
I do not block IPv6 anywhere.Wireshark shows this on local ipsec iface when I ping:
22:07:05.969317 (authentic,confidential): SPI 0xce682ffa: (hlim 127, next-header ICMPv6 (58) payload length: 40) 2001:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX > 2a01:XXX:XXXX:XXXX::XXX: [icmp6 sum ok] ICMP6, echo request, seq 45 22:07:10.676559 (authentic,confidential): SPI 0xce682ffa: (hlim 127, next-header ICMPv6 (58) payload length: 40) 2001:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX > 2a01:XXX:XXXX:XXXX::XXX: [icmp6 sum ok] ICMP6, echo request, seq 46 22:07:15.675531 (authentic,confidential): SPI 0xce682ffa: (hlim 127, next-header ICMPv6 (58) payload length: 40) 2001:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX > 2a01:XXX:XXXX:XXXX::XXX: [icmp6 sum ok] ICMP6, echo request, seq 47And each ping from 2.3 network to 2.2.6 network produces above (kernel: ip6_output (ipsec): error code 47) error on 2.2.6 system.
So traffic comes to 2.2.6 and there it stops or something ?Thanks!
-
Not sure there. I had that same tunnel I showed above working between 2.2.5 and 2.3 before upgrading the older system to 2.3. I don't have an active one that goes between 2.2.6 and 2.3 to test at the moment. I tested both because for a while we prevented both from being configured. I made sure it worked before relaxing the input validation.
https://redmine.pfsense.org/issues/5305
https://doc.pfsense.org/index.php/2.2.5_New_Features_and_Changes#IPsec -
As I suspected there is a problem with 2.2.6 and IKEv2 P2.
It does not work, at least 32-bit is not working with ipv4 and ipv6 both inside one P1.
I upgraded 2.2.6 to 2.3 and IPv6 tunnel inside IPv4 P1 is working just fine.
-
It's possible it's specific to 32-bit but I'm not sure how. Either way, if it works on 2.3 there is nothing to fix currently. If we do another 2.2.x release it will only be a security release and wouldn't be used to address something like this.
-
Yeah, but I can
t help myself, I like to know when Im wrong and this time my config checked out just fine :)
