>So I entered IPv6 addresses into /etc/ifconfig.wi0 on both sides:
>one is
>	inet6 fce0::2
>and the other
>	inet6 fce0::5

	where did you pick the prefix?  it looks to be a typo for
	"fec0::2".  Don't forget "prefixlen 64 alias" at the tail.
	IPv6 prefix length is always 64, and we have multiple addresses on
	an interface, which is "alias" in traditional ifconfig(8)'s mind.

	also, take a look at /etc/netstart (or /etc/rc.d/network) - for
	scope boundary's sake we install reject route for fec0::/10,
	you need to comment that line out.

>Now ping6 works. First question: what else (besides enabling IPSec in
>the kernel, which I did) does it need to have this IPv6 connection encrypted?

	man setkey

>Now, to route the IPv4 networks between both systems I tried to use the gif
>tunnel device and did 
>ifconfig gif0 inet 192.168.1.1
>and
>ifconfig gif0 inet 192.168.1.2
>respectively. Now I need the outer IPv6 addresses for the tunnel and tried
>gifconfig gif0 inet6 fce0::2 fce0::5
>but this failed. Other IPv6 addresses fail too.

	can you talk a little bit more about *how* it have failed?  what
	have you observed?  did you check the packet trace via tcpdump?
	how is your routing table configured?  there are so many information
	necessary to track your issue down.

itojun