[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

(usagi-users 04003) Problems with Route optimization with IPsec



Hello,
I can't get route optimization with IPsec to work. Without it, it works so I thint there might be a problem with sa.conf or mip6d.conf files.

Here is my sa.conf:

# 2003::1 is home address of MN
# 2003::2 is address of HA
#des-cbc key should be 8 characters long
#hmac-sha1 key should be 20 characters long
flush;
# MN -> HA transport SA for BU
 add 2003:0:0:0::1 2003:0:0:0::2 esp 2000
       -u 1
       -m transport
       -E des-cbc "my_key_1"
       -A hmac-sha1 "this is the test key" ;
# HA -> MN transport SA for BA
 add 2003:0:0:0::2 2003:0:0:0::1 esp 2001
      -u 2
        -m transport
        -E des-cbc "my_key_1"
        -A hmac-sha1 "this is the test key" ;
# MN -> HA transport SA for MPS
 add 2003:0:0:0::1 2003:0:0:0::2 esp 2002
      -u 3
        -m transport
        -E des-cbc "my_key_1"
        -A hmac-sha1 "this is the test key" ;
# HA -> MN transport SA for MPA
 add 2003:0:0:0::2 2003:0:0:0::1 esp 2003
      -u 3
        -m transport
        -E des-cbc "my_key_1"
        -A hmac-sha1 "this is the test key" ;
# MN -> HA tunnel SA for HoTI
 add 2003:0:0:0::1 2003:0:0:0::2 esp 2004
        -m tunnel
        -E des-cbc "my_key_1"
        -A hmac-sha1 "this is the test key" ;
# HA -> MN tunnel SA for HoT
 add 2003:0:0:0::2 2003:0:0:0::1 esp 2005
        -m tunnel
        -E des-cbc "my_key_1"
        -A hmac-sha1 "this is the test key" ;


Mobile Node config file:
# This is an example of mip6d Mobile Node configuration file

NodeConfig MN;

## If set to > 0, will not detach from tty
DebugLevel 10;

## Support route optimization with other MNs
DoRouteOptimizationCN enabled;

## Use route optimization with CNs
DoRouteOptimizationMN enabled;

MnDiscardHaParamProb enabled;

Interface "eth0";

MnHomeLink "eth0" {
    HomeAgentAddress 2003::2;
    HomeAddress 2003::1/64;
}

##
## IPsec configuration
##

UseMnHaIPsec enabled;

IPsecPolicySet {
    HomeAgentAddress 2003::2;
    HomeAddress 2003::1/64;
    IPsecPolicy HomeRegBinding UseESP 1 2;
    IPsecPolicy MobPfxDisc UseESP 3;
    IPsecPolicy TunnelMh UseESP;

}

HomeAgent Config File:


NodeConfig HA;
DebugLevel 10;

Interface "eth2";
#UseMnHaIPsec disabled;


##
## IPsec Configuration
##

UseMnHaIPsec enabled;
IPsecPolicySet {
      HomeAgentAddress 2003::2;
      HomeAddress 2003::1/64;
      IPsecPolicy HomeRegBinding UseESP 1 2;
      IPsecPolicy MobPfxDisc UseESP 3;
      IPsecPolicy TunnelMh UseESP;
}



Additionaly here is output from MIP6d on mibile node:

Sun Dec  2 23:28:22 main: MIPL Mobile IPv6 for Linux started in debug mode, not detaching from terminal
Sun Dec  2 23:28:22 conf_show: config_file = mip6d-ro-ipsec.conf
Sun Dec  2 23:28:22 conf_show: vt_hostname = localhost
Sun Dec  2 23:28:22 conf_show: vt_service = 7777
Sun Dec  2 23:28:22 conf_show: mip6_entity = 1
Sun Dec  2 23:28:22 conf_show: debug_level = 10
Sun Dec  2 23:28:22 conf_show: debug_log_file = stderr
Sun Dec  2 23:28:22 conf_show: PolicyModulePath = [internal]
Sun Dec  2 23:28:22 conf_show: DefaultBindingAclPolicy = 0
Sun Dec  2 23:28:22 conf_show: NonVolatileBindingCache = disabled
Sun Dec  2 23:28:22 conf_show: KeyMngMobCapability = disabled
Sun Dec  2 23:28:22 conf_show: UseMnHaIPsec = enabled
Sun Dec  2 23:28:22 conf_show: MnMaxHaBindingLife = 262140
Sun Dec  2 23:28:22 conf_show: MnMaxCnBindingLife = 420
Sun Dec  2 23:28:22 conf_show: MnRouterProbes = 0
Sun Dec  2 23:28:22 conf_show: MnRouterProbeTimeout = 0.000000
Sun Dec  2 23:28:22 conf_show: InitialBindackTimeoutFirstReg = 1.500000
Sun Dec  2 23:28:22 conf_show: InitialBindackTimeoutReReg = 1.000000
Sun Dec  2 23:28:22 conf_show: UseCnBuAck = disabled
Sun Dec  2 23:28:22 conf_show: DoRouteOptimizationMN = enabled
Sun Dec  2 23:28:22 conf_show: MnUseAllInterfaces = disabled
Sun Dec  2 23:28:22 conf_show: MnDiscardHaParamProb = enabled
Sun Dec  2 23:28:22 conf_show: SendMobPfxSols = enabled
Sun Dec  2 23:28:22 conf_show: OptimisticHandoff = disabled
Sun Dec  2 23:28:22 conf_show: SendMobPfxAdvs = enabled
Sun Dec  2 23:28:22 conf_show: SendUnsolMobPfxAdvs = enabled
Sun Dec  2 23:28:22 conf_show: MaxMobPfxAdvInterval = 86400
Sun Dec  2 23:28:22 conf_show: MinMobPfxAdvInterval = 600
Sun Dec  2 23:28:22 conf_show: HaMaxBindingLife = 262140
Sun Dec  2 23:28:22 conf_show: DoRouteOptimizationCN = enabled
Sun Dec  2 23:28:22 xfrm_cn_init: Adding policies and states for CN
Sun Dec  2 23:28:22 xfrm_mn_init: Adding policies and states for MN
Sun Dec  2 23:28:22 conf_home_addr_info: HoA address 2003:0:0:0:0:0:0:1
Sun Dec  2 23:28:22 conf_home_addr_info: HA address 2003:0:0:0:0:0:0:2
Sun Dec  2 23:28:22 __tunnel_add: created tunnel ip6tnl1 (17) from 2003:0:0:0:0:0:0:1 to 2003:0:0:0:0:0:0:2 user count 1
Sun Dec  2 23:28:22 conf_home_addr_info: Home address 2003:0:0:0:0:0:0:1
Sun Dec  2 23:28:22 flag_hoa: set HoA 2003:0:0:0:0:0:0:1/128 iif 17 flags 12 preferred_time 4294967295 valid_time 4294967295
Sun Dec  2 23:28:22 conf_home_addr_info: Added new home_addr_info successfully
Sun Dec  2 23:28:22 __md_discover_router: discover link on iface eth0 (3)
Sun Dec  2 23:28:25 md_change_default_router: add new router fe80:0:0:0:2c0:dfff:fee1:7011 on interface eth0 (3)
Sun Dec  2 23:28:25 md_update_router_stats: add coa 2003:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:28:27 mn_addr_do_dad: DAD succeeded!
Sun Dec  2 23:28:27 mn_addr_do_dad: address = 2003:0:0:0:0:0:0:1
Sun Dec  2 23:28:27 mn_move: 1731
Sun Dec  2 23:28:27 mn_move: in home net
Sun Dec  2 23:28:27 mv_hoa: move HoA 2003:0:0:0:0:0:0:1/64 from iface 17 to 3
Sun Dec  2 23:28:27 md_update_router_stats: add coa 2003:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:28:28 md_update_router_stats: add coa 2003:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:28:31 md_update_router_stats: add coa 2003:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:28:33 md_update_router_stats: add coa 2003:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:28:35 md_update_router_stats: add coa 2003:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:28:37 md_expire_router: expiring router fe80:0:0:0:2c0:dfff:fee1:7011 on iface eth0 (3)
Sun Dec  2 23:28:40 __md_discover_router: discover link on iface eth0 (3)
Sun Dec  2 23:28:44 __md_discover_router: discover link on iface eth0 (3)
Sun Dec  2 23:28:44 md_change_default_router: add new router fe80:0:0:0:2d0:b7ff:feb2:14c1 on interface eth0 (3)
Sun Dec  2 23:28:44 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:28:45 mn_move: 1731
Sun Dec  2 23:28:45 mn_move: in foreign net
Sun Dec  2 23:28:45 mv_hoa: move HoA 2003:0:0:0:0:0:0:1/128 from iface 3 to 17
Sun Dec  2 23:28:45 mn_send_home_bu: 783
Sun Dec  2 23:28:45 mn_get_home_lifetime: CoA lifetime 2591998 s, HoA lifetime 11988 s, BU lifetime 11988 s
Sun Dec  2 23:28:45 mn_ro_pol_add: Adding default RO triggering policies for all Correspondent Nodes
Sun Dec  2 23:28:45 process_first_home_bu: New bule for HA
Sun Dec  2 23:28:45 bul_add: Adding bule
== BUL_ENTRY ==
Home address    2003:0:0:0:0:0:0:1
Care-of address 2006:0:0:0:216:d3ff:fe32:c6aa
CN address      2003:0:0:0:0:0:0:2
 lifetime = 11988,  delay = 1500
 flags: IP6_MH_BU_HOME IP6_MH_BU_ACK
Sun Dec  2 23:28:45 mn_send_home_bu: New bule for HA
Sun Dec  2 23:28:45 mh_send: sending MH type 5
from 2003:0:0:0:0:0:0:1
to 2003:0:0:0:0:0:0:2
Sun Dec  2 23:28:45 mh_send: local CoA 2006:0:0:0:216:d3ff:fe32:c6aa
Sun Dec  2 23:28:45 bul_update_timer: Updating timer
== BUL_ENTRY ==
Home address    2003:0:0:0:0:0:0:1
Care-of address 2006:0:0:0:216:d3ff:fe32:c6aa
CN address      2003:0:0:0:0:0:0:2
 lifetime = 11988,  delay = 1500
 flags: IP6_MH_BU_HOME IP6_MH_BU_ACK
Sun Dec  2 23:28:45 dump_migrate: ifindex       17
Sun Dec  2 23:28:45 dump_migrate: hoa   2003:0:0:0:0:0:0:1
Sun Dec  2 23:28:45 dump_migrate: ha    2003:0:0:0:0:0:0:2
Sun Dec  2 23:28:45 dump_migrate: ipsec ESP
Sun Dec  2 23:28:45 dump_migrate: ifindex       17
Sun Dec  2 23:28:45 dump_migrate: hoa   2003:0:0:0:0:0:0:1
Sun Dec  2 23:28:45 dump_migrate: ha    2003:0:0:0:0:0:0:2
Sun Dec  2 23:28:45 dump_migrate: ocoa  2003:0:0:0:0:0:0:1
Sun Dec  2 23:28:45 dump_migrate: ncoa  2006:0:0:0:216:d3ff:fe32:c6aa
Sun Dec  2 23:28:45 dump_migrate: ipsec ESP
Sun Dec  2 23:28:45 tunnel_mod: modifying tunnel 17 end points with from 2006:0:0:0:216:d3ff:fe32:c6aa to 2003:0:0:0:0:0:0:2
Sun Dec  2 23:28:45 __tunnel_mod: modified tunnel iface ip6tnl1 (17)from 2006:0:0:0:216:d3ff:fe32:c6aa to 2003:0:0:0:0:0:0:2
Sun Dec  2 23:28:46 mn_recv_ba: 1029
Sun Dec  2 23:28:46 mn_recv_ba: Got BA from 2003:0:0:0:0:0:0:2 to home address 2003:0:0:0:0:0:0:1 with coa 2006:0:0:0:216:d3ff:fe32:c6aa and status 0
Sun Dec  2 23:28:46 mn_recv_ba: Dumping corresponding BULE
== BUL_ENTRY ==
Home address    2003:0:0:0:0:0:0:1
Care-of address 2006:0:0:0:216:d3ff:fe32:c6aa
CN address      2003:0:0:0:0:0:0:2
 lifetime = 11988,  delay = 1500
 flags: IP6_MH_BU_HOME IP6_MH_BU_ACK
Sun Dec  2 23:28:46 mpd_schedule_first_mps: schedule MPS in 2 s
Sun Dec  2 23:28:46 set_bule_lifetime: Set bule lifetime to 11988 (s) and resend to bule->delay 11388 (s)
Sun Dec  2 23:28:46 mn_recv_ba: Callback to bu_refresh after 11388 seconds
Sun Dec  2 23:28:46 bul_update_timer: Updating timer
== BUL_ENTRY ==
Home address    2003:0:0:0:0:0:0:1
Care-of address 2006:0:0:0:216:d3ff:fe32:c6aa
CN address      2003:0:0:0:0:0:0:2
 lifetime = 11988,  delay = 11388000
 flags: IP6_MH_BU_HOME IP6_MH_BU_ACK
Sun Dec  2 23:28:48 mpd_schedule_first_mps: schedule MPS in 10797 s
Sun Dec  2 23:28:54 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:28:57 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:29:01 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:29:06 mn_start_ro: MN: Start RO to 2005:0:0:0:0:0:0:5, from 2003:0:0:0:0:0:0:1
Sun Dec  2 23:29:06 bul_add: Adding bule
== BUL_ENTRY ==
Home address    2003:0:0:0:0:0:0:1
Care-of address 2006:0:0:0:216:d3ff:fe32:c6aa
CN address      2005:0:0:0:0:0:0:5
 lifetime = 210,  delay = 210000
 flags:
Sun Dec  2 23:29:06 rrl_get: 2003:0:0:0:0:0:0:1
Sun Dec  2 23:29:06 rrl_get: 2005:0:0:0:0:0:0:5
Sun Dec  2 23:29:06 rre_create: 2003:0:0:0:0:0:0:1
Sun Dec  2 23:29:06 rre_create: 2005:0:0:0:0:0:0:5
Sun Dec  2 23:29:06 mn_rr_cond_start_hot: Home keygen token not valid, send HoTI
Sun Dec  2 23:29:06 mh_send: sending MH type 1
from 2003:0:0:0:0:0:0:1
to 2005:0:0:0:0:0:0:5
Sun Dec  2 23:29:06 rrl_get: 2006:0:0:0:216:d3ff:fe32:c6aa
Sun Dec  2 23:29:06 rrl_get: 2005:0:0:0:0:0:0:5
Sun Dec  2 23:29:06 rre_create: 2006:0:0:0:216:d3ff:fe32:c6aa
Sun Dec  2 23:29:06 rre_create: 2005:0:0:0:0:0:0:5
Sun Dec  2 23:29:06 mn_rr_cond_start_cot: Care-of keygen token not valid, send CoTI
Sun Dec  2 23:29:06 mh_send: sending MH type 2
from 2006:0:0:0:216:d3ff:fe32:c6aa
to 2005:0:0:0:0:0:0:5
Sun Dec  2 23:29:06 rrl_get: 2003:0:0:0:0:0:0:1
Sun Dec  2 23:29:06 rrl_get: 2005:0:0:0:0:0:0:5
Sun Dec  2 23:29:06 rrl_get: 2006:0:0:0:216:d3ff:fe32:c6aa
Sun Dec  2 23:29:06 rrl_get: 2005:0:0:0:0:0:0:5
Sun Dec  2 23:29:06 mn_recv_hot: Still waiting for CoT, not sending BU
Sun Dec  2 23:29:06 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:29:09 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:29:11 mh_send: sending MH type 2
from 2006:0:0:0:216:d3ff:fe32:c6aa
to 2005:0:0:0:0:0:0:5
Sun Dec  2 23:29:17 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:29:21 mh_send: sending MH type 2
from 2006:0:0:0:216:d3ff:fe32:c6aa
to 2005:0:0:0:0:0:0:5
Sun Dec  2 23:29:24 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:29:29 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:29:37 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:29:41 mh_send: sending MH type 2
from 2006:0:0:0:216:d3ff:fe32:c6aa
to 2005:0:0:0:0:0:0:5
Sun Dec  2 23:29:46 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:29:56 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:30:01 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:30:04 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:30:13 mh_send: sending MH type 2
from 2006:0:0:0:216:d3ff:fe32:c6aa
to 2005:0:0:0:0:0:0:5
Sun Dec  2 23:30:14 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:30:21 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:30:28 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:30:38 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:30:41 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:30:45 mh_send: sending MH type 2
from 2006:0:0:0:216:d3ff:fe32:c6aa
to 2005:0:0:0:0:0:0:5
Sun Dec  2 23:30:50 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:30:58 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
Sun Dec  2 23:31:02 md_update_router_stats: add coa 2006:0:0:0:216:d3ff:fe32:c6aa on interface (3)
mip6d[9575]: terminated (SIGINT)
Sun Dec  2 23:31:05 terminate: got SIGINT, exiting
Sun Dec  2 23:31:05 flag_hoa: set HoA 2003:0:0:0:0:0:0:1/128 iif 17 flags 80 preferred_time 4294967295 valid_time 4294967295
Sun Dec  2 23:31:05 mh_send: sending MH type 5
from 2003:0:0:0:0:0:0:1
to 2003:0:0:0:0:0:0:2
Sun Dec  2 23:31:05 mh_send: local CoA 2006:0:0:0:216:d3ff:fe32:c6aa
Sun Dec  2 23:31:05 mn_pol_ext_cleanup:
Sun Dec  2 23:31:05 mpd_cancel_mps: canceling MPS
Sun Dec  2 23:31:05 mn_ro_pol_del: Deleting default RO triggering policies for all Correspondent Nodes
Sun Dec  2 23:31:05 dump_migrate: ifindex       17
Sun Dec  2 23:31:05 dump_migrate: hoa   2003:0:0:0:0:0:0:1
Sun Dec  2 23:31:05 dump_migrate: ha    2003:0:0:0:0:0:0:2
Sun Dec  2 23:31:05 dump_migrate: ocoa  2006:0:0:0:216:d3ff:fe32:c6aa
Sun Dec  2 23:31:05 dump_migrate: ncoa  2003:0:0:0:0:0:0:1
Sun Dec  2 23:31:05 dump_migrate: ipsec ESP
Sun Dec  2 23:31:05 dump_migrate: ifindex       17
Sun Dec  2 23:31:05 dump_migrate: hoa   2003:0:0:0:0:0:0:1
Sun Dec  2 23:31:05 dump_migrate: ha    2003:0:0:0:0:0:0:2
Sun Dec  2 23:31:05 dump_migrate: ipsec ESP
Sun Dec  2 23:31:05 bul_delete: Deleting bule
== BUL_ENTRY ==
Home address    2003:0:0:0:0:0:0:1
Care-of address 2003:0:0:0:0:0:0:1
CN address      2003:0:0:0:0:0:0:2
 lifetime = 0,  delay = 11388000
 flags: IP6_MH_BU_HOME IP6_MH_BU_ACK
Sun Dec  2 23:31:05 rrl_get: 2003:0:0:0:0:0:0:1
Sun Dec  2 23:31:05 rrl_get: 2005:0:0:0:0:0:0:5
Sun Dec  2 23:31:05 mn_rr_cond_start_hot: Home keygen token valid, no HoTI
Sun Dec  2 23:31:05 Failed to del policy:
Sun Dec  2 23:31:05 sel.daddr 2003:0:0:0:0:0:0:1

no theVT i can see that the problem is with RR procedure:

mip6d> bul
== BUL_ENTRY ==
Home address    2003:0:0:0:0:0:0:1
Care-of address 2006:0:0:0:216:d3ff:fe32:c6aa
CN address      2003:0:0:0:0:0:0:2
 lifetime = 11988,  delay = 11388000
 flags: IP6_MH_BU_HOME IP6_MH_BU_ACK
 ack ready
 lifetime 11902 / 11988 seq 44312 resend 0 delay 11388(after 11302s)
 mps 10714 / 10797
== BUL_ENTRY ==
Home address    2003:0:0:0:0:0:0:1
Care-of address 2006:0:0:0:216:d3ff:fe32:c6aa
CN address      2005:0:0:0:0:0:0:5
 lifetime = 210,  delay = 210000
 flags:
 ack ready RR state started
 lifetime 145 / 210 seq 15010 resend 0 delay 210(after 145s)

mip6d> rr
== Return Routability Entry (HOT_ENTRY) ==
 HoA 2003:0:0:0:0:0:0:1
 CN  2005:0:0:0:0:0:0:5
 CoA 2006:0:0:0:216:d3ff:fe32:c6aa
 Interface ip6tnl1
 resend 0 delay 210 (after 141 seconds) expires in 140 seconds
== Return Routability Entry (COT_ENTRY) ==
 CoA 2006:0:0:0:216:d3ff:fe32:c6aa
 CN  2005:0:0:0:0:0:0:5
 HoA 2003:0:0:0:0:0:0:1
 Interface eth0
 resend 4 delay 32 (after 30 seconds) expires in -70 seconds

Why do I get the following error mn_recv_hot: Still waiting for CoT, not sending BU ?
Best regards
Michal