Date: Mon, 23 Mar 2009 11:47:55 +0900
From: Hiroki ENDO <velo@tahi.org>
Subject: [users:01127] Re: issue about IKEv2 self test
To: users@tahi.org, szhou <szhou@redhat.com>
Message-Id: <20090323114755.d9ccf7ce.velo@tahi.org>
In-Reply-To: <49C1A40D.5040705@redhat.com>
References: <49C1A40D.5040705@redhat.com>
X-Mail-Count: 01127

Hi,

Self Test does not configure the NUT by default. Self Test configures
the TN automatically.
Currently, remote script for NUT configuration supports only racoon2
on FreeBSD. So you need to configure your NUT manually.

Please configure your NUT as Test Specification said.
Basically, default setup for End-Node is as follows:

NUT IKEv2 Address: 2001:db8:1:1:YOUR_IF_ID
NUT IKEv2 Port: 500
TN IKEv2 Address: 2001:db8:f:1::1/64
TN IKEv2 Port: 500
Authentication Method: Shared Key Message Integrity Code
Shared Key: IKETEST12345678!
NUT ID Type: ID_IPV6_ADDR:
NUT ID Data: 2001:db8:1:1:YOUR_IF_ID (same as NUT IKEv2 Address)
IKE_SA
        Encryption Algorithm: ENCR_3DES
        PRF: PRF_HMAC_SHA1
        Integrity Algorithm: AUTH_HMAC_SHA1_96
        Diffie-Hellman: 1024 MODP Group
CHILD_SA
        Security Protocol: ESP
        Transport Mode: transport mode (tunnel mode for SGW)
        Encryption Algorithm: ENCR_3DES
        Integrity Algorithm: AUTH_HMAC_SHA1_96
        ESN: No ESN
NUT SPD
        inbound
                src: 2001:db8:f:1::1 (2001:db8:f:2::/64 for SGW)
                dst: 2001:db8:1:1::1 (2001:db8:1:2::/64 for SGW)
                upper layer protocol: any
        outbound
                src: 2001:db8:1:1::1 (2001:db8:1:2::/64 for SGW)
                dst: 2001:db8:f:1::1 (2001:db8:f:2::/64 for SGW)
                upper layer protocol: any
And you use ping6 to 2001:db8:f:1::1 to initiate IKEv2 exchange,
when you are Initiator.

There might be many confusable and un-user-friendly points.
Please tell us the points for the future.

Thanks,