#
# USAGI Linux/IPsec for IPv6
#
# $USAGI: IPsec,v 1.15.2.1.2.2 2003/02/14 00:27:31 miyazawa Exp $
#

USAGI's IPsec for IPv6 is based on FreeS/WAN-1.9 and IABG.

NOTE: We use cryptoapi (patch-int-2.4.17.0.bz2) as implementation
of cipher/digest algorithms.  However, several algorithms are not
included due to the patent/license issue.  If you want to use them,
you can copy it from patch-int-2.4.17.0.bz2 to linux24/crypto/cipher/, 
and comment out related part of cipher/{Config.in, Makefile}.

The removed files :
	cipher-blowfish.c cipher-dfc.c cipher-idea.c 
	cipher-mars.c cipher-serpent.c cipher-twofish.c

Table of Contents

	1. Current Status
	2. Building/Installing USAGI IPsec
	2.1 Building Kernel 
	2.2 Install the pfkey command
	3. Using USAGI IPsec
	3.1. Transport Mode
	3.1.1 Manually keyed
	3.1.1.1 Save, Restore and Show IPsec Configurations
	3.1.2. Using IKEd
	3.1.2.1 Using IKEd with manual configuration
	3.1.2.2 Using IKEd with configuration file and auto scripts
	3.2. Tunnel Mode
	3.2.1. Connection between two sites
        3.2.1.1. Sample Network Topology
        3.2.1.2. Setup Instruction (manually keyed)
	3.2.1.3. Using IKEd
	3.2.2. Connection from a host to Security Gateway
        3.2.1.1. Sample Network Topology
        3.2.1.2. Setup Instruction (manually keyed)
	4. Notice
	5. Debugging 
	6. References
	7. Acknowledgement


1. Current status:

	We support Transport mode AH/ESP manually keyed and using IKEd.
	We support also Tunnel mode AH/ESP manually keyed and using IKEd.

2. Building/Installing USAGI IPsec

2.1 Building Kernel 

	The recommended kernel configuration for IPsec is as follows:
	("<o>": indicates an optional setting)

	Cryptographic options  --->
		<*> CryptoAPI support
		<*> Crypto Ciphers
		--- 128 bit blocksize
		<*>  AES (aka Rijndael) cipher
		--- 64 bit blocksize
		<*>  DES cipher
		<*>  3DES cipher
		--- Deprecated
		<o>  DUMMY cipher (DEPRECATED)
		--- For IPsec only (ESP null)
		<*>  NULL cipher (EXPERIMENTAL)
		<*> Digest Algorithms
		<*>  MD5 digest
		<*>  SHA1 digest
	        < > Crypto Devices
	Networking options  --->
		[*]    The IPsec protocol (EXPERIMENTAL)
		[*]     IPsec: IPsec Debug messages
		[*]     IPsec: IPsec Debug disable Default
		<*/M>   The IPv6 protocol (EXPERIMENTAL)
		...
		[*]     IPv6: IP Security Support (EXPERIMENTAL)
		<M>	IPv6: IPv6 over IPv6 Tunneling (EXPERIMENTAL)

2.2 Install the pfkey command

	% cd ANYWHERE/usagi/usagi/pfkey
	% ./configure --with-linux-kernel=ANYWHERE/usagi/kernel/linux24
	  (default /usr/src/linux)
	(or if you use USAGI kit, pfkey command will be installed automatically.)
	% make
	% su
	# make install

2.3 Install pluto (IKEd)

	% cd ANYWHERE/usagi/usagi/pluto
	% ./configure
	% make
	% su
	# make install

	By default, then you can see commands in /usr/local/v6/sbin 
	and configuration file and key material file in /usr/local/v6/etc.
	We install _confread, _include, auto, ipsec, pluto, ranbits, 
	rsasigkey and whack in /usr/local/v6/sbin.
	We also install conf.eg and secrets.eg in /usr/local/v6/etc.

3. Using USAGI IPsec

	IPsec can be configured manually using the pfkey command or
	it can be configured dynamically through the IKE daemon, pluto.

	(Attention: YOU MUST AVOID USING WEAK KEY.)

3.1 Transport Mode

	Example Network Scenario:

	(Host A) ----------------- (Host B)
	3ffe:a:b:c:d::1            3ffe:a:b:c:d::2

	mode		: transport AH/ESP
	AH  algo	: hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
	ESP auth algo	: hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
	ESP enc algo	: 3des-cbc (key 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7)
	SPI 		: A -> B AH:0x1234 ESP:0x5678, B -> A AH:0x9abc ESP:0xdef0
	Protocol	: UDP

3.1.1 Manually keyed

	(SET Host A -> Host B flow at Host A)
	(SA for AH)  
	# pfkey -A sa -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 -T ah -S 0x1234 -p udp \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	(SA for ESP) 
	# pfkey -A sa -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 -T esp -S 0x5678 -p udp \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef \
		--esp 3des-cbc --espkey 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7

        (SP for AH) 
	# pfkey -A sp -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 -T ah -S 0x1234 -p udp 
	(SP for ESP) 
	# pfkey -A sp -s 3ffe:a:b:c:d::1 -d 3ffe:a:b:c:d::2 -T esp -S 0x5678 -p udp 

	(SET Host B -> Host A flow at Host A)
	(SA for AH) 
	# pfkey -A sa -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 -T ah -S 0x9abc -p udp \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	(SA for ESP)
	# pfkey -A sa -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 -T esp -S 0xdef0 -p udp \
		--auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef \
		--esp 3des-cbc --espkey 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7

	# pfkey -A sp -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 -T ah -S 0x9abc -p udp 
	# pfkey -A sp -d 3ffe:a:b:c:d::1 -s 3ffe:a:b:c:d::2 -T esp -S 0xdef0 -p udp 

	Now on Host B do the same as above:
	(SET Host A -> Host B flow at Host B)
	(SET Host B -> Host A flow at Host B)

	You can also use the following options with the pfkey command:

	- "pfkey -L" to display current SA/SP status.
	- "pfkey -F any" to flush all the SAs and SPs.
	- "pfkey -D ..." to delete an SA or SP entry.
	- "pfkey --help" to display more help information.

	(For easy manual testing, we provide a script "ipsec-set" in pfkey directory.)
	We recommend disabling Replay_Window_Check for manual keying.
	e.g. # sysctl -w net.ipsec.replay_window_check=0
	or
	     # echo 0 > /proc/sys/net/ipsec/replay_window_chek

3.1.1.1 Save, Restore and Show IPsec Configurations

	You can use "ipsec-conf" with 'save', 'restore', 
	'reset' and 'show' (some commands need a file name).

	When you have some IPsec configurations in your kernel, 
	you can see these configurations as follows.
	# ipsec-conf show
	and you can save the configurations to file as follows.
	# ipsec-conf save FILENAME

	When you have a IPsec configuration file which was saved by using "ipsec-conf save", 
	you can restore the configuration as follows.
	# ipsec-conf restore FILENAME

3.1.2 Using IKEd

	Difference between FreeS/WAN's pluto and USAGI's pluto
	- Default path for ipsec.conf is changed to /usr/local/v6/etc/ipsec.conf
	- Default path for ipsec.secrets which is authentication key file is changed to
		/usr/local/v6/etc/ipsec.secrets.
	- Our pluto never calls updown script.
        - Support for DES and 768bit MODP Group
        - Support for encryption padding as specified in RFC2409(Sec. 5.3)
        - Support for using the ESP encryption without ESP authentication
        - Change to the phase 1 transform order based on the strongest
          encryption first, then the strongest group, then the strongest 
          authentication
        - Change to the phase 2 proposal/transform generation to include 
          more proposal choices and transform choices.
        - Support for USAGI IPsec tunnel/transport mode.

3.1.2.1 Using IKEd with manual configuration

	The two commands to use IKE are, "pluto" and "whack".
	pluto is a daemon that runs the IKE protocol.
	whack is a command used to communicate with a running pluto.

	1). See manual for pluto and ipsec.secrets, which is located in /usr/local/v6/man/{man5,man8}
	% man ipsec_pluto
	% man ipsec.secrets

	Start sequence:
	
	2). Define a preshared key of both hosts in /usr/local/v6/etc/ipsec.secrets (default).
	
		3ffe:a:b:c:d::1 3ffe:a:b:c:d::2 : PSK "hoge"
		...... (in ipsec.secrets)

	3). Run pluto with any option
	# pluto
	for debugging, run with "--nofork --stderrlog --debug-all" options.
	# pluto --nofork --stderrlog --debug-all

	4). Check pluto is running or not with ps command or ls /var/run.
	# ls /var/run
	If there is a pluto.pid file, pluto is running.
	or
	# whack --status
	You get the response like "whack: Pluto is not running (no "/var/run/pluto.ctl")",
	when pluto doesn't run.

	5). Configure IKE with whack command. The parameter after --name is the
	name of a configuration. This parameteris used for initiation,
	termination, and delete. The configuration name "testv6" is used in the 
	following examples.

	-- If you want to use authentication,
	# whack --name testv6 --ipv6 --host 3ffe:a:b:c:d::1 --to --host 3ffe:a:b:c:d::2 --authnticate
	-- If you want to use encryption,
	# whack --name testv6 --ipv6 --host 3ffe:a:b:c:d::1 --to --host 3ffe:a:b:c:d::2 --encrypt
	-- If you use both authentication and encryption,
	# whack --name testv6 --ipv6 --host 3ffe:a:b:c:d::1 --to --host 3ffe:a:b:c:d::2 --authnticate --encrypt

	You can use other options. Please see man pages for pluto.

	6). Make pluto listen
	# whack --listen
	Then pluto checks the interface and reads authentication keys from the file.

	7). Initiate key exchange with configuration name
	# whack --initiate --name testv6
	Pluto will start key exchanges.
	You can see the IPsec information with
	% pfkey -L (or 'ipsec-conf show' is more friendly.)

	Shutdown sequence from here.

	8). Terminate IPsec between the hosts.
	# whack --terminate --name testv6

	9). Delete configuration
	# whack --delete --name testv6

	10). Shutdown pluto
	# whack --shutdown
	
3.1.2.2 Using IKEd with configuration file and auto scripts

	We have ported some scripts of FreeS/WAN to USAGI.
	Then you can use "ipsec auto" command with "ipsec.conf" and "ipsec.secrets".
	But our implementation never call up/down script.

	There is no any setup scripts for booting up, "auto" field in ipsec.conf is no effect.

	We introduced "af" fields into "ipsec.conf", af which indicates Address
	Family. You can set "inet" or "inet6" in that fields. The default value is "inet".

	"/usr/local/v6/etc" is the default path to "ipsec.conf" and "ipsec.secrets".

	Example Network Scenario:

	(Host A) ----------------- (Host B)
	3ffe:a:b:c:d::1            3ffe:a:b:c:d::2

	mode		: transport AH/ESP
	AH  algo	: hmac-md5
	ESP auth algo	: hmac-md5
	ESP enc algo	: 3des-cbc

	IKEd authenticates another with pre-shared secret.

	The name of this SAs is "testv6"

	1). Write the pre-shared secret in ipsec.secret like this

		3ffe:a:b:c:d::1 3ffe:a:b:c:d::2 : PSK "test SAs secrets"

	2). Write the configuration of "testv6" in ipsec.conf.
	
		config setup
			.....
	
		conn testv6
			af=inet6
			type=transport
			authby=secret
			left=3ffe:a:b:c:d::1
			right=3ffe:a:b:c:d::2
			esp=3des-md5-96
			ah=hmac-md5-96

		You can specify the authentication method whether AH or ESP
		with parameter "auth".

	3). Run the pluto with some options (Do this on both hosts)
	#pluto --nofork --stderrlog --debug-all (for debugging)

	4). Add the configuration of "testv6" to pluto (Do this on both hosts)
	#ipsec auto --add testv6

	5). Make pluto read secrets (Do this on both hosts)
	#ipsec auto --ready

	6). Make pluto establish IPsec SAs which are configured in "testv6"
	#ipsec auto --up testv6

	To delete configuration of "testv6"
	# ipsec auto --delete testv6

	To change pre-shared secrets or add pre-shared secrets
	# ipsec auto --rereadsecret

	You want more specifications, please see manual pages.


3.2 Tunnel Mode

3.2.1. Connection between two sites

3.2.1.1. Sample Network Topology

	In this section, Security Gateway 1(SG1) and Security Gateway 2(SG2)
	connect between two networks over IPv6 or IPv4 external network, 
	by using IPsec Tunneling. Here is network topology.
	And SA between SG1 and SG2 is shown below.

            (NET1 : fec0:0:0:1000::/64)   (NETX : 3ffe:a:b:c:d::/64)   (NET2 : fec0:0:0:2000::/64)

    	HOST1-eth0-----------------eth0-SG1-eth1================eth1-SG2-eth0----------------eth0-HOST2

    	eth0:fec0:0:0:1000::101    eth0:fec0:0:0:1000::10       eth0:fec0:0:0:2000::20       eth0:fec0:0:0:2000::202
                                   eth1:3ffe:a:b:c:d::10        eth1:3ffe:a:b:c:d::20
                                   tnl0:fe80::10                tnl0:fe80::20

        mode            : tunnel AH/ESP
        AH  algo        : hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
        ESP auth algo   : hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
        ESP enc algo    : 3des-cbc (key 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7)
        SPI             : SG1 -> SG2 AH:0x1234 ESP:0x5678, SG2 -> SG1 AH:0x9abc ESP:0xdef0

3.2.1.2. Setup Instruction (manually keyed)

	First of all, you have to set up interfaces of each nodes and configure 
	SG1 and SG2 as routers.
    
	on HOST1
    	# ip addr add fec0:0:0:1000::101/64 dev eth0
    
	on HOST2
	# ip addr add fec0:0:0:2000::202/64 dev eth0
    
	If you want to configure HOST1 and HOST2 by Router Advertisements from 
	SG1 and SG2, you don't need to configure these addresses manually
	on HOST1 and HOST2.
    
	on SG1
	# ip addr add fec0:0:0:1000::10/64 dev eth0
	# ip addr add 3ffe:a:b:c:d::10/64 dev eth1
	# sysctl -w net/ipv6/conf/all/forwarding=1
	# sysctl -w net/ipv6/conf/all/accept_ra=0
    
	on SG2
	# ip addr add fec0:0:0:2000::20/64 dev eth0
	# ip addr add 3ffe:a:b:c:d::20/64 dev eth1
	# sysctl -w net/ipv6/conf/all/forwarding=1
	# sysctl -w net/ipv6/conf/all/accept_ra=0
    
    	Then, you have to set up tunnel device between SG1(NETX) and SG2(NETX), and configure
	routing.
	If you want to check tunnel configuration, type "ipv6tunnel show tnl0" after completing
	these configurations.

    	on SG1
    	# modprobe ipv6_tunnel
    	# ipv6tunnel add tnl0 --tunnel-local-packets encaplimit 0 \
      	  remote 3ffe:a:b:c:d::20 local 3ffe:a:b:c:d::10
    	# ip link set tnl0 up 
    	# ip addr add fe80::10 dev tnl0
    	# ip route add fec0:0:0:2000::/64 dev tnl0

    	on SG2
    	# modprobe ipv6_tunnel
    	# ipv6tunnel add tnl0 --tunnel-local-packets encaplimit 0 \
          remote 3ffe:a:b:c:d::10 local 3ffe:a:b:c:d::20
    	# ip link set tnl0 up
    	# ip addr add fe80::20 dev tnl0
    	# ip route add fec0:0:0:1000::/64 dev tnl0

	Now you should do ping from HOST1 to HOST2. 
	If it doesn't work well, check your configuration.
	Next, you have to set SAs and SPD.

    	on both SG1 and SG2
    
    	SG1 to SG2
    	# pfkey -A sa -s 3ffe:a:b:c:d::10 -d 3ffe:a:b:c:d::20 -T ah -S 0x1234 \
      	  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
    	# pfkey -A sa -s 3ffe:a:b:c:d::10 -d 3ffe:a:b:c:d::20 -T esp -S 0x5678 \
      	  --esp 3des-cbc --espkey 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7 \
      	  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
    	# pfkey -A sp -s fec0:0:0:1000::/64 -d fec0:0:0:2000::/64 -T ah -S 0x1234 \
      	  --tunnel --sad 3ffe:a:b:c:d::20
    	# pfkey -A sp -s fec0:0:0:1000::/64 -d fec0:0:0:2000::/64 -T esp -S 0x5678 \
      	  --tunnel --sad 3ffe:a:b:c:d::20
    
    	SG2 to SG1
    	# pfkey -A sa -s 3ffe:a:b:c:d::20 -d 3ffe:a:b:c:d::10 -T ah -S 0x9abc \
      	  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
    	# pfkey -A sa -s 3ffe:a:b:c:d::20 -d 3ffe:a:b:c:d::10 -T esp -S 0xdef0 \
      	  --esp 3des-cbc --espkey 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7 \
      	  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
   	# pfkey -A sp -s fec0:0:0:2000::/64 -d fec0:0:0:1000::/64 -T ah -S 0x9abc \
      	  --tunnel -sad 3ffe:a:b:c:d::10
    	# pfkey -A sp -s fec0:0:0:2000::/64 -d fec0:0:0:1000::/64 -T esp -S 0xdef0 \
      	  --tunnel -sad 3ffe:a:b:c:d::10

	Finally you have configured IPsec tunnel from SG1 to SG2.
	Try to do ping from HOST1 to HOST2, and check if the packets are encrypted.

3.2.1.3. Using IKEd

	Tunnel mode IKEd setup is almost same as Transport mode IKEd except for entry 
	of ipsec.conf file.

	1). Write the pre-shared secret in ipsec.secret like this

		3ffe:a:b:c:d::10 3ffe:a:b:c:d::20 : PSK "test SAs secrets"

	2). Write the configuration of "tunv6" in ipsec.conf.

		config setup
			.....

		conn tunv6
			af=inet6
			authby=secret
			left=3ffe:a:b:c:d::10
			leftsubnet=fec0:0:0:1000::/64
			leftnexthop=3ffe:a:b:c:d::20
			right=3ffe:a:b:c:d::20
			rightsubnet=fec0:0:0:2000::/64
			rightnexthop=3ffe:a:b:c:d::10
			esp=3des-md5-96
			ah=hmac-md5-96

	3). You can run pluto and control it by "ipsec auto" or whack command.
	    See 3.1.2.1 Using IKEd with manual configuration  and
		3.1.2.2 Using IKEd with configuration file and auto scripts.
			
3.2.2. Connection from a host to Security Gateway

3.2.2.1. Sample Network Topology

	In this section, Security Gateway 1(SG1) and Security Gateway 2(SG2)
	communicate over IPv6 external network, by using IPsec Tunneling.
	SG1 has only one phisical interface. Here is network topology.
	And SA between SG1 and SG2 is shown below.

           (NETX : 3ffe:a:b:c:d::/64)   (NET2 : fec0:0:0:2000::/64)

	SG1-eth0================eth1-SG2-eth0----------------eth0-HOST2

    	eth0:3ffe:a:b:c:d::10        eth0:fec0:0:0:2000::20       eth0:fec0:0:0:2000::202
    	tnl0:fec0:0:0:1000::10       eth1:3ffe:a:b:c:d::20
    	tnl0:fe80::10                tnl0:fe80::20

        mode            : tunnel AH/ESP
        AH  algo        : hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
        ESP auth algo   : hmac-md5 (key 0x0123456789abcdef0123456789abcdef)
        ESP enc algo    : 3des-cbc (key 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7)
        SPI             : SG1 -> SG2 AH:0x1234 ESP:0x5678, SG2 -> SG1 AH:0x9abc ESP:0xdef0

3.2.2.2. Setup Instruction (manually keyed)

	First of all, you have to set up interfaces of each nodes and configure 
	SG2 as a router.
    
	on HOST2
	# ip addr add fec0:0:0:2000::202/64 dev eth0

	If you want to configure HOST2 by Router Advertisements from SG2, 
	you don't need to configure these addresses manually on HOST2.

	on SG1
	# ip addr add 3ffe:a:b:c:d::10/64 dev eth0

	on SG2
	# ip addr add fec0:0:0:2000::20/64 dev eth0
	# ip addr add 3ffe:a:b:c:d::20/64 dev eth1
	# sysctl -w net/ipv6/conf/all/forwarding=1
	# sysctl -w net/ipv6/conf/all/accept_ra=0

	Then, you have to set up tunnel device between SG1(NETX) and SG2(NETX), and configure
	routing.
	If you want to check tunnel configuration, type "ipv6tunnel show tnl0" after completing
	these configurations.

	on SG1
	# modprobe ipv6_tunnel
	# ipv6tunnel add tnl0 --tunnel-local-packets encaplimit 0 \
	  remote 3ffe:a:b:c:d::20 local 3ffe:a:b:c:d::10
	# ip link set tnl0 up
	# ip addr add fe80::10 dev tnl0
	# ip addr add fec0:0:0:1000::10/64 dev tnl0
	# ip route add fec0:0:0:2000::/64 dev tnl0

	on SG2
	# modprobe ipv6_tunnel
	# ipv6tunnel add tnl0 --tunnel-local-packets encaplimit 0 \
  	  remote 3ffe:a:b:c:d::10 local 3ffe:a:b:c:d::20
	# ip link set tnl0 up
	# ip addr add fe80::20 dev tnl0
	# ip route add fec0:0:0:1000::/64 dev tnl0

	Now you should do ping from SG1 to HOST2. 
	If it doesn't work well, check your configuration.
	Next, you have to set SAs and SPD.

	on both SG1 and SG2

	SG1 to SG2
	# pfkey -A sa -s 3ffe:a:b:c:d::10 -d 3ffe:a:b:c:d::20 -T ah -S 0x1234 \
	  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	# pfkey -A sa -s 3ffe:a:b:c:d::10 -d 3ffe:a:b:c:d::20 -T esp -S 0x5678 \
	  --esp 3des-cbc --espkey 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7 \
	  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	# pfkey -A sp -s fec0:0:0:1000::10 -d fec0:0:0:2000::/64 -T ah -S 0x1234 \
	  --tunnel -sad 3ffe:a:b:c:d::20
	# pfkey -A sp -s fec0:0:0:1000::100 -d fec0:0:0:2000::/64 -T esp -S 0x5678 \
	  --tunnel -sad 3ffe:a:b:c:d::20

	SG2 to SG1
	# pfkey -A sa -s 3ffe:a:b:c:d::20 -d 3ffe:a:b:c:d::10 -T ah -S 0x9abc \
	  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	# pfkey -A sa -s 3ffe:a:b:c:d::20 -d 3ffe:a:b:c:d::10 -T esp -S 0xdef0 \
	  --esp 3des-cbc --espkey 0xa7a36ebd91863edfba763fa7edcba64d89123ace6359eba7 \
	  --auth hmac-md5 --authkey 0x0123456789abcdef0123456789abcdef
	# pfkey -A sp -s fec0:0:0:2000::/64 -d fec0:0:0:1000::10 -T ah -S 0x9abc \
	  --tunnel --sad 3ffe:a:b:c:d::10
	# pfkey -A sp -s fec0:0:0:2000::/64 -d fec0:0:0:1000::10 -T esp -S 0xdef0 \
	  --tunnel --sad 3ffe:a:b:c:d::10

	Finally you have configured IPsec tunnel from SG1 to SG2.
	Try to do ping from SG1 to HOST2, and check if the packets are encrypted.

4. Notice

	- If you use 3DES or DES for ESP encryption algorithm, please avoid using the weak key.

	- When you want to configure a policy which indicates applying IPsec except ICMP packets.  
	  You set a policy to bypass ICMP packet first, 
	  and second set a policy to apply IPsec all packet.  
	  For exapmle, to apply ESP except ICMP packets.
	  # pfkey -A sp -s SADDR -d DADDR --protocol icmp --policy bypass
	  # pfkey -A sp -s SADDR -d DADDR -T esp -S 0x1000
	  # ...

5. Debugging

	If you want to try to figure out ipsec related strange behavior,
	you can check a message via syslog to set /proc/net/ipsec/debug_*=1.
	(or sysctl -w net.ipsec.debug_{ipv6,pfkey,sadb,spd}=1)

6. References

	USAGI		http://www.linux-ipv6.org/
	cryptoapi	ftp://ftp.kernel.org/, http://sourceforge.net/projects/cryptoapi/
	FreeS/WAN	http://www.freeswan.org/
	IABG		http://www.ipv6.iabg.de/

   
7. Acknowledgement

	Joy Latten <latten@austin.ibm.com>
	Tom Lendacky <toml@us.ibm.com>


