KAME Mobile IPv6 How To

Written by Keiichi SHIMA @ { KAME Project | Internet Initiative Japan }


This documents decsribes the step-by-step instruction to use the KAME Mobile IPv6(KAME/MIP6) features. Since the KAME/MIP6 is still under developping, these information may be outdated at the time when you are reading this document. Please refer the latest documentation included in the KAME kit in such a case.

Brief history of KAME/MIP6

KAME/MIP6 is based on the three implementations (Ericsson, NEC, Keio Univ.) those have been built on the KAME IPv6 protocol stack before. When we planned to start to provide a MIP6 protocol stack with KAME base distribution, we dicided to rebuild the stack so that we could maintain the code easily and effectively. The initial KAME/MIP6 was mainly based on the Ericcson's code and some userland application are contributed from from NEC with the notation of a virtual home interface which is taken from the stack design of Keio Univ. Since then, we made many enhancement on KAME/MIP6 code and we now have highly interoperable, BSD-like licenced MIP6 stack.

Supported Platforms

Currently, FreeBSD and NetBSD is proved to work as a home agent / a mobile node / a correspondent node. Regerding to OpenBSD, we have no plan to supprot for a home agent and a mobile node functions because OpenBSD has completely differnt IPsec stack which makes it difficult to port KAME/MIP6 to OpenBSD. A correspondent node function for OpenBSD is planned but not tested yet.

Get the source code

The KAME/MIP6 is under developping. You should use the latest KAME snap kit always. Get the latest kit from the KAME Project website.

Rebuilding with the MIP6 extention

MIP6 features are not enabled by default. You must prepare a new kernel configuration file and rebuild your kernel that is able to speak the MIP6 protocol. Also, some user-space programs need to be rebuilt. Follow the instruction below.

Rebuild your kernel for a mobile node

To enable a mobile node feature, set the following kernel options in your kernel configuration file and rebuild the kernel.

options MIP6
pseudo-device hif 1

Rebuild your kernel for a home agent

To enable a home agent feature, set the following kernel options in your kernel configuration file and rebuild the kernel.

options MIP6

Rebuild your kernel for a correspondent node

If you just want a stationaly node which have Mobile IPv6 support (route optimization), set the following kernel options in your kernel configuration file and rebuild the kernel.

options MIP6

Build user-space programs

There are 4 user-space programs related to MIP6.

The router advertisement daemon.
The dynamic home agent discovery protocol daemon.
A control program of the KAME/MIP6 functions.
A program which displays statistics of packets related to MIP6.

Rebuild rtadvd

Go to the directory of rtadvd (${KAME}/freebsd4/sbin/rtadvd/ for example, if you use FreeBSD), add the following line to its Makefile


Recompile rtadvd and install it.

$ make clean
$ make
$ su (become the super user)
# make install

With -DMIP6, rtadvd is compiled with the -m switch which enables MIP6 related features of rtadvd.

Build had, mip6control, mip6stat

had, mip6control, mip6stat are build automatically when other user-space programs are build. They are installed to /usr/local/v6/sbin/.

Create IPsec configuration files

The KAME/MIP6 uses KAME IPsec to protect binding update messages and tunneled home test init/home test messages. You need to set up the security associations and policies properly.

Since the parameters are too complex enough to write down by hand, there are some utilities to aid this work. You can find mip6makeconfig.sh and mip6seccontrol.sh in the kame/kame/kame/mip6control/ directory.

First of all, you must create a configuration directory that holds MIP6 related IPsec set up files.

(become a super user)
# mkdir /usr/local/v6/etc/mobileip6

Next, create directories for each mobile node. For example,

# mkdir /usr/local/v6/etc/mobileip6/mobile_node_0

The name of the directory is arbitrary.

Next, create a file named config in the directory. The contents of the file is looks like as below.


mobile_node is an address of a mobile node. home_agent is an address of a home agent.

transport_spi_mn_to_ha is a SPI value of a SA to protect home registration packets which are sent from the mobile node to the home agent. transport_spi_ha_to_mn is the reverse. transport_protocol is a protocol name to protect home registration packets. You can specify either ah or esp.

If you choose esp in transport_protocol, you must specify both an encription algorithm/key and a hash algorithm/key by transport_esp_algorighm/transport_esp_secret and transport_auth_algorighm/transport_auth_secret.

If you use ah, you can omit transport encription parameters from your configuration file.

The lines which start with tunnel_ are the parameters for RR (Return Routability) signaling packets. The protocol is fixed to ESP. You cannot change this. As you have done in the above setting, specify the SPIs and the algorithm and the secret to protect signaling packets. In addition, you must specify tunnel_uid_mn_to_ha and tunnel_uid_ha_to_mn. They are used as unique identifiers to specify SAs for RR signaling.

Next, create parameter setting files by using mip6makeconfig.sh. For example,

# mip6makeconfig.sh mobile_node_0

Where mobile_node_0 is the directory name you have created in the /usr/local/v6/etc/mobileip6. After successful execution of this program, you will find 6 files created in the per node directory. Each file contains parameters for the IPsec (actually, the parameters for the setkey program).

mip6seccontrol.sh is a utility program to set/unset IPsec parameters.

You should invoke the program on your mobile node like:

# mip6seccontrol.sh -m installall

This installs the IPsec parameters for all mobile nodes stored in the /usr/local/v6/etc/mobileip6 directory.

On the home agent, you should invoke the program like:

# mip6seccontrol.sh -g installall

This installs the IPsec parameters for all mobile nodes stored in the /usr/local/v6/etc/mobileip6 directory.

Starting MIP6

We provide a startup script for the KAME/MIP6.

If you are using FreeBSD4, you will find rc and rc.mobileip6 in the /kame/freebsd4/etc directory. Copy those files to the /etc directory.

If you are using NetBSD, you will find mobileip6 in the /kame/netbsd/etc/rc.d/ directory. Copy this file to /etc/rc.d directory.

Starting a home agent

To start a home agent, add the following lines to your /etc/rc.conf.


Do not forget to replace ipv6_mobile_home_prefixes with your home prefix and ipv6_mobile_home_link with the interface name you use for the home network.

Since a home agent is a router, you will need other configuration parameters required for a generic IPv6 router. For example,


Starting a mobile node

To make a node as a mobile node, add the following lines to your /etc/rc.conf.


Replace ipv6_mobile_home_prefixes with your home prefix.

Tuning access routers

You may need to decrease an interval between unsolicited router advertisement of access routers for fast movement detection. This technique is effective to a certain degree.

Prepare rtadvd.conf for your access routers


fxp0 is the name of the interface which your access router advertises router advertisemetn messages.

Create a rtadvd.conf and place it in a proper directory. The directory is /usr/local/v6/etc if you are using KAME, otherwise /etc.

NOTE: Mobile IPv6 relaxes the maxinterval/mininterval values to 0.07/0.03. But you shouldn't expect a significant performance gain with this tuning. It will end up with a heavy CPU load on the node which rtadvd is running.

Doesn't work?

Please mail your problems to snap-users@kame.net .