ゆうちくりんの忘却禄

IPv4の場合は問題なくつながるのだが、IPv6を使用してのIPsec接続がうまく動かない……
なぜ接続出来ないのかがまったくわからん！！(-_-;)

Linuxで駄目ならFreeBSDでもインストールしてみるか……あ～面倒～

未だにもがき続けているのわけですが……
どうもこれはカーネル（Linux-2.6.18.2を使用）のバグ？みたいですね～

通常のPING6のやり取りの場合、下記のような感じになるのですが。

17:03:41.630200 IP6 2001::c0a8:ca04 > ff02::1:ffa8:ca05: ICMP6, neighbor solicitation, who has 2001::c0a8:ca05, length 32
17:03:41.630508 IP6 2001::c0a8:ca05 > 2001::c0a8:ca04: ICMP6, neighbor advertisement, tgt is 2001::c0a8:ca05, length 32
17:03:41.630772 IP6 2001::c0a8:ca04 > 2001::c0a8:ca05: ICMP6, echo request, seq 1, length 64
17:03:41.630976 IP6 2001::c0a8:ca05 > 2001::c0a8:ca04: ICMP6, echo reply, seq 1, length 64

IPsecを設定すると、下記のようになります。

16:57:33.790862 IP6 2001::c0a8:ca04 > ff02::1:ffa8:ca05: ICMP6, neighbor solicitation, who has 2001::c0a8:ca05, length 32
16:57:33.841848 IP6 2001::c0a8:ca05.isakmp > 2001::c0a8:ca04.isakmp: isakmp: phase 1 I ident
16:57:34.790794 IP6 2001::c0a8:ca04 > ff02::1:ffa8:ca05: ICMP6, neighbor solicitation, who has 2001::c0a8:ca05, length 32
16:57:35.790793 IP6 2001::c0a8:ca04 > ff02::1:ffa8:ca05: ICMP6, neighbor solicitation, who has 2001::c0a8:ca05, length 32
16:57:38.838886 IP6 fe80::280:6dff:fe71:5f2 > 2001::c0a8:ca04: ICMP6, neighbor solicitation, who has 2001::c0a8:ca04, length 32
16:57:38.839122 IP6 2001::c0a8:ca04 > fe80::280:6dff:fe71:5f2: ICMP6, neighbor advertisement, tgt is 2001::c0a8:ca04, length 24
16:57:43.838795 IP6 fe80::280:6dff:fe71:528 > fe80::280:6dff:fe71:5f2: ICMP6, neighbor solicitation, who has fe80::280:6dff:fe71:5f2, length 32
16:57:43.839183 IP6 fe80::280:6dff:fe71:5f2 > fe80::280:6dff:fe71:528: ICMP6, neighbor advertisement, tgt is fe80::280:6dff:fe71:5f2, length 24
16:57:43.849833 IP6 2001::c0a8:ca05.isakmp > 2001::c0a8:ca04.isakmp: isakmp: phase 1 I ident
16:57:48.838714 IP6 fe80::280:6dff:fe71:5f2 > fe80::280:6dff:fe71:528: ICMP6, neighbor solicitation, who has fe80::280:6dff:fe71:528, length 32
16:57:48.838920 IP6 fe80::280:6dff:fe71:528 > fe80::280:6dff:fe71:5f2: ICMP6, neighbor advertisement, tgt is fe80::280:6dff:fe71:528, length 24
16:57:53.853684 IP6 2001::c0a8:ca05.isakmp > 2001::c0a8:ca04.isakmp: isakmp: phase 1 I ident
16:58:03.861527 IP6 2001::c0a8:ca05.isakmp > 2001::c0a8:ca04.isakmp: isakmp: phase 1 I ident
16:58:13.871794 IP6 2001::c0a8:ca05.isakmp > 2001::c0a8:ca04.isakmp: isakmp: phase 1 I ident
16:58:18.870044 IP6 fe80::280:6dff:fe71:5f2 > 2001::c0a8:ca04: ICMP6, neighbor solicitation, who has 2001::c0a8:ca04, length 32
16:58:18.870244 IP6 2001::c0a8:ca04 > fe80::280:6dff:fe71:5f2: ICMP6, neighbor advertisement, tgt is 2001::c0a8:ca04, length 24
16:58:23.866783 IP6 fe80::280:6dff:fe71:528 > fe80::280:6dff:fe71:5f2: ICMP6, neighbor solicitation, who has fe80::280:6dff:fe71:5f2, length 32
16:58:23.867116 IP6 fe80::280:6dff:fe71:5f2 > fe80::280:6dff:fe71:528: ICMP6, neighbor advertisement, tgt is fe80::280:6dff:fe71:5f2, length 24
16:58:23.884125 IP6 2001::c0a8:ca05.isakmp > 2001::c0a8:ca04.isakmp: isakmp: phase 1 I ident
16:58:28.865880 IP6 fe80::280:6dff:fe71:5f2 > fe80::280:6dff:fe71:528: ICMP6, neighbor solicitation, who has fe80::280:6dff:fe71:528, length 32
16:58:28.866074 IP6 fe80::280:6dff:fe71:528 > fe80::280:6dff:fe71:5f2: ICMP6, neighbor advertisement, tgt is fe80::280:6dff:fe71:528, length 24

内容を見る限り、アドレスの問い合わせを送信しているが、応答がユニキャスト宛になるからIPsecが接続されていないと送信できないよ～な感じ……まさに、鶏と卵のような関係！！(ーー;)

確かに、ポリシー的にはユニキャスト宛はIPsecを通るように設定しているので、まさにその通りなのだが……これでいいのか？それともなんか設定があるの？(T_T)

USAGIが2.6.18にアップされるまで待つか……ふぅ～(^。^)y-.。o○

やっとこさ、一部の動作確認が出来ました！！(^。^)y-.。o○

トランスポートモードで、試していたのですがどうしても動作しなくて……どうせ使うのはトンネルモードだけだろう！っと言う事で、トンネルモードで試してみたら動作しました。(^^ゞ

しかし、トランスポートモードでは動作していません……(T_T)

トンネルモード・事前共有鍵の設定をwikiに追記しました。
http://www.youchikurin.com/wiki/index.php?IpsecTools#m63885fa