Mobile IPv6 for Linux Guide (with USAGI patch)

Introduction

This article provides a tutorial on setting up Mobile IPv6(MIPv6) on Linux.

Basic kernel configuration, IPv6 networking operation, configuration experience and basic MIPv6 knowledge are needed. If you use IPsec, basic IPsec knowledge and IPv6 tunnel gateway configuration experience is also required.

First of all, see README.MIPv6 about this software.

On this document, "(ready-logo)" means that configuration or procedure required to prepare environment to obtain IPv6 Ready Logo Program Phase-2 MIPv6.

Building kernel and mip6d

Get tar-balls and patches for both kernel and mip6d. (Please put KERNEL=kernel-s20051214 and USER=mipv6-s20051214 on the below)
Kernel
- Extract kernel tar-ball and apply patch like below:
  $ tar -zxf KERNEL.tar.gz $ cd KERNEL $ patch -p1 < KERNEL-umip-0.1.diff
- See INSTALL.kernel included by mip6d tar-ball about kernel configuration and build it.
mip6d
- Prepare mip6d tar-ball and patch.
  $ tar -zxf USER.tar.gz $ cd USER $ patch -p1 < USER-umip-0.1.diff
- See README.developer and INSTALL included by mip6d tar-ball and build it. Be sure to compile with debugging option using "--enable-vt".

Configuration

After mip6d is installed, you can see mip6d.conf(5) which has useful information about configuration.

HA specific configuration

router: HA should be configured as an IPv6 router like accept_ra=0, forwarding=1 and so on.An example is example-router.sh. This script must be run before the interface is brought up.
IPsec: See IPsec configuration.
mip6d: See mip6d.conf(5). An example is mip6d-ha.conf.
radvd: Send RA with HA related options like "HA flag", HA address as network prefix and "router address flag" on prefix information. See also radvd.conf(5) for the detail. An example is radvd.conf.
(optional): It is recommended smaller router advertisement interval. This also can be said to foreign links to where MN moves.
(ready-logo): Note: Don't send RA with HA related options like the above in the case of IPv6 Core Protocol router conformance test.

MN specific configuration

disable sending RS from kernel (ready-logo):
If you want to avoid to send RS from kernel, you can configure the proc entry for the interface you want to use like router_solicitations=0,router_solicitation_interval=0. An example is example-stop_kernel_rs.sh.This script must be run before the interface used by mip6d is brought up.
IPsec: See IPsec configuration.
mip6d: See mip6d.conf(5). An example is mip6d-mn.conf.

CN specific configuration

See mip6d.conf(5) for mip6d. An example is mip6d-cn.conf.

IPsec configuration

[HA,MN]See README.IPsec included by mip6d tar-ball. An example is setkey.conf.

Boot sequence

HA boot sequence

Before starting mip6d, the following conditions should be satisfied:
- Be ready as a router
- Assigned a global address on home link interface, as HA address
- IPsec SA configuration (when using IPsec with static keying)
- (optional)syslogd is running
Run mip6d
After started mip6d:
- Run radvd

MN boot sequence

Before starting mip6d, the following conditions should be satisfied:
- Disable sending RS from kernel(ready-logo, see below).
- The interface is brought up before you run mip6d.
- IPsec SA configuration (when using IPsec with static keying).
- (optional)syslogd is running.
After you made sure these conditions, you can run mip6d.

Note that about running IPv6 Ready Logo phase 2 with this implementation:

If you want to run the IPv6 Ready Logo Phase 2 conformance test for IPv6 core protocol as MN, you may want to configure not to send RS from kernel.
If you want to run the IPv6 Ready Logo Phase 2 interoperability test for MIPv6, you may want to add the InitialBindackTimeoutFirstReg or InitialBindackTimeoutReReg in the mip6d-mn.conf(The comment about this is inserted in this file).
There is a probability that the first BU is queued in the kernel more than 1 or 1.5 second because of some reason such like neighbor discovery is under going, network performance, machine resources and so on. Each variable is used to configure InitialBindackTimeoutFirstReg and INITIAL_BINDACK_TIMEOUT in RFC 3775.

CN boot sequence

Before starting mip6d, the following conditions should be satisfied:
- (optional)syslogd is running
Run mip6d

Example of mip6d boot script

MN boot script on Debian Distribution
See also MN boot sequence.
HA boot script on Debian Distribution
Make sure that
1. configuration for router is done before running this script.
2. radvd runs after this script.
See also HA boot sequence.

Examples for other distributions are (TBD)

Verification

Running

When you have syslog, mip6d will say own start as a log. Then an easy way to verify the mip6d running is to take a look at it.
[HA] Try virtual terminal to see mip6d information like below:
$ telnet localhost 7777 Trying ::1... Trying 127.0.0.1... Connected to ip6-localhost. Escape character is '^]'. mip6d> pl eth1 3ffe:501:ffff:100:200:ff:fe00:a0a0/64 valid 2591997 / 2592000 preferred 604800 flags OAR mip6d>
If you could get home prefix valid lifetime with positive value there, the HA is ready to serve. Otherwise, you should check the RA configuration.

Binding cache

Try virtual terminal to see mip6d information like below:
$ telnet localhost 7777 Trying ::1... Trying 127.0.0.1... Connected to ip6-localhost. Escape character is '^]'. mip6d> bc hoa 3ffe:501:ffff:100::1 status registered coa 3ffe:501:ffff:102:200:ff:fe00:a1a1 flags AH-- local 3ffe:501:ffff:100:200:ff:fe00:a0a0 lifetime 998 / 1000 seq 58722 unreach 0 mpa - / 0 retry 0 mip6d>
If the node has binding cache correctly, you will get entries there with registered [HA], cached [CN] at "status" for each MN HoA respectively.

Binding update list

[MN]Try virtual terminal to see mip6d information like below:
$ telnet localhost 7777 Trying ::1... Connected to localhost. Escape character is '^]'. mip6d> bul ha 3ffe:501:ffff:100:200:ff:fe00:a0a0 ack ready coa 3ffe:501:ffff:102:200:ff:fe00:a1a1 flags AH-- lifetime 798 / 1000 seq 58722 resend 0 delay 950 after 749 mps 1004393573 / 1932735240 mip6d>
If the MN sent BUs, you can find entries there for HA/CN respectively. To confirm home registration is completed, check the HA entry whose "ack" value is ready

Route optimization

We don't have an easy and good route optimization test for both-direction (other than using TAHI test or dumping packet). On the other hand, with ping6 command from USAGI cvs, you can check whether inbound echo reply is route-optimized or not.

Prepare ping6 from USAGI cvs. Be sure to re-compile with the kernel if you have old one built on an older kernel.
Try ping6 with "-E" option to see extension headers carried by echo reply.

Examples:

[HA,CN] Receiving a route-optimized echo reply from MN
$ ping6 -E -I HACN_ADDR MN_ADDR ... 64 bytes from MN_ADDR[HAO]: icmp_seq=1 ttl=61 time=1.04 ms
[MN] Receiving a route-optimized echo reply from HA,CN
$ ping6 -E HACN_ADDR ... 64 bytes from HACN_ADDR[RT2]: icmp_seq=1 ttl=61 time=1.04 ms

Known issues

It is not supported:
- mip6d with IKE daemon to establish SA
- to flush SPD during mip6d is running
- to re-insert SA during mip6d is running
  [HA] relevant binding cache entry exists
  [MN] on foreign link
Don't send BU to HA during HA performs proxy DAD with the same HoA.
When HA receives the next BU while processing the BU for the first Home Registration, HA can't handle it correctly and will go wrong.
When such a case occurred, you can aovid this trouble by setting InitialBindackTimeoutFirstReg or InitialBindackTimeoutReReg more than 1.0 second in the configuration file of MN(i.e., MN waits more than InitialBindackTimeoutFirstReg or INITIAL_BINDACK_TIMEOUT seconds to send the next BU).See also MN boot sequence section.