(usagi-users 03849) Re: IPv6 with Ipsec and Racoon issue

I think your solution depends on handling the ND Advertisement from host
B. I do not know what you mean by "show of neighbors ... FAILED". And I do
not know Racoon either. So, my advice is limited to ND areas.

I suspect Racoon is depending on the kernal's IP cache to get host B's
MAC. That forces you to trigger an update of that cache since the OS
purges stale info I think every 60 seconds.

A laborious alternative is rolling your own ND Solicitation packet sender
and ND Advertisement sniffer to get targeted host MACs.  Then you are
independant of the OS IP cache.

Let me mention again, ND (Neighbor Discovery) brings new network security
issues to the table to be addressed as IPv6 usage moves forward.

Michael

[ Message from: Philip Bellino  ]
> Michael,
> The answers to your questions:
> Your host A, the ND message it sends, is it a ND Solicitation message?
> Yes.
> Does host B respond with the ND Advertisement and do you process it?
> Yes, but a show of the neighbors has it as "FAILED".
>
> Thanks,
> Phil Bellino
>
> -----Original Message-----
> From: Michael Rose [mailto:[email protected]]
> Sent: Wednesday, May 16, 2007 11:58 AM
> To: Philip Bellino
> Cc: [email protected]
> Subject: Re: (usagi-users 03846) IPv6 with Ipsec and Racoon issue
>
> Neighbor Discovery is used by ping6 to obtain the MAC of a remote host
> before pings begin. Once it runs, host A has host B MAC in network cache
> for other programs to use.
>
> Your host A, the ND message it sends, is it a ND Solicitation message?
> Yes.
> Does host B respond with the ND Advertisement and do you process it?
> Yes
>
> IPv6 depends on Neighbor Discovery for MAC addresses which is a security
> issue.
>
> Michael
>
> [ Message from: Philip Bellino  ]
>> Hello,
>>
>> I know this may not be the forum to ask this question, but I am haivng
>
>> no luck on finding out if there is a solution to the problem stated
>> below.  I am looking to see if anyone from this group has seen this
>> issue:
>>
>>
>> Running ipsec-tools-0.6.7 on a Linux client and host.
>> I use Racoon with pre-shared keys and Security Policies with ESP/AHs
>> configured for IPv4 and IPv6.
>>
>> There is no problem with IPv4.
>>
>> I see a chicken and the egg problem with IPv6.
>>
>> An ICMPv6 Neighbor Solicitation goes from Host A to Host B.  This is
>> o.k. because it is not subject to IPsec.
>> The ICMPv6 Neighbor Discovery from Host B is not o.k. because since
>> there exists a SP that requires ESP/AH, it triggers an SA negotiation.
>> So, it looks like a loop is created and the result is that it does not
>
>> work.
>>
>> I have tried adding in:
>> spdadd ::/0 ::/0 icmp6 -P out none;
>> spdadd ::/0 ::/0 icmp6 -P in none;
>>
>> And although the icmps are now not subject to IPsec, I still get the
>> "phase1 negotiation" failure  in Racoon.
>>
>> The only way (besides not using Racoon and manually adding keyed SA's)
>
>> is the following:
>> 1.  Stop the Racoon daemons flush/spdflush all the SAs and SPDs 2.
>> Issue a ping6.
>> 3.  Re-issue the SPDs.
>> 4.  Start Racoon.
>>
>> Does anyone know of a permanent solution to this issue?
>>
>> Thanks,
>> Phil Bellino
>>
>>
>> ============================
>> Phil Bellino
>> MRV Communications, Inc.
>> Boston Product Division
>> 295 Foster St.
>> Littleton,MA 01460
>> Tel: (978)952-4807
>> Email: [email protected]
>> ============================
>>
>>
>
>
>
>