Which technique can you use to route IPv6 traffic over an IPv4 infrastructure?

PE routers—Two MX80 routers installed as provider edge (PE) routers that connect the IPv4 network to two disjoint IPv6 networks that require a logical path from one network to the other.

Before you begin configuring this example:

1. On each PE router, use the show chassis fpc pic-status operational mode command to determine which router line cards support filter-based GRE IPv4 tunneling and then use the

   [edit]
   user@PE1# set interfaces xe-0/0/0 unit 0 family inet address 10.0.1.10/30
   user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 address ::10.34.1.10/120
   user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 filter input gre_encap_1
   

   0 configuration statement to configure encapsulating and de-encapsulating interfaces.

   • At PE1, the encapsulator, configure one encapsulating interface on a supported line card.

   • At PE2, the de-encapsulator, configure three de-encapsulating interfaces on a supported line card.

2. Check that IPv4 routing protocols are enabled across the network to support routing paths from the encapsulator to the de-encapsulator.

   Configure routing information by manually adding static routes to route tables or by configuring static or dynamic route-sharing protocols. For more information, see Transport and Internet Protocols User Guide.

3. At PE1, ping the PE2 IPv4 loopback address to verify that the de-encapsulator is reachable from the encapsulator.

4. At PE2, ping the CE2 router IPv6 loopback address to verify that the destination customer edge router is reachable from the de-encapsulator..

   IPv6 routing paths from PE2 to CE2 can be provided by static routes manually added to routing tables or by static or dynamic route-sharing protocols.

   • By default, PE2 forwards packets based on interface routes (direct routes) imported from the primary routing table.

   • As an option, the de-encapsulating filter can specify that the Packet Forwarding Engine uses an alternate routing table to forward payload packets to the destination customer network. In an optional configuration task in this example, you specify an alternate routing table by installing static routes from PE2 to C1 in the routing instance blue. You configure the routing information base (RIB) group blue_group to specify that the route information of inet6.0 is shared with blue.inet6.0, then you associate the PE2 interfaces with routes stored in both the default routes and the routing instance.

In this example you configure a unidirectional filter-based GRE IPv4 tunnel from Router PE1 to Router PE2, providing a logical path from IPv6 network C1 to IPv6 network C2.

Note:

To enable bidirectional filter-based GRE tunneling, you must configure a second tunnel in the reverse direction.

As an optional task in this example, you can create a RIB group, which specifies the sharing of routing information (including routes learned from peers, local routes resulting from the application of protocol policies to the learned routes, and the routes advertised to peers) of multiple routing tables.

Topology

shows the path of IPv6 traffic transported from network C1 to network C2, across an IPv4 transport network using a filter-based tunnel from PE1 to PE2 and without requiring tunnel interfaces.

Figure 1: Filter-Based Tunnel from PE1 to PE2 in an IPv4 Network

summarizes the configuration of Router PE1 as the encapsulator. summarizes the configuration of Router PE2 as the de-encapsulator.

Table 1: Encapsulator Components on PE1

Component

CLI Names

Description

Encapsulator

Device name:IPv4 loopback:IPv6 loopback:

[edit]
user@PE1# set interfaces xe-0/0/0 unit 0 family inet address 10.0.1.10/30
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 address ::10.34.1.10/120
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 filter input gre_encap_1

[edit]
user@PE1# set interfaces xe-0/0/0 unit 0 family inet address 10.0.1.10/30
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 address ::10.34.1.10/120
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 filter input gre_encap_1

[edit]
user@PE1# set interfaces xe-0/0/0 unit 0 family inet address 10.0.1.10/30
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 address ::10.34.1.10/120
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 filter input gre_encap_1

MX80 router installed as an ingress PE router. PE1 connects the IPv4 network the customer edge router CE1 in the IPv6 source network C1.

Encapsulating interface

Interface name:IPv4 address:IPv6 address:

[edit]
user@PE1# set interfaces xe-0/0/0 unit 0 family inet address 10.0.1.10/30
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 address ::10.34.1.10/120
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 filter input gre_encap_1

[edit]
user@PE1# set interfaces xe-0/0/0 unit 0 family inet address 10.0.1.10/30
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 address ::10.34.1.10/120
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 filter input gre_encap_1

[edit]
user@PE1# set interfaces xe-0/0/0 unit 0 family inet address 10.0.1.10/30
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 address ::10.34.1.10/120
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 filter input gre_encap_1

Customer-facing logical interface hosted on a 10-Gigabit Ethernet MIC. CE1 sends this interface IPv6 traffic that originates at end-user hosts and is destined for applications or hosts on the IPv6 destination network C2.

Encapsulation filter

Filter name:

[edit]
user@PE1# set interfaces xe-0/0/0 unit 0 family inet address 10.0.1.10/30
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 address ::10.34.1.10/120
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 filter input gre_encap_1

IPv6 firewall filter whose action causes the Packet Forwarding Engine to encapsulate matched packets using the specified tunnel characteristics. Encapsulation consists of adding a GRE header, adding an IPv4 packet header, and then forwarding the resulting GRE packet through the GRE IPv4 tunnel.

Tunnel source interface

Interface name:IPv4 address:

[edit]
user@PE1# set interfaces xe-0/0/0 unit 0 family inet address 10.0.1.10/30
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 address ::10.34.1.10/120
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 filter input gre_encap_1

[edit]
user@PE1# set interfaces xe-0/0/0 unit 0 family inet address 10.0.1.10/30
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 address ::10.34.1.10/120
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 filter input gre_encap_1

Core-facing egress interface to the tunnel.

GRE tunnel template

Tunnel name:

[edit]
user@PE2# set interfaces xe-0/0/2 unit 0 family inet address 10.0.1.12/30

Defines the GRE IPv4 tunnel from Router PE1 (

[edit]
user@PE1# set interfaces xe-0/0/0 unit 0 family inet address 10.0.1.10/30
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 address ::10.34.1.10/120
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 filter input gre_encap_1

[edit]
user@PE2# set interfaces xe-0/0/2 unit 0 family inet address 10.0.1.12/30

[edit]
user@PE2# set interfaces xe-0/0/2 unit 0 family inet address 10.0.1.12/30

Table 2: De-Encapsulator Components on PE2

Component

CLI Names

Description

De-encapsulator

Device name:IPv4 loopback:IPv6 loopback:

[edit]
user@PE2# set interfaces xe-0/0/2 unit 0 family inet address 10.0.1.12/30

[edit]
user@PE2# set interfaces xe-0/0/2 unit 0 family inet address 10.0.1.12/30

[edit]
user@PE2# set interfaces xe-0/0/2 unit 0 family inet address 10.0.1.12/30

MX80 router installed as an egress PE router to receive GRE packets forwarded from ingress router PE1 across a GRE IPv4 tunnel.

De-encapsulating interfaces

Interface name:IPv4 address:

Interface name:IPv4 address:

Interface name:IPv4 address:

[edit]
user@PE1# set interfaces xe-0/0/0 unit 0 family inet address 10.0.1.10/30
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 address ::10.34.1.10/120
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 filter input gre_encap_1

[edit]
user@PE2# set interfaces xe-0/0/2 unit 0 family inet address 10.0.1.12/30

[edit]
user@PE2# set interfaces xe-0/0/2 unit 0 family inet address 10.0.1.12/30

[edit]
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then count c_gre_encap_1
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then encapsulate tunnel_1

[edit]
user@PE1# set interfaces xe-0/0/0 unit 0 family inet address 10.0.1.10/30
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 address ::10.34.1.10/120
user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 filter input gre_encap_1

[edit]
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then count c_gre_encap_1
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then encapsulate tunnel_1

Core-facing ingress logical interfaces hosted on 10-Gigabit Ethernet MICs. The interfaces receive GRE packets routed through the GRE IPv4 tunnel from PE1.

De-encapsulation filter

Filter name:

[edit]
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then count c_gre_encap_1
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then encapsulate tunnel_1

IPv4 firewall filter that applies the decapsulate action to GRE packets. The filter action causes the Packet Forwarding Engine to de-encapsulate matched packets.

De-encapsulation consists of removing the outer GRE header and then forwarding the inner IPv6 payload packet to its original destination on the destination IPv6 network by performing destination lookup on the default routing table.

Tunnel egress interface

Interface name:IPv4 address:IPv6 address:

[edit]
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then count c_gre_encap_1
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then encapsulate tunnel_1

[edit]
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then count c_gre_encap_1
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then encapsulate tunnel_1

[edit]
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then count c_gre_encap_1
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then encapsulate tunnel_1

Customer-facing interface though which the router forwards de-encapsulated IPv6 packets to the destination IPv6 network C2.

To transport IPv6 packets from CE1 to CE2 across an IPv4 transport network using a filter-based tunnel from PE1 to PE2 and without configuring tunnel interfaces, perform these tasks:

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the

[edit]
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then count c_gre_encap_1
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then encapsulate tunnel_1

Configuring PE1 to Encapsulate IPv6 Packets

set interfaces lo0 unit 0 family inet address 10.255.1.1
set interfaces lo0 unit 0 family inet6 address 2001:db8::1
set interfaces xe-0/0/0 unit 0 family inet address 10.0.1.10/30
set interfaces xe-0/0/0 unit 0 family inet6 address 2001::10.34.1.10/120
set interfaces xe-0/0/0 unit 0 family inet6 filter input gre_encap_1
set interfaces xe-0/0/2 unit 0 family inet address 10.0.1.12/30
set firewall family inet6 filter gre_encap_1 term t1 then count c_gre_encap_1
set firewall family inet6 filter gre_encap_1 term t1 then encapsulate tunnel_1
set firewall tunnel-end-point tunnel_1 ipv4 source-address 10.255.1.1
set firewall tunnel-end-point tunnel_1 ipv4 destination-address 10.255.2.2
set firewall tunnel-end-point tunnel_1 gre
 

Configuring PE2 to De-Encapsulate GRE Packets

set interfaces lo0 unit 0 family inet address 10.255.2.2
set interfaces lo0 unit 0 family inet6 address 2001:fc3::2
set interfaces xe-0/0/0 unit 0 family inet address 10.0.2.20/30
set interfaces xe-0/0/1 unit 0 family inet address 10.0.2.21/30
set interfaces xe-0/0/2 unit 0 family inet address 10.0.2.22/30
set interfaces xe-0/0/3 unit 0 family inet address 10.0.2.23/30
set interfaces xe-0/0/3 unit 0 family inet6 address ::20.34.2.23/120
set forwarding-options family inet filter input gre_decap_1
set firewall family inet filter gre_decap_1 term t1 from source-address 10.255.1.1/32
set firewall family inet filter gre_decap_1 term t1 from destination-address 10.255.2.2/32
set firewall family inet filter gre_decap_1 term t1 then count c_gre_decap_1
set firewall family inet filter gre_decap_1 term t1 then decapsulate gre

Optional: Configuring PE2 with an Alternate Routing Table

set routing-instances blue instance-type forwarding
set routing-instances blue routing-options rib blue.inet6.0 static route 0::/0 next-hop fec0:0:2003::2
set routing-options passive
set routing-options rib inet6.0
set routing-options rib-groups blue_group import-rib inet6.0
set routing-options rib-groups blue_group import-rib blue.inet6.0
set routing-options interface-routes rib-group inet6 blue_group
set firewall family inet filter gre_decap_1 term t1 then decapsulate gre routing-instance blue

Configuring PE1 to Encapsulate IPv6 Packets

Step-by-Step Procedure

To configure Router PE1 to encapsulate IPv6 packets arriving from CE1:

1. Configure the router loopback addresses.

   [edit]
   user@PE1# set interfaces lo0 unit 0 family inet address 10.255.1.1
   user@PE1# set interfaces lo0 unit 0 family inet6 address 2001:db8::1
   

2. Configure the encapsulating interface IPv4 and IPv6 addresses and attach the encapsulating filter to the IPv6 input.

   [edit]
   user@PE1# set interfaces xe-0/0/0 unit 0 family inet address 10.0.1.10/30
   user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 address ::10.34.1.10/120
   user@PE1# set interfaces xe-0/0/0 unit 0 family inet6 filter input gre_encap_1
   

3. Configure the core-facing egress interface to the tunnel.

   [edit]
   user@PE2# set interfaces xe-0/0/2 unit 0 family inet address 10.0.1.12/30
   

4. Define an IPv6 firewall filter that causes the Packet Forwarding Engine to encapsulate all packets.

   [edit]
   user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then count c_gre_encap_1
   user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then encapsulate tunnel_1
   

   Note:

   The encapsulate firewall filter action is a terminating filter action. A filter-terminating action halts all evaluation of a firewall filter for a specific packet. The router performs the specified action, and no additional terms are examined.

5. Define a GRE IPv4 tunnel template named tunnel_1 that specifies the host IP addresses of the one tunnel source interface and three tunnel destination interfaces.

   [edit]
   user@PE1# set firewall tunnel-end-point tunnel_1 ipv4 source-address 10.255.1.1
   user@PE1# set firewall tunnel-end-point tunnel_1 ipv4 destination-address 10.255.2.2
   user@PE1# set firewall tunnel-end-point tunnel_1 gre
   

   Note:

   You can tunnel multiple but distinct flows from 10.0.1.10 (the tunnel source interface on PE1) to 10.0.2.20 – 10.0.2.22 (the de-encapsulating interfaces on PE2) if you use the GRE option key number to uniquely identify each tunnel.

6. If you are done configuring the device, commit the configuration.

   [edit ]
   user@PE1# commit
   

Results

From configuration mode, confirm your configuration by entering the

[edit]
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then count c_gre_encap_1
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then encapsulate tunnel_1

[edit]
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then count c_gre_encap_1
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then encapsulate tunnel_1

Router PE1

Confirm the firewall filter and tunnel template on the encapsulator.

user@PE2# show firewall
family inet6 {
    filter gre_encap_1 {
        term t1 {
            then {
                count c_gre_encap_1;
                encapsulate tunnel_1;
            }
        }
    }
}
tunnel-end-point tunnel_1 {
    ipv4 {
        source-address 10.255.1.1;
        destination-address 10.255.2.2;
    }
    gre;
}

Router PE1

Confirm the interfaces on the encapsulator.

set interfaces lo0 unit 0 family inet address 10.255.2.2
set interfaces lo0 unit 0 family inet6 address 2001:fc3::2
set interfaces xe-0/0/0 unit 0 family inet address 10.0.2.20/30
set interfaces xe-0/0/1 unit 0 family inet address 10.0.2.21/30
set interfaces xe-0/0/2 unit 0 family inet address 10.0.2.22/30
set interfaces xe-0/0/3 unit 0 family inet address 10.0.2.23/30
set interfaces xe-0/0/3 unit 0 family inet6 address ::20.34.2.23/120
set forwarding-options family inet filter input gre_decap_1
set firewall family inet filter gre_decap_1 term t1 from source-address 10.255.1.1/32
set firewall family inet filter gre_decap_1 term t1 from destination-address 10.255.2.2/32
set firewall family inet filter gre_decap_1 term t1 then count c_gre_decap_1
set firewall family inet filter gre_decap_1 term t1 then decapsulate gre

Configuring PE2 to De-Encapsulate GRE Packets

Step-by-Step Procedure

To configure Router PE2 to de-encapsulate GRE packets arriving from the IPv4 tunnel:

1. Configure the router loopback address.

   set interfaces lo0 unit 0 family inet address 10.255.2.2
   set interfaces lo0 unit 0 family inet6 address 2001:fc3::2
   set interfaces xe-0/0/0 unit 0 family inet address 10.0.2.20/30
   set interfaces xe-0/0/1 unit 0 family inet address 10.0.2.21/30
   set interfaces xe-0/0/2 unit 0 family inet address 10.0.2.22/30
   set interfaces xe-0/0/3 unit 0 family inet address 10.0.2.23/30
   set interfaces xe-0/0/3 unit 0 family inet6 address ::20.34.2.23/120
   set forwarding-options family inet filter input gre_decap_1
   set firewall family inet filter gre_decap_1 term t1 from source-address 10.255.1.1/32
   set firewall family inet filter gre_decap_1 term t1 from destination-address 10.255.2.2/32
   set firewall family inet filter gre_decap_1 term t1 then count c_gre_decap_1
   set firewall family inet filter gre_decap_1 term t1 then decapsulate gre

   1

2. Configure the de-encapsulating interfaces.

   set interfaces lo0 unit 0 family inet address 10.255.2.2
   set interfaces lo0 unit 0 family inet6 address 2001:fc3::2
   set interfaces xe-0/0/0 unit 0 family inet address 10.0.2.20/30
   set interfaces xe-0/0/1 unit 0 family inet address 10.0.2.21/30
   set interfaces xe-0/0/2 unit 0 family inet address 10.0.2.22/30
   set interfaces xe-0/0/3 unit 0 family inet address 10.0.2.23/30
   set interfaces xe-0/0/3 unit 0 family inet6 address ::20.34.2.23/120
   set forwarding-options family inet filter input gre_decap_1
   set firewall family inet filter gre_decap_1 term t1 from source-address 10.255.1.1/32
   set firewall family inet filter gre_decap_1 term t1 from destination-address 10.255.2.2/32
   set firewall family inet filter gre_decap_1 term t1 then count c_gre_decap_1
   set firewall family inet filter gre_decap_1 term t1 then decapsulate gre

   2

3. Configure the customer-facing egress interface to CE2.

   set interfaces lo0 unit 0 family inet address 10.255.2.2
   set interfaces lo0 unit 0 family inet6 address 2001:fc3::2
   set interfaces xe-0/0/0 unit 0 family inet address 10.0.2.20/30
   set interfaces xe-0/0/1 unit 0 family inet address 10.0.2.21/30
   set interfaces xe-0/0/2 unit 0 family inet address 10.0.2.22/30
   set interfaces xe-0/0/3 unit 0 family inet address 10.0.2.23/30
   set interfaces xe-0/0/3 unit 0 family inet6 address ::20.34.2.23/120
   set forwarding-options family inet filter input gre_decap_1
   set firewall family inet filter gre_decap_1 term t1 from source-address 10.255.1.1/32
   set firewall family inet filter gre_decap_1 term t1 from destination-address 10.255.2.2/32
   set firewall family inet filter gre_decap_1 term t1 then count c_gre_decap_1
   set firewall family inet filter gre_decap_1 term t1 then decapsulate gre

   3

4. Apply the ingress de-encapsulating firewall filter to all forwarded packets.

   set interfaces lo0 unit 0 family inet address 10.255.2.2
   set interfaces lo0 unit 0 family inet6 address 2001:fc3::2
   set interfaces xe-0/0/0 unit 0 family inet address 10.0.2.20/30
   set interfaces xe-0/0/1 unit 0 family inet address 10.0.2.21/30
   set interfaces xe-0/0/2 unit 0 family inet address 10.0.2.22/30
   set interfaces xe-0/0/3 unit 0 family inet address 10.0.2.23/30
   set interfaces xe-0/0/3 unit 0 family inet6 address ::20.34.2.23/120
   set forwarding-options family inet filter input gre_decap_1
   set firewall family inet filter gre_decap_1 term t1 from source-address 10.255.1.1/32
   set firewall family inet filter gre_decap_1 term t1 from destination-address 10.255.2.2/32
   set firewall family inet filter gre_decap_1 term t1 then count c_gre_decap_1
   set firewall family inet filter gre_decap_1 term t1 then decapsulate gre

   4

5. Define IPv4 filter gre_decap_1.

   Define an IPv4 filter that de-encapsulates and forwards all GRE packets.

   set interfaces lo0 unit 0 family inet address 10.255.2.2
   set interfaces lo0 unit 0 family inet6 address 2001:fc3::2
   set interfaces xe-0/0/0 unit 0 family inet address 10.0.2.20/30
   set interfaces xe-0/0/1 unit 0 family inet address 10.0.2.21/30
   set interfaces xe-0/0/2 unit 0 family inet address 10.0.2.22/30
   set interfaces xe-0/0/3 unit 0 family inet address 10.0.2.23/30
   set interfaces xe-0/0/3 unit 0 family inet6 address ::20.34.2.23/120
   set forwarding-options family inet filter input gre_decap_1
   set firewall family inet filter gre_decap_1 term t1 from source-address 10.255.1.1/32
   set firewall family inet filter gre_decap_1 term t1 from destination-address 10.255.2.2/32
   set firewall family inet filter gre_decap_1 term t1 then count c_gre_decap_1
   set firewall family inet filter gre_decap_1 term t1 then decapsulate gre

   5

6. Configure term t1 to match packets transported across the tunnel tunnel_1 defined on Router PE1. The tunnel sends packets from Router PE1 (configured with IPv4 loopback address 10.255.1.1) to Router PE2 (configured with IPv4 loopback address 10.255.2.2).

   set interfaces lo0 unit 0 family inet address 10.255.2.2
   set interfaces lo0 unit 0 family inet6 address 2001:fc3::2
   set interfaces xe-0/0/0 unit 0 family inet address 10.0.2.20/30
   set interfaces xe-0/0/1 unit 0 family inet address 10.0.2.21/30
   set interfaces xe-0/0/2 unit 0 family inet address 10.0.2.22/30
   set interfaces xe-0/0/3 unit 0 family inet address 10.0.2.23/30
   set interfaces xe-0/0/3 unit 0 family inet6 address ::20.34.2.23/120
   set forwarding-options family inet filter input gre_decap_1
   set firewall family inet filter gre_decap_1 term t1 from source-address 10.255.1.1/32
   set firewall family inet filter gre_decap_1 term t1 from destination-address 10.255.2.2/32
   set firewall family inet filter gre_decap_1 term t1 then count c_gre_decap_1
   set firewall family inet filter gre_decap_1 term t1 then decapsulate gre

   6

7. Configure term t1 to count and de-encapsulate matched packets.

   set interfaces lo0 unit 0 family inet address 10.255.2.2
   set interfaces lo0 unit 0 family inet6 address 2001:fc3::2
   set interfaces xe-0/0/0 unit 0 family inet address 10.0.2.20/30
   set interfaces xe-0/0/1 unit 0 family inet address 10.0.2.21/30
   set interfaces xe-0/0/2 unit 0 family inet address 10.0.2.22/30
   set interfaces xe-0/0/3 unit 0 family inet address 10.0.2.23/30
   set interfaces xe-0/0/3 unit 0 family inet6 address ::20.34.2.23/120
   set forwarding-options family inet filter input gre_decap_1
   set firewall family inet filter gre_decap_1 term t1 from source-address 10.255.1.1/32
   set firewall family inet filter gre_decap_1 term t1 from destination-address 10.255.2.2/32
   set firewall family inet filter gre_decap_1 term t1 then count c_gre_decap_1
   set firewall family inet filter gre_decap_1 term t1 then decapsulate gre

   7

   If the de-encapsulating filter action decapsulate references the blue routing instance, make sure that the routing instance is configured and that the RIB group blue_group defines the sharing of the alternate routes into the primary table.

8. If you are done configuring the device, commit the configuration.

   set interfaces lo0 unit 0 family inet address 10.255.2.2
   set interfaces lo0 unit 0 family inet6 address 2001:fc3::2
   set interfaces xe-0/0/0 unit 0 family inet address 10.0.2.20/30
   set interfaces xe-0/0/1 unit 0 family inet address 10.0.2.21/30
   set interfaces xe-0/0/2 unit 0 family inet address 10.0.2.22/30
   set interfaces xe-0/0/3 unit 0 family inet address 10.0.2.23/30
   set interfaces xe-0/0/3 unit 0 family inet6 address ::20.34.2.23/120
   set forwarding-options family inet filter input gre_decap_1
   set firewall family inet filter gre_decap_1 term t1 from source-address 10.255.1.1/32
   set firewall family inet filter gre_decap_1 term t1 from destination-address 10.255.2.2/32
   set firewall family inet filter gre_decap_1 term t1 then count c_gre_decap_1
   set firewall family inet filter gre_decap_1 term t1 then decapsulate gre

   8

Results

From configuration mode, confirm your configuration by entering the

[edit]
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then count c_gre_encap_1
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then encapsulate tunnel_1

[edit]
user@PE1# set firewall tunnel-end-point tunnel_1 ipv4 source-address 10.255.1.1
user@PE1# set firewall tunnel-end-point tunnel_1 ipv4 destination-address 10.255.2.2
user@PE1# set firewall tunnel-end-point tunnel_1 gre

[edit]
user@PE1# set firewall tunnel-end-point tunnel_1 ipv4 source-address 10.255.1.1
user@PE1# set firewall tunnel-end-point tunnel_1 ipv4 destination-address 10.255.2.2
user@PE1# set firewall tunnel-end-point tunnel_1 gre

Router PE2

Confirm the firewall filter on the de-encapsulator.

set interfaces lo0 unit 0 family inet address 10.255.2.2
set interfaces lo0 unit 0 family inet6 address 2001:fc3::2
set interfaces xe-0/0/0 unit 0 family inet address 10.0.2.20/30
set interfaces xe-0/0/1 unit 0 family inet address 10.0.2.21/30
set interfaces xe-0/0/2 unit 0 family inet address 10.0.2.22/30
set interfaces xe-0/0/3 unit 0 family inet address 10.0.2.23/30
set interfaces xe-0/0/3 unit 0 family inet6 address ::20.34.2.23/120
set forwarding-options family inet filter input gre_decap_1
set firewall family inet filter gre_decap_1 term t1 from source-address 10.255.1.1/32
set firewall family inet filter gre_decap_1 term t1 from destination-address 10.255.2.2/32
set firewall family inet filter gre_decap_1 term t1 then count c_gre_decap_1
set firewall family inet filter gre_decap_1 term t1 then decapsulate gre

Note:

If the de-encapsulating filter action decapsulate references the blue routing instance, make sure that the routing instance is configured and that the RIB group blue_group defines the sharing of the alternate routes into the primary table.

Router PE2

Confirm the forwarding options (for attaching the de-encapsulating firewall filter to all input forwarded packets) on the de-encapsulator.

set routing-instances blue instance-type forwarding
set routing-instances blue routing-options rib blue.inet6.0 static route 0::/0 next-hop fec0:0:2003::2
set routing-options passive
set routing-options rib inet6.0
set routing-options rib-groups blue_group import-rib inet6.0
set routing-options rib-groups blue_group import-rib blue.inet6.0
set routing-options interface-routes rib-group inet6 blue_group
set firewall family inet filter gre_decap_1 term t1 then decapsulate gre routing-instance blue

Router PE2

Confirm the interfaces on the de-encapsulator.

set routing-instances blue instance-type forwarding
set routing-instances blue routing-options rib blue.inet6.0 static route 0::/0 next-hop fec0:0:2003::2
set routing-options passive
set routing-options rib inet6.0
set routing-options rib-groups blue_group import-rib inet6.0
set routing-options rib-groups blue_group import-rib blue.inet6.0
set routing-options interface-routes rib-group inet6 blue_group
set firewall family inet filter gre_decap_1 term t1 then decapsulate gre routing-instance blue

Optional: Configuring PE2 with an Alternate Routing Table

Step-by-Step Procedure

To configure Router PE2 with an alternate routing table:

1. Configure the routing instance blue, and add static routes to CE2.

   set routing-instances blue instance-type forwarding
   set routing-instances blue routing-options rib blue.inet6.0 static route 0::/0 next-hop fec0:0:2003::2
   set routing-options passive
   set routing-options rib inet6.0
   set routing-options rib-groups blue_group import-rib inet6.0
   set routing-options rib-groups blue_group import-rib blue.inet6.0
   set routing-options interface-routes rib-group inet6 blue_group
   set firewall family inet filter gre_decap_1 term t1 then decapsulate gre routing-instance blue

   2

   The Junos OS software generates the routing table blue.inet6.0 using the routing information learned within the instance.

2. Enable routes to remain in routing and forwarding tables, even if the routes become inactive. This allows a static route to remain in the table if the next hop is unavailable.

   set routing-instances blue instance-type forwarding
   set routing-instances blue routing-options rib blue.inet6.0 static route 0::/0 next-hop fec0:0:2003::2
   set routing-options passive
   set routing-options rib inet6.0
   set routing-options rib-groups blue_group import-rib inet6.0
   set routing-options rib-groups blue_group import-rib blue.inet6.0
   set routing-options interface-routes rib-group inet6 blue_group
   set firewall family inet filter gre_decap_1 term t1 then decapsulate gre routing-instance blue

   3

3. Create a RIB group by explicitly creating the default routing table.

   set routing-instances blue instance-type forwarding
   set routing-instances blue routing-options rib blue.inet6.0 static route 0::/0 next-hop fec0:0:2003::2
   set routing-options passive
   set routing-options rib inet6.0
   set routing-options rib-groups blue_group import-rib inet6.0
   set routing-options rib-groups blue_group import-rib blue.inet6.0
   set routing-options interface-routes rib-group inet6 blue_group
   set firewall family inet filter gre_decap_1 term t1 then decapsulate gre routing-instance blue

   4

4. Define the RIB group blue_group.

   set routing-instances blue instance-type forwarding
   set routing-instances blue routing-options rib blue.inet6.0 static route 0::/0 next-hop fec0:0:2003::2
   set routing-options passive
   set routing-options rib inet6.0
   set routing-options rib-groups blue_group import-rib inet6.0
   set routing-options rib-groups blue_group import-rib blue.inet6.0
   set routing-options interface-routes rib-group inet6 blue_group
   set firewall family inet filter gre_decap_1 term t1 then decapsulate gre routing-instance blue

   5

   In the import-rib statement, specify the primary routing table first.

5. Associate the router interfaces with routing information specified by the RIB group.

   set routing-instances blue instance-type forwarding
   set routing-instances blue routing-options rib blue.inet6.0 static route 0::/0 next-hop fec0:0:2003::2
   set routing-options passive
   set routing-options rib inet6.0
   set routing-options rib-groups blue_group import-rib inet6.0
   set routing-options rib-groups blue_group import-rib blue.inet6.0
   set routing-options interface-routes rib-group inet6 blue_group
   set firewall family inet filter gre_decap_1 term t1 then decapsulate gre routing-instance blue

   6

6. If you are done configuring the device, commit the configuration.

   set routing-instances blue instance-type forwarding
   set routing-instances blue routing-options rib blue.inet6.0 static route 0::/0 next-hop fec0:0:2003::2
   set routing-options passive
   set routing-options rib inet6.0
   set routing-options rib-groups blue_group import-rib inet6.0
   set routing-options rib-groups blue_group import-rib blue.inet6.0
   set routing-options interface-routes rib-group inet6 blue_group
   set firewall family inet filter gre_decap_1 term t1 then decapsulate gre routing-instance blue

   7

Results

From configuration mode, confirm your configuration by entering the

[edit]
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then count c_gre_encap_1
user@PE1# set firewall family inet6 filter gre_encap_1 term t1 then encapsulate tunnel_1

[edit]
user@PE1# set firewall tunnel-end-point tunnel_1 ipv4 source-address 10.255.1.1
user@PE1# set firewall tunnel-end-point tunnel_1 ipv4 destination-address 10.255.2.2
user@PE1# set firewall tunnel-end-point tunnel_1 gre

[edit]
user@PE1# set firewall tunnel-end-point tunnel_1 ipv4 source-address 10.255.1.1
user@PE1# set firewall tunnel-end-point tunnel_1 ipv4 destination-address 10.255.2.2
user@PE1# set firewall tunnel-end-point tunnel_1 gre

Router PE2

If you configured an alternate routing table on Router PE2, confirm the routing instance configuration.

set routing-instances blue instance-type forwarding
set routing-instances blue routing-options rib blue.inet6.0 static route 0::/0 next-hop fec0:0:2003::2
set routing-options passive
set routing-options rib inet6.0
set routing-options rib-groups blue_group import-rib inet6.0
set routing-options rib-groups blue_group import-rib blue.inet6.0
set routing-options interface-routes rib-group inet6 blue_group
set firewall family inet filter gre_decap_1 term t1 then decapsulate gre routing-instance blue

Router PE2

If you configured an alternate routing table on Router PE2, confirm the RIB group and direct routing configurations.

set routing-instances blue instance-type forwarding
set routing-instances blue routing-options rib blue.inet6.0 static route 0::/0 next-hop fec0:0:2003::2
set routing-options passive
set routing-options rib inet6.0
set routing-options rib-groups blue_group import-rib inet6.0
set routing-options rib-groups blue_group import-rib blue.inet6.0
set routing-options interface-routes rib-group inet6 blue_group
set firewall family inet filter gre_decap_1 term t1 then decapsulate gre routing-instance blue

Confirm that the configurations are working properly.

Verifying Routing Information

Purpose

Verify that the direct routes include the alternate routing table information.

Action

To perform the verification:

1. (Optional) To verify the routing instance blue on PE2, use the show route instance operational mode command to display the primary table and number of routes for that routing instance.

   [edit]
   user@PE1# set interfaces lo0 unit 0 family inet address 10.255.1.1
   user@PE1# set interfaces lo0 unit 0 family inet6 address 2001:db8::1
   

   0

2. (Optional) To view the routing table associated with the routing instance blue on PE2, use the show route table operational mode command

   [edit]
   user@PE1# set interfaces lo0 unit 0 family inet address 10.255.1.1
   user@PE1# set interfaces lo0 unit 0 family inet6 address 2001:db8::1
   

   1

3. (Optional) To verify that the alternate routes from routing instance blue have been imported to the PE2 forwarding table, use the show route forwarding-table operational mode command to display the contents of the router forwarding table and the routing instance forwarding table.

   [edit]
   user@PE1# set interfaces lo0 unit 0 family inet address 10.255.1.1
   user@PE1# set interfaces lo0 unit 0 family inet6 address 2001:db8::1
   

   2

Verifying Encapsulation on PE1

Purpose

Verify the encapsulating interface on PE1.

Action

To perform the verification:

1. Use the show interfaces filters operational mode command to verify that the encapsulating firewall filter is attached to the ingress of the encapsulating interface.

   [edit]
   user@PE1# set interfaces lo0 unit 0 family inet address 10.255.1.1
   user@PE1# set interfaces lo0 unit 0 family inet6 address 2001:db8::1
   

   3

2. Use the show interfaces operational mode command to verify that the encapsulating interface is receiving packets.

   [edit]
   user@PE1# set interfaces lo0 unit 0 family inet address 10.255.1.1
   user@PE1# set interfaces lo0 unit 0 family inet6 address 2001:db8::1
   

   4

3. Use the show firewall filter operational mode command to verify that ingress passenger protocol traffic triggers the encapsulating filter.

   [edit]
   user@PE1# set interfaces lo0 unit 0 family inet address 10.255.1.1
   user@PE1# set interfaces lo0 unit 0 family inet6 address 2001:db8::1
   

   5

Meaning

If the encapsulating filter is attached to the encapsulating interface, and the encapsulating interface receives passenger protocol traffic, and the firewall filter statistics show that ingress passenger protocol traffic is being encapsulated, then GRE packets are being forwarded through the tunnel.

Verifying De-Encapsulation on PE2

Purpose

Verify the de-encapsulating interfaces on PE2.

Action

To perform the verification:

1. On PE1, use the ping operational mode command to verify that PE2 is reachable.

   [edit]
   user@PE1# set interfaces lo0 unit 0 family inet address 10.255.1.1
   user@PE1# set interfaces lo0 unit 0 family inet6 address 2001:db8::1
   

   6

2. On PE2, use the show interfaces filter operational mode command to verify that the de-encapsulating firewall filter is attached to the ingress of the de-encapsulating interfaces.

   [edit]
   user@PE1# set interfaces lo0 unit 0 family inet address 10.255.1.1
   user@PE1# set interfaces lo0 unit 0 family inet6 address 2001:db8::1
   

   7

3. On PE2, use the show interfaces operational mode command to verify that the de-encapsulating interfaces are receiving packets.

   [edit]
   user@PE1# set interfaces lo0 unit 0 family inet address 10.255.1.1
   user@PE1# set interfaces lo0 unit 0 family inet6 address 2001:db8::1
   

   8

   Depending on how routing is configured and which links are up and which links are down, some of the de-encapsulating interfaces might not be receiving packets although the tunnel is operating properly.

4. On PE2, use the show firewall filter operational mode command to verify that ingress GRE traffic triggers the de-encapsulating filter.

   [edit]
   user@PE1# set interfaces lo0 unit 0 family inet address 10.255.1.1
   user@PE1# set interfaces lo0 unit 0 family inet6 address 2001:db8::1
   

   9

Meaning

The verification confirms the following operational states and activities of the encapsulator:

• PE2 is reachable from the PE1.

• The de-encapsulating filter is attached to the input of all de-encapsulating interfaces.

• The de-encapsulator is receiving traffic at de-encapsulating interfaces as expected.

• GRE packets received at the de-encapsulating interfaces trigger the de-encapsulating firewall filter action.

  How to route IPv6 via IPv4?

  native routing between IPv4 and IPv6 networks is not possible. You can have a NAT translation from IPv6 into IPv4. For it to be effective, you might also need DNS64, which is a translation of address in DNS query to return AAAA record instead of A record. Please, read this article, t describes NAT64 very well.

  How does IPv6 travel over IPv4 networks?

  IPv6 over IPv4 tunnels are point-to-point tunnels made by encapsulating IPv6 packets within IPv4 headers to carry them over IPv4 routing infrastructures. This allows isolated IPv6 end systems and devices to communicate without the need to upgrade the IPv4 infrastructure that exists between them.

  How to configure IPv6 tunneling over IPv4?

  How to Configure IPv6 Over IPv4 Tunnels.

  Become superuser..

  Create the file /etc/hostname6. ip. tun n . Use the values 0, 1, 2, and so on, for n . Then, add entries by following these steps. Add the tunnel source addresses. Then, add the tunnel destination addresses. tsrc IPv4-source-addr tdst IPv4-destination-addr up..

  Which protocol tunnels IPv6 traffic over IPv4 networks for intranet communications?

  Teredo operates using a platform independent tunneling protocol that provides IPv6 (Internet Protocol version 6) connectivity by encapsulating IPv6 datagram packets within IPv4 User Datagram Protocol (UDP) packets. Teredo routes these datagrams on the IPv4 Internet and through NAT devices.