IPsec VTI dualstack

dragoangel

I try to create IPsec VTI routed tunnel with two 2nd phases per IPv4 and IPv6.
In end work only first one. Second one doesn't get routed even manually. Does someone have such config work? What I can missed?

dragoangel

I even tried create separated p1 per ipv6 and ipv4 and in this case it work more correctly but still applying firewall rules on interfaces with Gateway still sometimes work and sometimes no. I see that traffic pass rule by counter but not reach another part of tunnel. More over when create p2 for tunnel and vti at once in one p1 - will end up by handup pfsense. No alert, no warning will stop you from destructive manipulations.

jimp

It works fine for me.

: ifconfig ipsec4000
ipsec4000: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1299
	tunnel inet 198.51.100.3 --> 198.51.100.20
	inet6 fe80::20c:29ff:fe45:256%ipsec4000 prefixlen 64 scopeid 0x9
	inet6 2001:db8:3:1111::1 prefixlen 64
	inet 10.3.111.1 --> 10.3.111.2 netmask 0xfffffffc
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
	reqid: 4000
	groups: ipsec

: ping -c 2 -S 10.3.111.1 10.3.111.2
PING 10.3.111.2 (10.3.111.2) from 10.3.111.1: 56 data bytes
64 bytes from 10.3.111.2: icmp_seq=0 ttl=64 time=0.849 ms
64 bytes from 10.3.111.2: icmp_seq=1 ttl=64 time=0.687 ms

--- 10.3.111.2 ping statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.687/0.768/0.849/0.081 ms

: ping6 -c 2 -S 2001:db8:3:1111::1 2001:db8:3:1111::2
PING6(56=40+8+8 bytes) 2001:db8:3:1111::1 --> 2001:db8:3:1111::2
16 bytes from 2001:db8:3:1111::2, icmp_seq=0 hlim=64 time=3.093 ms
16 bytes from 2001:db8:3:1111::2, icmp_seq=1 hlim=64 time=1.558 ms

--- 2001:db8:3:1111::2 ping6 statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 1.558/2.325/3.093/0.768 ms

: cat /etc/version
2.4.5-RELEASE

You only need one P1 with two P2s: One for IPv4, one for IPv6. You handle anything else in routes.

Make sure it's IKEv2.

dragoangel

@jimp /64 in "address" is obvious. No... Will try.