Strange issue with IPv6 through ipsec

Strange issue with IPv6 through ipsec

[Niccolò Belli]

Hi,
I'm not sure if netdev is the right place, that's a strange behavior but 
I'm not sure if it's a bug because I'm an IPv6 newbie.

I'd like to give my servers IPv6 connectivity for the World IPv6 Launch, 
so I bought a virtual machine with IPv6 connectivity and I asked to 
route a /56, then I extruded it through an IKEv2 ipsec tunnel 
(Strongswan 4.5.3 on Debian Squeeze amd64).

A is the virtual machine with IPv6 connectivity.
B is the other peer.
A has IPv6 a:b:c:d::1/64
The routed subnet is a:b:c:300::/56

After the tunnel creation I add an IPv6 to B external interface:
ip -6 addr add a:b:c:301::1/6 dev nas0
Then I create a default route:
ip -6 route add default via a:b:c:0301::2 dev nas0

Now I can ping A from B and B from A.
If I destroy and re-create the tunnel everything keep working.

If instead of adding an IPv6 to nas0 I add it to eth0 (an internal 
interface):
ip -6 addr add a:b:c:301::1/6 dev eth0
ip -6 route add default via a:b:c:0301::2 dev eth0

it still works (A con ping B and B can ping A) *BUT* if I destroy and 
re-create the tunnel it doesn't work anymore!
I have to type:
ip -6 addr del a:b:c:301::1/6 dev eth0
ip -6 addr add a:b:c:301::1/6 dev eth0
ip -6 route add default via a:b:c:0301::2 dev eth0

to make it work again O_O

Cheers,
Niccolò

Re: Strange issue with IPv6 through ipsec

[Niccolò Belli]

Il 01/03/2012 00:43, Niccolò Belli ha scritto:
> ip -6 addr add a:b:c:301::1/6 dev nas0

That's obviously /64.

Re: Strange issue with IPv6 through ipsec

[Niccolò Belli]

Sorry for the dumb question, it isn't a bug and I found the answer using 
dcpdump:

listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
14:09:40.891358 IP6 a:b:c:301::1 > ff02::1:ff00:2: ICMP6, neighbor 
solicitation, who has a:b:c:301::2, length 32
14:09:40.891708 IP6 a:b:c:301::2 > a:b:c:301::1: ICMP6, neighbor 
advertisement, tgt is a:b:c:301::2, length 32
14:09:40.891727 IP6 a:b:c:301::1 > a:b:c:301::2: ICMP6, echo request, 
seq 1, length 64
14:09:40.891778 IP6 a:b:c:301::2 > a:b:c:301::1: ICMP6, echo reply, seq 
1, length 64
14:09:41.887406 IP6 a:b:c:301::1 > a:b:c:301::2: ICMP6, echo request, 
seq 2, length 64
14:09:41.887478 IP6 a:b:c:301::2 > a:b:c:301::1: ICMP6, echo reply, seq 
2, length 64
14:09:42.887391 IP6 a:b:c:301::1 > a:b:c:301::2: ICMP6, echo request, 
seq 3, length 64
14:09:42.887440 IP6 a:b:c:301::2 > a:b:c:301::1: ICMP6, echo reply, seq 
3, length 64
14:09:43.886647 IP6 a:b:c:301::1 > a:b:c:301::2: ICMP6, echo request, 
seq 4, length 64
14:09:43.886716 IP6 a:b:c:301::2 > a:b:c:301::1: ICMP6, echo reply, seq 
4, length 64
14:09:44.886636 IP6 a:b:c:301::1 > a:b:c:301::2: ICMP6, echo request, 
seq 5, length 64
14:09:44.886687 IP6 a:b:c:301::2 > a:b:c:301::1: ICMP6, echo reply, seq 
5, length 64
14:09:45.886651 IP6 a:b:c:301::1 > a:b:c:301::2: ICMP6, echo request, 
seq 6, length 64
14:09:45.886722 IP6 a:b:c:301::2 > a:b:c:301::1: ICMP6, echo reply, seq 
6, length 64
14:09:45.889830 IP6 fe80::211:d8ff:fed9:c01a > a:b:c:301::1: ICMP6, 
neighbor solicitation, who has a:b:c:301::1, length 32
14:09:45.889866 IP6 a:b:c:301::1 > fe80::211:d8ff:fed9:c01a: ICMP6, 
neighbor advertisement, tgt is a:b:c:301::1, length 24


I simply had to passthrough multicast link-local traffic.

I'm sorry but I'm really newbie to IPv6 :(

Regards,
Niccolò