<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<meta name="Generator" content="Zarafa WebAccess v7.1.4-41394">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Securing dual-stack IPv4-IPv6?</title>
<style type="text/css">
body
{
font-family: Arial, Verdana, Sans-Serif ! important;
font-size: 12px;
padding: 5px 5px 5px 5px;
margin: 0px;
border-style: none;
background-color: #ffffff;
}
p, ul, li
{
margin-top: 0px;
margin-bottom: 0px;
}
</style>
</head>
<body>
<div><p>Hi,</p><p> </p><p>I'm trying to figure out how to use IPsec with dual-stack IPv4/IPv6 connections. For some reason, on my system, only either IPv4 or IPv6, but not both, will have IPsec enabled.</p><p> </p><p>This is on Centos 6.4, openswan-2.6.32-20.el6_4.x86_64</p><p> </p><p>I'm using transport mode,</p><p> </p><p>One clue I have is that the remote side says that it can't install the eroute for IPv6 because it is already in use for IPv4:</p><p> </p><p>May 26 16:15:19 remote pluto[15412]: "myfqdn-6": cannot install eroute -- it is in use for "myfqdn-4" #0<br /> </p><p>(I think it is random chance whether the error occurs for the IPv6 or IPv4 connection).</p><p> </p><p> </p><p>I am using the following ipsec.conf:</p><p> </p><p>version 2.0 # conforms to second version of ipsec.conf specification<br /><br /># basic configuration<br />config setup<br /> protostack=netkey<br /> nat_traversal=yes<br /> virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.168.2.0/24<br /> oe=off<br /><br />conn %default<br /> type=transport<br /> authby=rsasig<br /> rightrsasigkey=%cert<br /> rightid=%fromcert<br /><br /> left=myfqdn<br /> leftid=%fromcert<br /> leftcert=myfqdn<br /><br /> pfs=yes<br /> aggrmode=no<br /> ike=3des-sha1-modp1536<br /> phase2=esp<br /> phase2alg=3des-sha1<br /> auto=start<br /> </p><p>conn otherfqdn-4<br /> connaddrfamily=ipv4<br /> right=otherfqdn<br /> rightcert=otherfqdn<br /><br />conn otherfqdn-6<br /> connaddrfamily=ipv6<br /> right=otherfqdn<br /> rightcert=otherfqdn<br /> </p></div>
</body>
</html>