Tunneling IPv6: 6to4 Tunnels

VN:F [1.9.6_1107]
Rating: 4.8/5 (4 votes cast)
By Marko Milivojevic on August 9th, 2010

This is the first in series of guides on tunneling IPv6 over existing IPv4 networks. For this first article, I’ve chosen the method that I see many CCIE students struggle with – 6to4 tunnels.

We will be working with the diagram depicted below. Let’s examine the initial network before we start configuring anything new.

Diagram

As we can see on the diagram, we seem to have three “IPv6 islands” connected with IPv4 networks to some sort of a backbone device. In “real life”, this backbone device could represent the Internet, or private network – for example MPLS VPN. In our case, it’s a single device. Edge routers in our IPv6 islands (R2, R3 and R5) have full reachability between their Loopback0 interfaces. For that, we used simple BGP configuration.

Initial IPv4 Configuration

Here are relevant configuration snippets and verification.

R2:

router bgp 65002
 bgp router-id 2.2.2.2
 bgp log-neighbor-changes
 neighbor 192.168.2.7 remote-as 7
 !
 address-family ipv4
  no synchronization
  network 2.2.2.2 mask 255.255.255.255
  neighbor 192.168.2.7 activate
  neighbor 192.168.2.7 send-community
  no auto-summary
 exit-address-family
!

R2#tclsh
R2(tcl)#foreach ip {
+>(tcl)#2.2.2.2
+>(tcl)#3.3.3.3
+>(tcl)#5.5.5.5
+>(tcl)#} { ping $ip source Loopback0 repeat 3 timeout 1 }

Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2.2.2.2, timeout is 1 seconds:
Packet sent with a source address of 2.2.2.2
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 1/3/4 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 3.3.3.3, timeout is 1 seconds:
Packet sent with a source address of 2.2.2.2
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 16/17/20 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 5.5.5.5, timeout is 1 seconds:
Packet sent with a source address of 2.2.2.2
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 12/13/16 ms

R3:

router bgp 65003
 bgp router-id 3.3.3.3
 bgp log-neighbor-changes
 neighbor 192.168.3.7 remote-as 7
 !
 address-family ipv4
  no synchronization
  network 3.3.3.3 mask 255.255.255.255
  neighbor 192.168.3.7 activate
  neighbor 192.168.3.7 send-community
  no auto-summary
 exit-address-family
!

R3#tclsh
R3(tcl)#foreach ip {
+>(tcl)#2.2.2.2
+>(tcl)#3.3.3.3
+>(tcl)#5.5.5.5
+>(tcl)#} { ping $ip source Loopback0 repeat 3 timeout 1 }

Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2.2.2.2, timeout is 1 seconds:
Packet sent with a source address of 3.3.3.3
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 16/17/20 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 3.3.3.3, timeout is 1 seconds:
Packet sent with a source address of 3.3.3.3
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 4/5/8 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 5.5.5.5, timeout is 1 seconds:
Packet sent with a source address of 3.3.3.3
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 12/14/16 ms

R5:

router bgp 65005
 bgp router-id 5.5.5.5
 bgp log-neighbor-changes
 neighbor 192.168.5.7 remote-as 7
 !
 address-family ipv4
  no synchronization
  network 5.5.5.5 mask 255.255.255.255
  neighbor 192.168.5.7 activate
  neighbor 192.168.5.7 send-community
  no auto-summary
 exit-address-family
!

R5#tclsh
R5(tcl)#foreach ip {
+>(tcl)#2.2.2.2
+>(tcl)#3.3.3.3
+>(tcl)#5.5.5.5
+>(tcl)#} { ping $ip source Loopback0 repeat 3 timeout 1 }

Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2.2.2.2, timeout is 1 seconds:
Packet sent with a source address of 5.5.5.5
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 16/17/20 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 3.3.3.3, timeout is 1 seconds:
Packet sent with a source address of 5.5.5.5
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 12/14/20 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 5.5.5.5, timeout is 1 seconds:
Packet sent with a source address of 5.5.5.5
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 1/4/8 ms

BB:

router bgp 7
 bgp router-id 7.7.7.7
 no bgp default ipv4-unicast
 bgp log-neighbor-changes
 neighbor 192.168.2.2 remote-as 65002
 neighbor 192.168.3.3 remote-as 65003
 neighbor 192.168.5.5 remote-as 65005
 !
 address-family ipv4
  no synchronization
  network 7.7.7.7 mask 255.255.255.255
  neighbor 192.168.2.2 activate
  neighbor 192.168.2.2 send-community
  neighbor 192.168.3.3 activate
  neighbor 192.168.3.3 send-community
  neighbor 192.168.5.5 activate
  neighbor 192.168.5.5 send-community
  no auto-summary
 exit-address-family
!

Initial IPv6 Configuration

On top of the connectivity between our edge devices, we have fully functional IPv6 routing within each of the islands. Let’s examine each one in turn.

In “Site A”, we are running OSPFv3 between R1 and R2. We have full visibility of all networks in use. Let’s take a look.

R1:

ipv6 unicast-routing
!
interface Ethernet0/0
 no ip address
 ipv6 address 2002:202:202:1::1/64
 ipv6 ospf 1 area 0
!
interface Serial1/0
 no ip address
 ipv6 address FE80::1 link-local
 ipv6 address 2002:202:202:12::1/64
 ipv6 enable
 ipv6 ospf 1 area 0
!
ipv6 router ospf 1
 router-id 1.1.1.1
 log-adjacency-changes
 passive-interface Ethernet0/0
!

R1#show ipv6 route ospf
IPv6 Routing Table - default - 6 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external, ND - Neighbor Discovery
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
O   2002:202:202::2/128 [110/64]
     via FE80::2, Serial1/0

R2:

ipv6 unicast-routing
!
interface Loopback0
 ip address 2.2.2.2 255.255.255.255
 ipv6 address 2002:202:202::2/64
 ipv6 ospf 1 area 0
!
interface Serial1/0
 no ip address
 ipv6 address FE80::2 link-local
 ipv6 address 2002:202:202:12::2/64
 ipv6 enable
 ipv6 ospf 1 area 0
!
ipv6 router ospf 1
 router-id 2.2.2.2
 log-adjacency-changes
 passive-interface Loopback0
!

R2#show ipv6 route ospf
IPv6 Routing Table - default - 6 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external, ND - Neighbor Discovery
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
O   2002:202:202:1::/64 [110/74]
     via FE80::1, Serial1/0

In “Site B”, configuration is very similar, but I decided to use EIGRPv6 as the routing protocol instead. Let’s take a look at that!

R3:

unicast-routing
!
interface Loopback0
 ip address 3.3.3.3 255.255.255.255
 ipv6 address 2002:303:303::3/64
 ipv6 eigrp 34
!
interface Serial1/1
 no ip address
 ipv6 address FE80::3 link-local
 ipv6 address 2002:303:303:34::3/64
 ipv6 eigrp 34
!
ipv6 router eigrp 34
 passive-interface Loopback0
 eigrp router-id 3.3.3.3
!

R3#show ipv6 route eigrp
IPv6 Routing Table - default - 6 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external, ND - Neighbor Discovery
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
D   2002:303:303:4::/64 [90/2195456]
     via FE80::4, Serial1/1

R4:

ipv6 unicast-routing
!
interface Ethernet0/0
 no ip address
 ipv6 address 2002:303:303:4::4/64
 ipv6 eigrp 34
!
interface Serial1/1
 no ip address
 ipv6 address FE80::4 link-local
 ipv6 address 2002:303:303:34::4/64
 ipv6 eigrp 34
!
ipv6 router eigrp 34
 passive-interface Ethernet0/0
 eigrp router-id 4.4.4.4
!

R4#show ipv6 route eigrp
IPv6 Routing Table - default - 6 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external, ND - Neighbor Discovery
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
D   2002:303:303::/64 [90/2297856]
     via FE80::3, Serial1/1

Similarly to this, “Site C” is running yet another routing protocol – RIPng. Here are the relevant configurations.

R5:

ipv6 unicast-routing
!
interface Loopback0
 ip address 5.5.5.5 255.255.255.255
 ipv6 address 2002:505:505::5/64
 ipv6 rip 1 enable
!
interface Serial1/0
 no ip address
 ipv6 address FE80::5 link-local
 ipv6 address 2002:505:505:56::5/64
 ipv6 rip 1 enable
!
ipv6 router rip 1
!

R5#show ipv6 route rip
IPv6 Routing Table - default - 6 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external, ND - Neighbor Discovery
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
R   2002:505:505:6::/64 [120/2]
     via FE80::6, Serial1/0

R6:

ipv6 unicast-routing
!
interface Ethernet0/0
 no ip address
 ipv6 address 2002:505:505:6::6/64
 ipv6 rip 1 enable
!
interface Serial1/0
 no ip address
 ipv6 address FE80::6 link-local
 ipv6 address 2002:505:505:56::6/64
 ipv6 rip 1 enable
!
ipv6 router rip 1
!

R6#show ipv6 route rip
IPv6 Routing Table - default - 6 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external, ND - Neighbor Discovery
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
R   2002:505:505::/64 [120/2]
     via FE80::5, Serial1/0

Connecting the Islands With 6to4 Tunnels

As is the case with so many technologies, 6to4 tunnels are more difficult to understand than they are to configure. Let’s see what problem they solve first.

Connecting Sites A, B and C in our network using tunnels should be relatively easy. All we have to do is build tunnels from R1 to R3 and to R3, as well as between R3 and R5. That’s not so much of a problem, but what happens when we add Site D to the mix? Well, we can build another set of tunnels and we’re good to go. What if … we add 100 more sites? Using “manual” tunneling, such as GRE, doesn’t scale very well in that scenario, as we will need full mesh of tunnels, or (N-1)/2 tunnels, where N is the number of nodes.

The solution may be to use 6to4 tunnels, which provide some level of automation, with some restrictions. The basic idea is simple. IPv4 address of the “island edge node”, in our case R2, R3 and R5, will be embedded in IPv6 addresses used at the particular site. For example, we can decide that Site A will use R2′s Loopback0 for this purpose and we will use 2.2.2.2, converted to hex, as this embedded address. Similar to this, we’ll use 3.3.3.3 and 5.5.5.5 for sites B and C. The next bit is interesting.

This is such an interesting idea that special purpose /16 prefix is assigned for it. All IPv6 addresses in 2002::/16 range are supposed to be built using this method. Let’s see how embedding works.

We have IPv4 address 2.2.2.2 and IPv6 prefix 2002::/16. When we convert 2.2.2.2 to hex and divide it into 2-byte tuples, we get: 0202:0202. We can omit leading zeroes, so this becomes 202:202. Just as an example, had we used 172.19.213.44, this would have resulted in the following: AC13:D52C. Luckily, we used something simpler. When we have converted the address to hex, we will simply append it to 2002://16 prefix, resulting in 2002:202:202::/48. Very simple.

The resulting /48 subnet can be further divided into subnets at a particular site. In our case we used several subnets in all three sites. If you look carefully, you will notice they are all parts of the same 2002:xxxx:xxxx::/48 subnet at each site. All of those addresses are “hidden”, or reachable behind the same IPv4 node – our “island edge”.

This is how addressing is formed in each site, but let’s look at other important building blocks of this solution. First of all, we need to build tunnels themselves. Let me configure them on each of our end-nodes and I will then explain what I did. Here are the configurations.

R2:

interface Tunnel0
 no ip address
 ipv6 unnumbered Loopback0
 tunnel source Loopback0
 tunnel mode ipv6ip 6to4
!

R3:

interface Tunnel0
 no ip address
 ipv6 unnumbered Loopback0
 tunnel source Loopback0
 tunnel mode ipv6ip 6to4
!

R5:

interface Tunnel0
 no ip address
 ipv6 unnumbered Loopback0
 tunnel source Loopback0
 tunnel mode ipv6ip 6to4
!

Did you notice something strikingly similar with all three? Yes, they are indeed identical. Furthermore, we specify only source of the tunnel, but not the destination. The reason for that is that destination is implied by the destination address of the IPv6 packet. For example, packet going from Site A to Site B will have destination 2002:303:303:x::y. When this packet needs to be tunneled across the IPv4 cloud, our border router, R2, will know where to send it based on the 32 bits following 2002 prefix. Pretty clever.

We are not done however. On each of the nodes, we need to ensure that 2002::/16 prefix is reachable via Tunnel0 interface. For that, we need one simple static route on each of the nodes, pointing to the Tunnel0 interface. We also need to let other routers in the site know about this. While we could simply use static routing, originate the default from the edge node, I opted for a simple redistribution. Let’s look at those configurations now.

R2:

ipv6 route 2002::/16 Tunnel0
!
ipv6 router ospf 1
 redistribute static metric 10
!

R3:

ipv6 route 2002::/16 Tunnel0
!
ipv6 router eigrp 34
 redistribute static metric 1 1 1 1 1500
!

R5:

ipv6 route 2002::/16 Tunnel0
!
ipv6 router rip 1
 redistribute static metric 10
!

With this done, we should now have 2002::/16 visible in the routing tables on R1, R4 and R6, as well as full reachability between all the sites. Let’s check this out.

R1:

R1#show ipv6 route ospf
IPv6 Routing Table - default - 7 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external, ND - Neighbor Discovery
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
OE2 2002::/16 [110/10]
     via FE80::2, Serial1/0
O   2002:202:202::2/128 [110/64]
     via FE80::2, Serial1/0
R1#tclsh
R1(tcl)#foreach ip {
+>(tcl)#2002:0202:0202::2
+>(tcl)#2002:0202:0202:1::1
+>(tcl)#2002:0303:0303::3
+>(tcl)#2002:0303:0303:4::4
+>(tcl)#2002:0505:0505::5
+>(tcl)#2002:0505:0505:6::6
+>(tcl)#} { ping $ip repeat 3 timeout 1 }

Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:202:202::2, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 8/9/12 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:202:202:1::1, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 0/4/8 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:303:303::3, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 24/25/28 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:303:303:4::4, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 36/38/44 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:505:505::5, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 20/24/28 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:505:505:6::6, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 32/33/36 ms

R4:

R4#show ipv6 route eigrp
IPv6 Routing Table - default - 7 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external, ND - Neighbor Discovery
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
EX  2002::/16 [170/2560512256]
     via FE80::3, Serial1/1
D   2002:303:303::/64 [90/2297856]
     via FE80::3, Serial1/1
R4#tclsh
R4(tcl)#foreach ip {
+>(tcl)#2002:0202:0202::2
+>(tcl)#2002:0202:0202:1::1
+>(tcl)#2002:0303:0303::3
+>(tcl)#2002:0303:0303:4::4
+>(tcl)#2002:0505:0505::5
+>(tcl)#2002:0505:0505:6::6
+>(tcl)#} { ping $ip repeat 3 timeout 1 }

Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:202:202::2, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 24/25/28 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:202:202:1::1, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 32/34/36 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:303:303::3, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 8/12/20 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:303:303:4::4, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 4/4/4 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:505:505::5, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 24/25/28 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:505:505:6::6, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 28/33/36 ms

R6:

R6#show ipv6 route rip
IPv6 Routing Table - default - 7 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, M - MIPv6, R - RIP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external, ND - Neighbor Discovery
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
R   2002::/16 [120/11]
     via FE80::5, Serial1/0
R   2002:505:505::/64 [120/2]
     via FE80::5, Serial1/0
R6#tclsh
R6(tcl)#foreach ip {
+>(tcl)#2002:0202:0202::2
+>(tcl)#2002:0202:0202:1::1
+>(tcl)#2002:0303:0303::3
+>(tcl)#2002:0303:0303:4::4
+>(tcl)#2002:0505:0505::5
+>(tcl)#2002:0505:0505:6::6
+>(tcl)#} { ping $ip repeat 3 timeout 1 }

Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:202:202::2, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 24/25/28 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:202:202:1::1, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 32/33/36 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:303:303::3, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 24/25/28 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:303:303:4::4, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 32/33/36 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:505:505::5, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 8/9/12 ms
Type escape sequence to abort.
Sending 3, 100-byte ICMP Echos to 2002:505:505:6::6, timeout is 1 seconds:
!!!
Success rate is 100 percent (3/3), round-trip min/avg/max = 0/2/4 ms

There we go – simple and easy!

Note for end: While prefix 2002::/16 is supposed to be used for this purpose, IOS will work perfectly fine with any valid IPv6 prefix and build tunnels across IPv4 network.


Marko Milivojevic – CCIE #18427
Senior Technical Instructor – IPexpert
Join our Online Study List

Tunneling IPv6: 6to4 Tunnels, 4.8 out of 5 based on 4 ratings
Share and Enjoy:
  • RSS
  • Twitter
  • Facebook
  • Google Bookmarks
  • Digg
  • Print
  • Technorati
  • Slashdot
  • LinkedIn
  • del.icio.us
  • Reddit
  • Sphinn
  • Mixx
  • Blogplay
  • Netvibes
  • NewsVine
  • Live
  • Ping.fm
  • MySpace
  • Yahoo! Bookmarks
  • Yahoo! Buzz

Tags: , ,

5 Responses to “Tunneling IPv6: 6to4 Tunnels”

  1. Marc says:

    Thank you Marko, that made it perfectly clear and non-scary.

    VA:F [1.9.6_1107]
    Rating: 0.0/5 (0 votes cast)
  2. GLB says:

    any debug that shows the translation happnening?

    VA:F [1.9.6_1107]
    Rating: 0.0/5 (0 votes cast)
    • Isn’t ping enough? :-)


      Marko Milivojevic – CCIE #18427
      Senior Technical Instructor – IPexpert
      Join our Online Study List

      VN:F [1.9.6_1107]
      Rating: 0.0/5 (0 votes cast)
    • GLB says:

      yeah i guess it is :)>

      access-list 101 permit ip host 3.3.3.3 host 2.2.2.2
      access-list 101 permit ip host 2.2.2.2 host 3.3.3.3

      ipv6 access-list TUNN
      permit ipv6 host 2002:202:202:12::1 host 2002:303:303:4::4
      permit ipv6 host 2002:303:303:4::4 host 2002:202:202:12::1

      R2#sh debugging
      Generic IP:
      IP packet debugging is on (detailed) for access list 101
      Generic IPv6:
      IPv6 unicast packet debugging is on (detailed) for access list TUNN

      R2#debug ip packet detail 101
      IP packet debugging is on (detailed) for access list 101
      R2#
      *Mar 1 00:28:17.791: IPv6: Sending on Serial0/1
      *Mar 1 00:28:18.079: IPV6: source 2002:202:202:12::1 (Serial0/1)
      *Mar 1 00:28:18.079: dest 2002:303:303:4::4 (Tunnel0)
      *Mar 1 00:28:18.083: traffic class 0, flow 0×0, len 100+4, prot 58, hops 63, forwarding
      *Mar 1 00:28:18.083: IP: tableid=0, s=2.2.2.2 (local), d=3.3.3.3 (Serial0/0), routed via FIB
      *Mar 1 00:28:18.083: IP: s=2.2.2.2 (local), d=3.3.3.3 (Serial0/0), len 120, sending, proto=41
      *Mar 1 00:28:18.263: IP: tableid=0, s=3.3.3.3 (Serial0/0), d=2.2.2.2 (Loopback0), routed via RIB
      *Mar 1 00:28:18.267: IP: s=3.3.3.3 (Serial0/0), d=2.2.2.2, len 120, rcvd 4, proto=41
      *Mar 1 00:28:18.267: IPV6: source 2002:303:303:4::4 (Tunnel0)
      *Mar 1 00:28:18.271: dest 2002:202:202:12::1 (Serial0/1)
      *Mar 1 00:28:18.271: traffic class 0, flow 0×0, len 100+20, prot 58, hops 62, forwarding

      VA:F [1.9.6_1107]
      Rating: 0.0/5 (0 votes cast)
  3. [...] unlike automatic 6to4 tunnels, which I blogged about last time, ISATAP tunnels automatically send traffic to its IPv6 destination [...]

Leave a Reply