Have anyone success to setup ipsec with ipv6 in QNX ?
I use QNX 6.3.0 with extended TDK networking (which allows to have ipv6 + ipsec cabability). I was able to enable ipv6 for 2 qnx hosts and use ping6, telnet to test. Ipv6 seems to work properly. Then I try to test ipsec for ipv4. The setup is very simple. Host 1 (10.10.16.88) have the follow keys string:
flush;
spdflush;
add 10.10.16.88 10.10.20.64 esp 9998 -E des-cbc “hogehoge” ;
add 10.10.20.64 10.10.16.88 esp 9999 -E des-cbc “hogehoge” ;
spdadd 10.10.16.88 10.10.20.64 any -P out ipsec esp/transport//use;
spddump;
dump esp;
and host 2(10.10.20.64) use the keys strings
flush;
spdflush;
add 10.10.16.88 10.10.20.64 esp 9998 -E des-cbc “hogehoge” ;
add 10.10.20.64 10.10.16.88 esp 9999 -E des-cbc “hogehoge” ;
spdadd 10.10.20.64 10.10.16.88 any -P out ipsec esp/transport//use;
spddump;
dump esp;
After setup. the ping and telnet work as expected, the packet exchange between 2 host contain ESP header. (use ethereal to capture packet)
However. if I replace ipv4 address with ipv6 address as follow:
for host1 (fe80::1825:99ff:fe84:3485):
flush;
spdflush;
add fe80::220:22ff:fe32:4200 fe80::1825:99ff:fe84:3485
esp 9998 -E des-cbc “hogehoge” ;
add fe80::1825:99ff:fe84:3485 fe80::220:22ff:fe32:4200
esp 9999 -E des-cbc “hogehoge” ;
spdadd fe80::1825:99ff:fe84:3485 fe80::220:22ff:fe32:4200
any -P out ipsec esp/transport//use;
spddump;
dump esp;
and for host2:
flush;
spdflush;
add fe80::220:22ff:fe32:4200 fe80::1825:99ff:fe84:3485
esp 9998 -E des-cbc “hogehoge” ;
add fe80::1825:99ff:fe84:3485 fe80::220:22ff:fe32:4200
esp 9999 -E des-cbc “hogehoge” ;
spdadd fe80::220:22ff:fe32:4200 fe80::1825:99ff:fe84:3485
any -P out ipsec esp/transport//use;
spddump;
dump esp;
Then try to use ping6, the packet exchange between to host contain no ESP.
If I force the policy by replace the “use” to “require” and add src-dst after transport key.
<Host 1 setkey>:
flush;
spdflush;
add fe80::220:22ff:fe32:4200 fe80::1825:99ff:fe84:3485
esp 9998 -E des-cbc “hogehoge” ;
add fe80::1825:99ff:fe84:3485 fe80::220:22ff:fe32:4200
esp 9999 -E des-cbc “hogehoge” ;
spdadd fe80::1825:99ff:fe84:3485 fe80::220:22ff:fe32:4200 any -P out ipsec
esp/transport/fe80::1825:99ff:fe84:3485-fe80::220:22ff:fe32:4200/require;
spddump;
dump esp;
I test with ping6 and telnet without success. communication failed.
please advice.
Thanks