(racoon 695) Re: Does racoon work with link local IPv6 addresses?

Juan Antonio,

	What happens if you remove interface names from "remote" and "sainfo" 
statements? As I understand, even without interface name these addresses 
are unique at least site-wide, therefore I expect this should not 
confuse racoon.

	If my suggestion is wrong in principle, please provide explanation.

Juan Antonio Martínez Navarro wrote:
> Hi Aidas,
> 
> Don't worry about it, you addressed to me right.
> 
> I was able to install racoon from cvs. Thank you ;)
> 
> But the problem related with the link local address isn't solved
> completely.
> 
> Although when I start up racoon i don't find any error, when I try to
> use link local address to establish the ipsec tunnel doing a ssh
> connection "ssh fe80::202:b3ff:fe60:206e%eth0" I get this result:
> 
> ------------------------------------------------------
> 2004-09-06 10:47:32: ERROR: no configuration found for
> fe80::202:b3ff:fe60:206e.
> 2004-09-06 10:47:32: ERROR: failed to begin ipsec sa negotication.
> ------------------------------------------------------
> 
> My racoon.conf is the next:
> -----------------------------------------------------
> 
> path pre_shared_key "/etc/racoon/psk.txt";
> 
> timer
> {
>         phase1  1min;
>         phase2  1min;
> }
> 
> remote fe80::202:b3ff:fe60:206e%eth0
> {
>         exchange_mode main;
>         proposal
>         {
>                 encryption_algorithm 3des;
>                 hash_algorithm md5;
>                 authentication_method pre_shared_key;
>                 dh_group 2;
>         }
> }
> 
> sainfo address fe80::202:b3ff:feb8:1857%eth0/128 tcp address
> fe80::202:b3ff:fe60:206e%eth0/128 tcp
> {
>         pfs_group 2;
>         lifetime time 12 hour;
>         encryption_algorithm 3des;
>         authentication_algorithm hmac_sha1, hmac_md5;
>         compression_algorithm deflate;
> }
> -----------------------------------------------------
> 
> and my setkey.conf is :
> -----------------------------------------------------
> # Flush the SAD and SPD entries
> flush;
> spdflush;
> 
> spdadd fe80::202:b3ff:feb8:1857%eth0/128
> fe80::202:b3ff:fe60:206e%eth0/128 tcp -P out ipsec
> esp/tunnel/fe80::202:b3ff:feb8:1857%eth0-fe80::202:b3ff:fe60:206e%eth0/require ;
> spdadd fe80::202:b3ff:fe60:206e%eth0/128
> fe80::202:b3ff:feb8:1857%eth0/128 tcp -P in ipsec
> esp/tunnel/fe80::202:b3ff:fe60:206e%eth0-fe80::202:b3ff:feb8:1857%eth0/require ;
> 
> -----------------------------------------------------
> 
> As you can see I've added the interface eth0 in every link local
> address. But in the log error you can't find this interface, so I think
> the error could be caused by don't using the interface in the link local
> address so it couldn't find any remote configuration for this address
> without interface. 
> 
> We've tried to remove the "%eth0" from configuration files but, we get a
> bind error.
> 
> El mié, 01-09-2004 a las 18:05, Aidas Kasparas escribió:
> 
>>Fix for this just went into ipsec-tools cvs. Please try cvs version and 
>>report back did it solve your problem.
>>
>>Juan Antonio Martínez Navarro wrote:
>>
>>>Hi everybody,
>>>
>>>I'm using racoon in a Linux (Kernel 2.6.7) and I'd like to know if it's
>>>possible to use the link local address. I'm not able to use it but I can
>>>use the global ipv6 address. When I start up racoon, this is the result
>>>it shows.
>>>
>>>----------------------------------------------------------------------
>>>Sep  1 13:26:47 pfc7 racoon: INFO: @(#)ipsec-tools 0.3.3
>>>(http://ipsec-tools.sourceforge.net)
>>>Sep  1 13:26:47 pfc7 racoon: INFO: @(#)This product linked OpenSSL
>>>0.9.7d 17 Mar 2004 (http://www.openssl.org/)
>>>Sep  1 13:26:47 pfc7 racoon: INFO: ::1[500] used as isakmp port (fd=7)
>>>Sep  1 13:26:47 pfc7 racoon: ERROR: failed to bind to address
>>>fe80::202:b3ff:feb8:1857%253[500] (No such device).
>>>Sep  1 13:26:47 pfc7 racoon: INFO:
>>>2001:720:1710:0:202:b3ff:feb8:1857[500] used as isakmp port (fd=8)
>>>Sep  1 13:26:47 pfc7 racoon: INFO: 127.0.0.1[500] used as isakmp port
>>>(fd=9)
>>>Sep  1 13:26:47 pfc7 racoon: INFO: 155.54.210.94[500] used as isakmp
>>>port (fd=10)
>>>
>>>------------------------------------------------------------------------
>>>
>>>I asked it a few months ago, I hope it has a solution.
>>>Thank you.
>>>
>>>
>>>
>>
>