6to4 IPv6 – Configuring Tunnel Address

ciscoipip addressipv4ipv6

http://packetlife.net/blog/2010/mar/15/6to4-ipv6-tunneling/

In order to configure a 6to4 tunnel on R2 router, you execute the following commands:

R2(config)# interface tunnel0
R2(config-if)# tunnel mode ipv6ip 6to4
R2(config-if)# tunnel source 10.0.2.1
R2(config-if)# ipv6 address 2002:a00:201::/128

Does anyone know why on earth should I specify the Ipv6 address of the tunnel (last command)? The fact that I've written:

R2(config-if)# ipv6 address 2002:a00:201::/128

is not used by R2 at any point, I believe – R2 doesn't need that information.

When an IPv6 host behind R1 sends a packet to an IPv6 host 2001:db8:0:2::/64 behind R2, the first thing that happens is R1 checks its routing table. We configured R1 in the following way:

ipv6 route 2002::/16 tunnel0
ipv6 route 2001:db8:0:2::/64 2002:a00:201::

It then puts the IPv6 packet inside an IPv4 packet and sets the IPv4 destination address to 10.0.2.1 – it extracts the destination address from the second address in this line, which created an entry in the routing table: ipv6 route 2001:db8:0:2::/64 2002:a00:201::.

So if we didn't set the IPv6 tunnel address on R2 (R2(config-if)# ipv6 address 2002:a00:201::/128), I guess it wouldn't change anything, because the packet would arrive to R2 anyway. Then why should we do it?

By the way, 10.0.2.1 is a private IP address, so it shouldn't be used in a 6to4 address (only public IPs are allowed) – I think the article is wrong in this aspect.

Best Answer

The IPv6 address is the network address assigned to the interface of the tunnel. I don't know where you came up with the /128 because that is used for something like a loopback.

Specifies the IPv6 network assigned to the interface and enables IPv6 processing on the interface.

Something like this from the Cisco documentation:

Example: Configuring 6to4 Tunnels

The following example configures a 6to4 tunnel on a border router in an isolated IPv6 network. The IPv4 address is 192.168.99.1, which translates to the IPv6 prefix of 2002:c0a8:6301::/48. The IPv6 prefix is subnetted into 2002:c0a8:6301::/64 for the tunnel interface: 2002:c0a8:6301:1::/64 for the first IPv6 network, and 2002:c0a8:6301:2::/64 for the second IPv6 network. The static route ensures that any other traffic for the IPv6 prefix 2002::/16 is directed to tunnel interface 0 for automatic tunneling.

interface GigabitEthernet0/0/0
 description IPv4 uplink
 ip address 192.168.99.1 255.255.255.0
!
interface GigabitEthernet1/0/0
 description IPv6 local network 1
 ipv6 address 2002:c0a8:6301:1::1/64 
!
interface GigabitEthernet2/0/0
 description IPv6 local network 2
 ipv6 address 2002:c0a8:6301:2::1/64 
!
interface Tunnel0
 description IPv6 uplink
 no ip address
 ipv6 address 2002:c0a8:6301::1/64 
 tunnel source GigabitEthernet0/0/0
 tunnel mode ipv6ip 6to4
!
ipv6 route 2002::/16 tunnel 0

Related Solutions

Cisco IPv6 – 6rd Configuration Example with General-Prefix

ipv6 general-prefix DELEGATED_PREFIX 6rd Tunnel0

This line defines DELEGATED_PREFIX. It automatically calculates the IPv6 prefix based on the 6rd settings of the Tunnel0 interface.

ipv6 address DELEGATED_PREFIX ::/128 anycast (on int Tunnel 0)

This line sets an IPv6 address on the Tunnel0 interface using the DELEGATED_PREFIX defined before. It tells the router to take the prefix, leave the other bits zero (::) and configure it as a single anycast address. The anycast flag tells the router that the address may be used on multiple devices at the same time. It will therefore not perform any Duplicate Address Detection (not really relevant for a tunnel interface) and it will not use that address as a source address (because the return traffic might end up at one of the other anycast nodes).

ipv6 address DELEGATED_PREFIX ::/64 eui-64 (on int Ethernet 0)

This does the same for the Ethernet0 interface. It uses the DELEGATED_PREFIX to give an address to the interface. One problem is that you're using the same subnet on the tunnel interface. You should use separate subnets for different interfaces. The eui-64 flag tells the router to generate the last 64 bits of the interface address based on its MAC address.

An example to (hopefully) make things clearer:

Let's take the 6rd settings from the example:

6rd IPv4 prefix: 10.0.0.0/8
6rd IPv6 prefix: 2001:db80::/28

Then if your router has IPv4 address 10.0.0.10 you will get IPv6 prefix 2001:db80:0:a000::/52. The /8 in the IPv4 prefix means that the first 8 bits are fixed. So when constructing the IPv6 prefix it will only use the last 24 (32 - 8) bits from the IPv4 address. These have binary value 0000 0000 0000 0000 0000 1010. When written in hexadecimal that is 00 00 0a. This is appended to the /28 IPv6 prefix, giving a /52 (28 + 24).

So DELEGATED_PREFIX will get value 2001:db80:0:a000::/52. Therefore the Tunnel0 interface will get address 2001:db80:0:a000::/128 and the Ethernet0 interface will get something like 2001:db80:0:a000:1234:56ff:fe78:90ab/64 (assuming MAC address 12.34.56.78.90.ab).

It would be better to give the ethernet interface an address from a different subnet, like:

ipv6 address DELEGATED_PREFIX 0:0:0:1::/64 eui-64

That would result in 2001:db80:0:a001:1234:56ff:fe78:90ab/64. And if you don't want to make the address dependent on the MAC address you can also just give it a fixed address:

ipv6 address DELEGATED_PREFIX 0:0:0:1::1/64

That would result in 2001:db80:0:a001::1/64.

IPv6 – Understanding the 6to4 Mechanism

You are correct that 6to4 is for allowing IPv6 hosts (actually whole networks of IPv6 hosts) to talk to other IPv6 hosts. It does that by doing automatic tunnelling: putting the IPv6 packet into an IPv4 packet. This is done by a router that has both IPv4 and IPv6. That IPv4 packet can then be transmitted over the IPv4 internet (which doesn't know how to handle IPv6 at all) to another router that has both IPv4 and IPv6. The IPv4 wrapper is taken off, and the IPv6 packet can travel to its destination.

This is just basic tunnelling. What makes 6to4 so special? It is that the IPv4 address of the router is communicated inside the IPv6 prefix. For example: the address between 2002:c000:0204:0000:0000:0000:0000:0000 and 2002:c000:0204:ffff:ffff:ffff:ffff:ffff can be reached by wrapping (encapsulating) the IPv6 packet inside an IPv4 packet and sending that packet to IPv4 address 192.0.2.4 (c0=192, 00=0, 02=2, 04=4). That makes it possible for people whose provider doesn't give them IPv6 but does give them a public IPv4 address to get their own IPv6 addresses. With a /48 you can create 65536 subnets (which are a /64 each).

The problem occurs when communicating with systems that have 'normal' IPv6 addresses. Such addresses don't have an IPv4 address encoded in the IPv6 address and therefore the 6to4 router doesn't know which IPv4 address to send the packets to. So it has to send them to a 3rd-party relay that is connected to the normal IPv6 internet. The quality of such relays is very unpredictable, and therefore the connectivity to the normal IPv6 internet is often bad. Therefore such deployment of 6to4 is deprecated (see RFC7526).

If you want IPv6 access then first complain to your ISP. If they don't want to provide IPv6 then find a decent ISP that does. If you can't get IPv6 from an ISP then you should look at i.e. tunnelbroker.net. They provide free IPv6 tunnels with proper connectivity. It's not optimal, but it's much much better than unreliable 6to4.

Based on the chat discussion some extra information:

6to4 is an obsolete technology. It was meant to give IPv6 addresses and routeability to people whose ISP didn't provide proper IPv6. A quick overview:

you need a device with a public IPv4 address
From that IPv6 address you derive a /48 prefix to use with 6to4
so my address (37.77.56.75) would become 2002:254d:384b::/48
that prefix can then be used to provision my whole house/business/etc with IPv6
that is where you need subnetting
the device with the public IPv4 address is the gateway between my internal IPv6 network and the rest of the IPv6 world
and your LANs are numbered out of that 2002:....:....::/48 prefix

And that's it basically :)

The problem with 6to4 is that it needs 3rd-party relays on the internet to relay between the IPv4 internet (to which your 6to4 gateway is connected) and the real IPv6 internet. And you usually have no control over which relays are used for your outbound traffic, and you certainly never have control over which relays are used for your inbound traffic. This causes many many problems with reliability. Connectivity to some IPv6 sites may work, to others it may not, or performance is really unpredictable etc etc etc.

So it is therefore better use i.e. tunnelbroker.net. They provide proper tunnels straight to the real IPv6 internet :)

Best Answer

Related Solutions

Cisco IPv6 – 6rd Configuration Example with General-Prefix

IPv6 – Understanding the 6to4 Mechanism

Related Topic