topic Re: IKEv2 IPv6 tunnel with dynamic endpoint from one IP in General Topics

IKEv2 IPv6 tunnel with dynamic endpoint from one IP

nikoo — Tue, 07 Jun 2022 05:39:30 GMT

With IPv4 it is possible to build multiple IPSec tunnels from one interface IP with dynamic/unknown destinations and separate them based on the IKE peer IDs. That configuration is accepted by the firewall.

As for IPv6, as soon as one source interface is used for multiple IPSec tunnel with dynamic peers, the following error is shown during commit:

• IKEv2 gateway CUSTOMER1-GW peer gateway address :: is not unique among gateways using local address xxxx:xxx:xx:x::2/64.(Module: ikemgr)
• IKEv2 gateway CUSTOMER2-GW peer gateway address :: is not unique among gateways using local address xxxx:xxx:xx:x::2/64.(Module: ikemgr)

As soon as source IPv6 for one of the tunnel is changed to a different one - commits succeeds.

This looks like a unnecessary limitation to me as IPv4 is accepting this configuration just fine.

Maybe not the most widely used configuration, but any input on this?

Re: IKEv2 IPv6 tunnel with dynamic endpoint from one IP

kiwi — Thu, 09 Jun 2022 07:56:28 GMT

Hi @nikoo ,

Looks like a missing feature. Please check with your account manager if it's something that's on the roadmap or have him create a feature request for you which you can then add your vote to.

Cheers,

-Kiwi.

Re: IKEv2 IPv6 tunnel with dynamic endpoint from one IP

BenjaminShirley — Tue, 16 Apr 2024 14:55:43 GMT

Noticed this aswell, I have a few branch sites where wanted to avoid NAT with IPSEC. Remote VPN endpoints are behind ISP provided routers which can only provide public IPv6 addresses to devices behind it.