From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stephen Clark Subject: Re: ipsec tunnel with different inner and outer ip families Date: Fri, 13 Jan 2012 09:04:53 -0500 Message-ID: <4F103A05.3050802@earthlink.net> References: Reply-To: sclark46-ihVZJaRskl1bRRN4PJnoQQ@public.gmane.org Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6235668505110760934==" Cc: ipsec-tools-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org, netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: "Prashant Batra (prbatra)" Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ipsec-tools-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org List-Id: netdev.vger.kernel.org This is a multi-part message in MIME format. --===============6235668505110760934== Content-Type: multipart/alternative; boundary="------------070809070700020809070200" This is a multi-part message in MIME format. --------------070809070700020809070200 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Hi, I couldn't get it to work either. So I made and ipv4 in ipv6 tunnel, then did an ipv4 to ipv4 ipsec tunnel inside of ipv4-in-ipv6 tunnel. Then gre inside of ipv4 ipsec tunnel so I could run OSPF - works great. HTH, Steve On 01/13/2012 02:11 AM, Prashant Batra (prbatra) wrote: > > Hello, > > Does linux 2.6.* support an IPSec tunnel with different family of > inner and outer addresses , like v4 in v6 or v6 in v4. > > After trying ip xfrm * from user space, the utility doesn't seem to > accept two different families in a single command. > > #ip xfrm policy add dir out src 172.168.68.1/32 dst 172.168.68.2/32 > tmpl src 2001:db8:0:242::36/128 dst 2001:db8:0:242::37/128 proto esp > mode tunnel > > Error: an inet prefix is expected rather than "2001:db8:0:242::36/128". > > So, I tried sending a NETLINK SPD add message) from user space with, > selector as v4 addresses and tmpl as v6 address. > > Policy got added but kernel doesn't seem to be interpreting the > addresses correctly. > > src 172.16.80.1/32 dst 0.0.0.0/0 > > dir out priority 1024 > > tmpl src 32.1.13.184 dst 32.1.13.184 /* I gave ipv6 > addresses here*/ > > proto esp spi 0x00000000 reqid 0 mode tunnel > > Can someone help me with this? > > Regards, > > Prashant. > > > ------------------------------------------------------------------------------ > RSA(R) Conference 2012 > Mar 27 - Feb 2 > Save $400 by Jan. 27 > Register now! > http://p.sf.net/sfu/rsa-sfdev2dev2 > > > _______________________________________________ > Ipsec-tools-devel mailing list > Ipsec-tools-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org > https://lists.sourceforge.net/lists/listinfo/ipsec-tools-devel > -- "They that give up essential liberty to obtain temporary safety, deserve neither liberty nor safety." (Ben Franklin) "The course of history shows that as a government grows, liberty decreases." (Thomas Jefferson) --------------070809070700020809070200 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Hi,

I couldn't get it to work either. So I made and ipv4 in ipv6 tunnel, then did an ipv4 to ipv4 ipsec tunnel inside of ipv4-in-ipv6 tunnel.
Then gre inside of ipv4 ipsec tunnel so I could run OSPF - works great.

HTH,
Steve

On 01/13/2012 02:11 AM, Prashant Batra (prbatra) wrote:

Hello,

 

Does linux 2.6.* support an IPSec tunnel with different family of inner and outer addresses , like v4 in v6 or v6 in v4.

After trying ip xfrm * from user space, the utility doesn’t seem to accept two different families in a single command.

 

#ip xfrm policy add dir out src 172.168.68.1/32 dst 172.168.68.2/32 tmpl src 2001:db8:0:242::36/128 dst 2001:db8:0:242::37/128 proto esp  mode tunnel

Error: an inet prefix is expected rather than "2001:db8:0:242::36/128".

 

So, I tried sending a NETLINK SPD add message) from user space with, selector as v4 addresses and tmpl as v6 address.

Policy got added but kernel doesn’t seem to be interpreting the addresses correctly.

 

src 172.16.80.1/32 dst 0.0.0.0/0

        dir out priority 1024

        tmpl    src 32.1.13.184 dst 32.1.13.184   /* I gave ipv6 addresses here*/

                proto esp spi 0x00000000 reqid 0 mode tunnel

 

Can someone help me with this?

 

Regards,

Prashant.


------------------------------------------------------------------------------
RSA(R) Conference 2012
Mar 27 - Feb 2
Save $400 by Jan. 27
Register now!
http://p.sf.net/sfu/rsa-sfdev2dev2

_______________________________________________
Ipsec-tools-devel mailing list
Ipsec-tools-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/ipsec-tools-devel
  


-- 

"They that give up essential liberty to obtain temporary safety, 
deserve neither liberty nor safety."  (Ben Franklin)

"The course of history shows that as a government grows, liberty 
decreases."  (Thomas Jefferson)
--------------070809070700020809070200-- --===============6235668505110760934== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ RSA(R) Conference 2012 Mar 27 - Feb 2 Save $400 by Jan. 27 Register now! http://p.sf.net/sfu/rsa-sfdev2dev2 --===============6235668505110760934== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============6235668505110760934==--