[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

(usagi-users 03923) Re: IPsec IPv4 over IPv6 Problem: No route to host



Hi,

I think you should set IPv4 routing information for
the other gateway somehow.

The IPsec process is done after routing resolution.
I guess the gateways did not have routing information and
returned the error.

I did not use IPv4 over IPv6. I however have similar situation,
using IPv6 over IPv4 IPsec. In my case, I did not have IPv6
route between two gateways. I could not configure specific routing
information and/or default gateway of IPv6 accordingly.

I configure "sit" device to set routing information to cheat the kernel
on routing resolution.

POINTOPOINT flag affects neighbor discovery and the kernel just sent
packets to the device in my case.

BTW, Let me confirm, you want to IPv4 IPsec over IPv6 or
IPv4 over IPv6 IPsec?

Best regards,

Toshiyuki Okamoto wrote:
> Problem about IPsec IPv4 over IPv6, which is included in kernel 2.6.21.
> 
> A IPv6 global address is assigned for eth1 by DHCPv6 IA-PD. This case,
> IPsec SA is successfully established but packets cannot been sent to WAN.
> 
> I do ping, this error occured:
> 
>  $ ping: sendmsg: No route to host
> 
> Do someone know about this issue ?
> 
> Network is figured below:
>  LAN                 WAN                 LAN
>    |------ GW-1 -------|
>    | eth1        eth0  |
>                        |------ GW-2 -------|
>                        |  eth0       eth1  |
>                                            |
> ・GW-1
> eth0      Link encap:Ethernet  HWaddr 00:11:43:AC:60:AF
>           inet6 addr: fe80::211:43ff:feac:60af/64 Scope:Link
> 
> eth1      Link encap:Ethernet  HWaddr 00:90:CC:DE:8B:EE
>           inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
>           inet6 addr: 2001:1::290:ccff:fede:8bee/64 Scope:Global
>           inet6 addr: fe80::290:ccff:fede:8bee/64 Scope:Link
> 
> 
> ・GW-2
> eth0      Link encap:Ethernet  HWaddr 00:11:43:AB:00:8A
>           inet6 addr: fe80::211:43ff:feab:8a/64 Scope:Link
> 
> eth1      Link encap:Ethernet  HWaddr 00:90:CC:DE:89:F7
>           inet addr:192.168.2.1  Bcast:192.168.2.255  Mask:255.255.255.0
>           inet6 addr: 2001:2::290:ccff:fede:89f7/64 Scope:Global
>           inet6 addr: fe80::290:ccff:fede:89f7/64 Scope:Link
> 
> After IKE daemon (racoon2) is booted on GW-1/2, I do ping from GW-1:
>  $ ping -I 192.168.1.1 192.168.2.1
> This case, IKE sequence is successfully done, and IPsec SA is registered.
> but ping packet isn't been sent with error above.
> 
> The case IPv6 global address is assigned to eth0 manually,
> IPv4 over IPv6 packet is sent successfully.
> ping6 between GW-1 and GW-2 is okay.
> 
> I suspect that IPv6 routing table is not loaded or invalid.
> 
> I tried that IPv6 global address is assigned to eth0 manually (which
> prefix is varied to GW1/eth0 from GW2/eth0 with appropriate routing
> set),
>  IPv4 over IPv6 packet is not sent successfully.
> 
> 

--
Kazunori Miyazawa