Re: [Ipsec] IPv6 with Ipsec and Racoon issue

Philip,

> Running ipsec-tools-0.6.7 on a Linux client and host.
> I use Racoon with pre-shared keys and Security Policies with ESP/AHs
> configured for IPv4 and IPv6.
>
> There is no problem with IPv4.
>
> I see a chicken and the egg problem with IPv6.
>
> An ICMPv6 Neighbor Solicitation goes from Host A to Host B.  This is
> o.k. because it is not subject to IPsec.
> The ICMPv6 Neighbor Discovery from Host B is not o.k. because since
> there exists a SP that requires ESP/AH, it triggers an SA negotiation.
>

I wrote a draft about this many, many years ago:

http://www.arkko.com/publications/draft-arkko-icmpv6-ike-effects-01.txt
http://www.arkko.com/publications/draft-arkko-manual-icmpv6-sas-01.txt

Basically, you need to set up specific policies to avoid running IPv6 ND
under IKE-negotiated SAs. An implementation that I had in the 1990s
did this automatically. Some other implementations that I know have
this hardcoded, too. Not sure what Racoon does, maybe you need to
specify policies manually.

The problems that we run into were also a reason for creating
SEND (RFC 3971) which is a non-IPsec based security mechanism
for ND.

Jari

_______________________________________________
Ipsec mailing list
Ipsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec