Ipv6 Ipv4 Tunnel

Revision
NMC-COD IPV6 TUNNELING Page 1
1.0 (11/30/2006)
NETMASTERCLASS
ROUTING AND SWITCHING CCIE TRACK
NMC-COD
IPv6 Tunneling
Module
I2
3
3
R2
3
3
R5
R6
4
I5
R1
N1
2 2
4
R3
3
3
R4
N2
N1
R7
I3
I4
FOR
CCIE CANDIDATES
1-888-677-2669
2006 Copyright NetMasterClass, LLC - All rights reserved.

http://www.netmasterclass.com 13530 Dulles Technology Drive, Suite #150, Herndon, VA 20171
This document is a part of Public PDF Files section of NetMasterClass Technical Library: http://www.netmasterclass.com/READiT
IPv6 Class-On-Demand series, that includes Videos, Quizzes and DRILLiT labs, is available: http://www.netmasterclass.com/LEARNiT
Revision: 1.0 (11/30/2006)
Disclaimer
NetMasterClass, LLC is an independent training and consulting company based in Herndon, Virginia. The
terms Cisco, Cisco Systems and CCIE are the trademarks of Cisco Systems, Inc. NetMasterClass,
LLC is Cisco Learning Partner.
Cisco Non-Disclosure Agreement Compliance

All products and services offered by NetMasterClass, LLC are in full compliance with the Cisco CCIE Lab
non-disclosure agreement. The content of the NetMasterClass CCIE preparation materials is based upon
the NetMasterClass issue spotting and analysis internetwork training methods.
1-888-677-2669

Revision: 1.0 (11/30/2006)
NMC-COD: IPv6 Tunneling

Table of Contents
1.1
1.2
1.3
1.4
1.5
1.6
1.7
Dynamips configuration files ...........................................................................................................4

Manual IPv6 Tunnel over IPv4 network.............................................................................................5
GRE IPv4/IPv6 Tunnel ....................................................................................................................12
Automatic 6to4 Tunnel.....................................................................................................................25
IPv4 Compatible IPv6 Tunnel ..........................................................................................................37
ISATAP Tunnel ................................................................................................................................44
Initial Configuration Scripts..............................................................................................................53
IPv6 block is one of the blocks of Class On Demand IPv6 modules offered by
NetMasterClass.
1-888-677-2669

Revision: 1.0 (11/30/2006)
1.1
Dynamips configuration files
Routers Initial and Final configuration scripts should be stored in the specified folder. The author of this
article used \IPV6\cfg.
Dynamips/Dynagen network configuration files are listed as following:
IPV4_IPV6_BGP_tunnel_final.net
IPV6_6to4_BGP_tunnel_final.net
IPV6_6to4_static_route_tunnel_final.net
IPV6_GRE_tunnel_4_routers_final.net
IPV6_GRE_tunnel_4_routers_init.net
IPV6_ISATAP_BGP_tunnel_final.net
IPV6_manual_tunnel_4_routers_final.net
IPV6_manual_tunnel_4_routers_init.net
If you want to download these files as a zip archive, please use the link below:
http://www.netmasterclass.com/download/IPV6_TUNNELING.zip
Used IOS version:

Cisco IOS Software, 3600 Software (C3640-JK9O3S-M), Version 12.4(5), RELEASE SOFTWARE (fc3)
1-888-677-2669

Revision: 1.0 (11/30/2006)
1.2
Manual IPv6 Tunnel over IPv4 network
Characteristics of the manual IPv6 tunnel
This tunnel is the equivalent to a permanent link between two IPv6 domains over an IPv4
backbone
An IPv6 address is manually configured on a tunnel interface, and manually configured IPv4
addresses are assigned to the tunnel source and the tunnel destination
The host or router at each end of a configured tunnel must support both the IPv4 and IPv6
protocol stacks (dual stack)
Manually configured tunnels can be configured between border routers or between a border router
and a host
The primary use is for stable connections that require regular secure communication between two edge
routers. You can also use this technique between an end system and an edge router, or for connection to
remote IPv6 networks.
Manual tunnels are similar to GRE based tunnels.
1-888-677-2669

Revision: 1.0 (11/30/2006)
Manual Tunnel Configuration:

Dynamips/Dynagen Topology files:
IPV6_manual_tunnel_4_routers_init.net, IPV6_manual_tunnel_4_routers_final.net
1. Initialize R1, R2, R3 and R4 with the initial configuration scripts. Scripts are in Appendix A.
2. Create a manual tunnel between R1 and R2 using the loopback interfaces 101 and 102. R1 and R2
run RIP to provide IPv4 connectivity between Lo101 and Lo102:
Verify connectivity between Lo101 and Lo102 involved in the tunnel source and destination:
R1#ping 172.16.102.1 source 172.16.101.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.102.1, timeout is 2 seconds:
Packet sent with a source address of 172.16.101.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/38/56 ms
Configure the tunnel on R1 and R2:

R1#conf t
R1(config)#interface Tunnel12
R1(config-if)# no ip address
R1(config-if)# ipv6 address 12::12:1/64
R1(config-if)# tunnel source 172.16.101.1
R1(config-if)# tunnel destination 172.16.102.1
R1(config-if)# tunnel mode ipv6ip
R2#conf t
R2(config-if)# tunnel mode ipv6ip
Run debug tunnel and ping tunnel end point IPv6 address, for example from R2:
R2#debug tunnel
Tunnel Interface debugging is on
R2#
R2#ping 12::12:1
Sending 5, 100-byte ICMP Echos to 12::12:1, timeout is 2 seconds:
!!!!!
R2#
*Mar 1 00:06:32.215: Tunnel12: IPv6/IP encapsulated 172.16.102.1->172.16.101.1
(linktype=79, len=120)
1-888-677-2669

Revision: 1.0 (11/30/2006)

*Mar 1 00:06:32.339: Tunnel12:
ttl=254 tos=0x0)
*Mar 1 00:06:32.343: Tunnel12:
(len=120, ttl=254)
*Mar 1 00:06:32.347: Tunnel12:
*Mar 1 00:06:32.347:
*Mar 1 00:06:32.359: Tunnel12:
*Mar 1 00:06:32.451: Tunnel12:
ttl=254 tos=0x0)
*Mar 1 00:06:32.455: Tunnel12:
(len=120, ttl=254)
*Mar 1 00:06:32.459: Tunnel12:
R2#u all
All possible debugging has been
R2#
IPv6/IP to classify 172.16.101.1->172.16.102.1 (len=120

to decaps IPv6/IP packet 172.16.101.1->172.16.102.1
decapsulated IPv6/IP packet
12::12:1 -> 12::12:2 (len=60 ttl=64)
IPv6/IP encapsulated 172.16.102.1->172.16.101.1
IPv6/IP to classify 172.16.101.1->172.16.102.1 (len=120
to decaps IPv6/IP packet 172.16.101.1->172.16.102.1
decapsulated IPv6/IP packet
turned off
Note: you can see the tunnel source and destination IPv4 addresses (172.16.101.1 and 172.16.102.1)
involved in encapsulation/decapsulation.
Question: What IPv4 protocol is used to carry the encapsulated IPv6 packets?
Answer: It is IPv4 protocol number 41 which is according to IANAs PROTOCOL NUMBERS at

http://www.iana.org/assignments/protocol-numbers :
Decimal
------41
Keyword
------IPv6
Protocol
-------Ipv6
References
---------[Deering]
You can see this number in the output of debug ip packet detail while pinging the tunnel IPv6 endpoints:
R1#deb ip pack det
IP packet debugging is on (detailed)
R1#ping 12::12:2
!!!!!
R1#
*Mar 1 00:10:46.115: IP: s=172.16.101.1 (Tunnel12), d=172.16.102.1 (Serial1/0), len 120,
sending, proto=41
*Mar 1 00:10:46.203: IP: tableid=0, s=172.16.102.1 (Serial1/0), d=172.16.101.1
(Loopback101), routed via RIB
.
Here are some important properties of the tunnel interface:
1-888-677-2669

Revision: 1.0 (11/30/2006)
R1#show interfaces tunnel 12

Tunnel12 is up, line protocol is up
Hardware is Tunnel
MTU 1514 bytes, BW 9 Kbit, DLY 500000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation TUNNEL, loopback not set
Keepalive not set
Tunnel source 172.16.101.1, destination 172.16.102.1
Tunnel protocol/transport IPv6/IP
Tunnel TTL 255
Fast tunneling enabled
Tunnel transmit bandwidth 8000 (kbps)
Tunnel receive bandwidth 8000 (kbps)
Last input 00:09:41, output 00:09:41, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/0 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
22 packets input, 2624 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
22 packets output, 2184 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 output buffer failures, 0 output buffers swapped out
R1#
Look at the IPv6 addresses assigned to the tunnel interface. The tunnel link local address will be formed
from the IPv4 address of the tunnel source. On R1, the tunnel source is 172.16.101.1, therefore:
Decimal
Decimal
Decimal
Decimal
172 = Hex AC
16 = Hex 10
101 = Hex 65
1 = Hex 1
172.16.101.1 -> AC10:6501

R1#show ipv6 int tunnel 12
IPv6 is enabled, link-local address is FE80::AC10:6501
Global unicast address(es):
12::12:1, subnet is 12::/64
Joined group address(es):
FF02::1
FF02::2
FF02::1:FF10:6501
FF02::1:FF12:1
MTU is 1480 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds
R1#
Likewise on R2 the tunnel source 172.16.102.1 will be translated to AC10:6601

Just like with the serial IPv6 interface, when you assign Global unicast IPv6 address on the tunnel
interface, the IOS will create two entries in the IPv6 routing table, one Local entry with the /128 mask
1-888-677-2669

Revision: 1.0 (11/30/2006)
pointing to the tunnel interface and the other is the connected prefix with the mask matching what was
specified on the tunnel interface. In our case this is /64.
R1#show ipv6 route
IPv6 Routing Table - 6 entries
Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP
U - Per-user Static route
I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary
O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
C
12::/64 [0/0]
via ::, Tunnel12
L
12::12:1/128 [0/0]
via ::, Tunnel12
C
13::/64 [0/0]
via ::, Serial1/1
L
13::13:1/128 [0/0]
via ::, Serial1/1
L
FE80::/10 [0/0]
via ::, Null0
L
FF00::/8 [0/0]
via ::, Null0
R1#
Routing protocols over a manual IPv6 tunnel

The tunnel is considered by IOS as an IPv6 link, just like an IPv6 serial interface. You can run all
supported IPv6 routing protocols over the IPv6 manual tunnel. Here is an example of an IPv6 RIP
configuration:
1-888-677-2669

Revision: 1.0 (11/30/2006)
Configure IPv6 RIP instance RIPoTU on R1, R2, R3 and R4 and enable it on the respective interfaces,
look at the diagram:
R1#conf t
R1(config)#ipv6 unicast-routing
R1(config)#ipv6 router rip RIPoTU
R1(config-rtr)#int tu 12
R1(config-if)#ipv6 rip RIPoTU enable
R1(config-if)#int s1/1
R2#conf t
R2(config-rtr)#int tu12
R3#conf t
R3(config-rtr)#int s1/0
R3(config-if)#ipv6 router rip RIPoTU
R4#conf t
On R1 check the RIP prefixes learned via the Tunnel12 interface:

R1#show ipv6 route rip
R
24::/64 [120/2]
via FE80::AC10:6601, Tunnel12
R1#
Check the routing table on the other routers:

R
13::/64 [120/2]
via FE80::AC10:6501, Tunnel12
R2#
1-888-677-2669

Revision: 1.0 (11/30/2006)

R
12::/64 [120/2]
via FE80::CE00:5FF:FE68:0, Serial1/0
R
24::/64 [120/3]
via FE80::CE00:5FF:FE68:0, Serial1/0
R3#
Now you can ping between the farthest IPv6 addresses on R3 and R4. Your traffic will be routed via the
Tunnel 12 between R1 and R2
R3#ping 24::24:4
!!!!!
R3#
1-888-677-2669

Revision: 1.0 (11/30/2006)
1.3
GRE IPv4/IPv6 Tunnel
Characteristics of the GRE IPv4/IPv6 tunnel
GRE is a Cisco proprietary tunneling protocol. Mode GRE over IPv4 is the default tunnel mode on
the Cisco router.
Similar to manual IPv6 tunnels, IPv6 GRE tunnels are links between two points.
The primary use of GRE tunnels is for stable connections that require regular secure
communication between two edge routers. You could also do this between an edge router and an
end system. The edge routers and the end systems must be dual-stack implementations.
GRE has a protocol field that identifies the passenger protocol. GRE tunnels allow Intermediate
System-to-Intermediate System (IS-IS) or IPv6 to be specified as a passenger protocol. You could
actually permit both IS-IS and IPv6 traffic to run over the same tunnel. The GRE protocol field is
why it is desirable that you tunnel IS-IS and IPv6 inside GRE.
1-888-677-2669

Revision: 1.0 (11/30/2006)
GRE IPv4 Tunnel Configuration:

IPV6_GRE_tunnel_4_routers_init.net, IPV6_GRE_tunnel_4_routers_final.net
IPv6 is a passenger protocol.

IPv4 is a transport protocol.
Initialize R1, R2, R3 and R4 with the initial configuration scripts.
Create a IPv6 GRE tunnel between R1 and R2 using the loopback interfaces 101 and 102. R1 and R2 run
RIP to provide IPv4 connectivity between Lo101 and Lo102:
Verify connectivity between Lo101 and Lo102 involved in tunnel source and destination:
R1#ping 172.16.102.1 source 172.16.101.1
Sending 5, 100-byte ICMP Echos to 172.16.102.1, timeout is 2 seconds:
Packet sent with a source address of 172.16.101.1
!!!!!
Configure tunnel on R1 and R2:

R1#conf t
R2#conf t
You do not have to configure GRE mode on the tunnel, it is the default on a Cisco router.
Run debug tunnel and ping tunnel end point IPv6 address, for example from R2:
R2#deb tunnel
1-888-677-2669

Revision: 1.0 (11/30/2006)
R2#ping 12::12:1
!!!!!
R2#
*Mar 1 00:08:06.775: Tunnel12: GRE/IP encapsulated 172.16.102.1->172.16.101.1
*Mar 1 00:08:06.843: Tunnel12: GRE/IP to classify 172.16.101.1->172.16.102.1 (len=124
type=0x86DD ttl=254 tos=0x0)
You can see the tunnel source and destination IPv4 addresses (172.16.101.1 and 172.16.102.1)
involved in encapsulation/decapsulation. Type 0x86DD is the Ethernet protocol type for IPv6. It is a
payload of the GRE packet from R1.
Question: What IPv4 protocol is used to carry the encapsulated IPv6 packets?
Answer: It is IPv4 protocol number 41 which is according to IANAs PROTOCOL NUMBERS at

http://www.iana.org/assignments/protocol-numbers :
Decimal
------47
Keyword
------GRE
Protocol
-------General Routing Encapsulation
References
---------[Tony Li]
You can see this number in the output of debug ip packet detail while pinging the tunnel IPv6 endpoints:
R2#deb ip pack detail
IP packet debugging is on (detailed)
R2#ping 12::12:1
!!!!!
R2#
sending, proto=47
sending, proto=47
.
1-888-677-2669

Revision: 1.0 (11/30/2006)
Here are some important properties of tunnel interface:

Hardware is Tunnel
Keepalive not set
Tunnel source 172.16.102.1, destination 172.16.101.1
Tunnel protocol/transport GRE/IP
Key disabled, sequencing disabled
Checksumming of packets disabled
Tunnel TTL 255
R2#
Look at the IPv6 addresses assigned to the tunnel interface of R1 or R2. The tunnel link local address will
be formed just like any other MAC-less interfaces (loopback, Serial, etc) based on a MAC address of the
first Ethernet interface. For more details listen to IPv6 address assignment module.
You can override the local link address with a manually configured one.
R1#show ipv6 interface tunnel 12
IPv6 is enabled, link-local address is FE80::CE00:CFF:FE58:0
12::12:1, subnet is 12::/64
FF02::1
FF02::2
FF02::1:FF12:1
FF02::1:FF58:0
MTU is 1476 bytes
R1#
Just like with the serial IPv6 interface, when you assign Global unicast IPv6 address on the tunnel
interface, the IOS will create two entries in the IPv6 routing table, one Local entry with the /128 mask
pointing to tunnel interface and the other is a Connected prefix with the mask matching what was specified
1-888-677-2669

Revision: 1.0 (11/30/2006)
on the tunnel interface. In this case it was /64. These forwarding entries are no different from those
created by manual IPv6 tunnel. Please see the manual tunnel configuration section.
R1#show ipv6 route
C
12::/64 [0/0]
via ::, Tunnel12
L
12::12:1/128 [0/0]
via ::, Tunnel12
C
13::/64 [0/0]
via ::, Serial1/1
L
13::13:1/128 [0/0]
via ::, Serial1/1
L
FE80::/10 [0/0]
via ::, Null0
L
FF00::/8 [0/0]
via ::, Null0
R1#
Routing protocols over GRE IPv4 tunnel

Tunnel is considered by IOS as an IPv6 link, just like an IPv6 serial interface. You can run all supported
IPv6 routing protocols over the IPv6 manual tunnel. Here is an example of IPv6 RIP configuration:
1-888-677-2669

Revision: 1.0 (11/30/2006)
Configure IPv6 RIP instance RIPoTU on R1, R2, R3 and R4 and enable it on the respective interfaces,
look at the diagram:
R1#conf t
R1(config-rtr)#int tu 12
R2#conf t
R2(config-rtr)#int tu12
R3#conf t
R4#conf t
On R1 check the RIP prefixes learned via Tunnel12 interface:

R
24::/64 [120/2]
via FE80::CE01:CFF:FE58:0, Tunnel12
R1#
The next hop learned via IPv6 IGPs is always link local.
Check the routing table on the other routers:

R
13::/64 [120/2]
R2#
1-888-677-2669

Revision: 1.0 (11/30/2006)

R
12::/64 [120/2]
via FE80::CE00:CFF:FE58:0, Serial1/0
R
24::/64 [120/3]
R3#
Now you can ping between the farthest IPv6 addresses on R3 and R4. Your traffic will be routed via the
Tunnel 12 between R1 and R2.
R3#ping 24::24:4
!!!!!
R3#
GRE IPv6 Tunnel Configuration

IPv6 is a passenger protocol.
IPv6 is a transport protocol.
GRE tunnel can be built with the IPv6 used as a transport protocol. For example create tunnel between
IPv6 only sites for VPN or other purposes. Next example illustrates it with the use of IPv6 OSPF between
IPv6 only routers R3 and R4. Use the configuration from the previous example for GRE IPv4 configuration.
Configure tunnel between R3 and R4 using the IPv6 addresses assigned to S1/0 interfaces for the tunnel
source and destination. Also GRE mode is going to be IPv6. Form IPv6 OSPF adjacency over the tunnel
and advertise networks 33::/64 and 44/64 between R3 and R4.
1-888-677-2669

Revision: 1.0 (11/30/2006)
Make sure you can ping between these networks.

R1 and R2 are not aware about OSPF networks.
R3#conf t
R3(config)#interface tunnel 34
*Mar 1 01:52:54.071: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel34, changed
state to down
R3(config-if)#ipv6 address 34::34:3/24
R3(config-if)#tunnel source 13::13:3
R3(config-if)#tunnel dest 24::24:4
R3(config-if)#tunnel mode gre ipv6
R3(config-if)#
state to up
R3(config-if)#
R4#conf t
state to down
R4(config-if)#tunnel destination 13::13:3
R4(config-if)#
state to up
R4(config-if)#
1-888-677-2669

Revision: 1.0 (11/30/2006)
Verify connectivity between end points of the GRE IPv6 tunnel:

R3#ping 34::34:4
!!!!!
R3#
Configure tunnel interfaces on R3 and R4:

R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
state to down
R3(config-if)#tunnel dest 24::24:4
R3(config-if)#
state to up
R3(config-if)#
state to down
R4(config-if)#tunnel destination 13::13:3
R4(config-if)#
state to up
R4(config-if)#

Hardware is Tunnel
Keepalive not set
Tunnel source 13::13:3, destination 24::24:4
Tunnel protocol/transport GRE/IPv6
Key disabled, sequencing disabled
Checksumming of packets disabled
Tunnel TTL 255
1-888-677-2669

Revision: 1.0 (11/30/2006)

R3#
Note: Transport protocol is IPv6 in the output above.

R3#show ipv6 interface tunnel 34
IPv6 is enabled, link-local address is FE80::CE02:DFF:FE7C:0
34::34:3, subnet is 34::/24
FF02::1
FF02::2
FF02::5
FF02::1:FF34:3
FF02::1:FF7C:0
MTU is 1456 bytes
Hosts use stateless autoconfig for addresses.
R3#
Verify connectivity between the end points:

R3#ping 34::34:4
!!!!!
R3#
Configure IPv6 OSPF between R3 and R4 according to diagram:

R3#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R3(config)#int tu34
R3(config-if)#ipv6 ospf 1 area 0
R3(config-if)#int lo 33
R3(config-if)#ipv6
*Mar 1 01:58:54.783: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback33, changed
state to up
R3(config-if)#
*Mar 1 02:00:15.331: %OSPFv3-5-ADJCHG: Process 1, Nbr 172.16.24.4 on Tunnel34 from
LOADING to FULL, Loading Done
R3(config-if)#
R4(config-if)#int tu 34
R4(config-if)#int lo 44
R4(config-if)#
*Mar 1 02:00:14.715: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback44, changed
state to up
*Mar 1 02:00:19.679: %OSPFv3-5-ADJCHG: Process 1, Nbr 172.16.13.3 on Tunnel34 from
LOADING to FULL, Loading Done
1-888-677-2669

Revision: 1.0 (11/30/2006)

R4(config-if)#
R3#show ipv6 ospf nei

Neighbor ID
Pri
State
Dead Time
Interface ID
Interface
172.16.24.4
1
FULL/ 00:00:38
12
Tunnel34
R3#show ipv6 route ospf
O
34::/64 [110/22222]
via FE80::CE03:DFF:FE7C:0, Tunnel34
OI 44::44:1/128 [110/11111]
R3#
Verify connectivity
R3#ping 44::44:1 source 33::33:1
Packet sent with a source address of 33::33:1
!!!!!
R3#
Encapsulation/decapsulation and forwarding steps when ping 44::44:1 source 33::33:1

1. R3 builds an ICMP packet with the source 33:33:1 and destination 44::44:1 and does the
lookup in ipv6 routing tables to find the outgoing interface. Here is an entry in the routing
table:
R3#show ipv6 route 44::44:1
OI 44::44:1/128 [110/11111]
R3#
2. The outgoing interface is Tunnel34 meaning that R3 needs to build an IPv6 GRE packet via
encapsulation (debug tunnel):
*Mar 1 02:36:42.539: Tunnel34: GRE/IPv6 encapsulated 13::13:3->24::24:4 (linktype=79,
len=144)
3. Now R3 is going to do the lookup for 24::24:4 which is the destination of the IPv6 GRE
packet:
1-888-677-2669

Revision: 1.0 (11/30/2006)

R
24::/64 [120/3]
R3#
4. R3 finds that the outgoing interface is S1/0, encapsulates the GRE IPv6 packet in HDLC
(default cisco serial encapsulation) and forward to R1.
5. R1 does a lookup in the routing table for 24::24:4 and finds entry:
R
24::/64 [120/2]
R1#
6. Outgoing interface Tunnel12 tells router that the IPv6 GRE packet needs to be
encapsulated in GRE IPV4 packet with the following source and destination IPv4
addresses:
7. R1 does a lookup for 172.16.102.1

R1#show ip route 172.16.102.1
Routing entry for 172.16.102.0/24
Known via "rip", distance 120, metric 1
Redistributing via rip
Last update from 172.16.12.2 on Serial1/0, 00:00:16 ago
Routing Descriptor Blocks:
* 172.16.12.2, from 172.16.12.2, 00:00:16 ago, via Serial1/0
Route metric is 1, traffic share count is 1
R1#
8. R1 finds Serial1/0 as an outgoing interface, encapsulates GRE IPv4 packet in HDLC and
forward to R2.
9. R2 receives GRE IPv4 packet and decapsulates it:
Mar 1 02:49:26.823: Tunnel12: GRE/IP to classify 172.16.101.1->172.16.102.1 (len=124
10. Note the type of payload is the IPv6 packet. The decapsulated IPv6 packet is the GRE IPv6
packet with the source and destination 13::13:3->24::24:4
11. R2 does the lookup for 24::24:4 in the table:
1-888-677-2669

Revision: 1.0 (11/30/2006)

C
24::/64 [0/0]
via ::, Serial1/1
12. Finds the outgoing interface Serail1/1, encapsulates in HDLC and forwards to R4.
13. R4 receives the GRE IPv6 packet and decapsulates it:
*Mar
*Mar
1 02:54:39.379: Tunnel34: GRE/IPv6 to decaps 13::13:3->24::24:4 (len=84 ttl=62)

1 02:54:39.379: Tunnel34: GRE decapsulated IPv6 packet (linktype=79, len=80)
14. R4 receives the ICMP echo request and replies:

R4#
*Mar
*Mar
*Mar
1 02:58:54.455: ICMPv6: Received ICMPv6 packet from 33::33:1, type 128

1 02:58:54.459: ICMPv6: Received echo request from 33::33:1
1 02:58:54.463: ICMPv6: Sending echo reply to 33::33:1
15. Same steps will be involved to process the ICMP reply and deliver it to R3.
1-888-677-2669

Revision: 1.0 (11/30/2006)
1.4
Automatic 6to4 Tunnel
Characteristics of the automatic 6to4 tunnel
Allows isolated IPv6 domains to be connected over an IPv4 network to remote IPv6 networks.
The tunnel is not point-to-point; it is point-to-multipoint.
The IPv4 address embedded in the IPv6 address is used to find the other end of the automatic
tunnel.
The IANA has permanently assigned one 13-bit IPv6 Top Level Aggregator (TLA) for the 6to4
scheme. Its numeric value is 0x0002, i.e., it is 2002::/16 when expressed as an IPv6 address
prefix. It is a recommended prefix for the real life deployments. In the lab you can use any prefix to
set up the 6to4 tunnel.
The benefits to the enterprise of using 6to4 tunnels are as follows:
Cisco IOS software supports 6to4 tunnels.

The end-user host configuration is simpleit requires minimal management overhead.
The tunnel is automatic; no enterprise-specific configuration is required at the 6to4 relay site. 6to4
tunnels scale well.
This solution accommodates dynamic IP addresses at the enterprise.
The tunnel exists only for the duration of the session.
A 6to4 tunnel requires only a one-time configuration at the ISP, which makes the 6to4 relay
service available simultaneously to many enterprises.
6to4 tunnel usage has the following limitations:
Independently managed NAT is not allowed along the path of the tunnel.
You cannot easily implement multihoming.
The 6to4 tunnel mechanism provides a /48 address block; no more addresses are available.
Because 6to4 tunnels are configured many-to-one and tunnel traffic can originate from multiple
endpoints, 6to4 tunnels can provide only overall traffic information to the ISP.
The underlying IPv4 address determines the enterprise 6to4 IPv6 address prefix, so the migration
to native IPv6 requires renumbering the network.
This solution is limited to static or BGP4+ routing.
1-888-677-2669

Revision: 1.0 (11/30/2006)
Automatic 6to4 Tunnel Configuration

IPV6_manual_tunnel_4_routers_init.net, IPV6_6to4_static_route_tunnel_final.net
Automatic 6to4 tunnel will be setup between two border routers R1 and R2. The IPv4 address of the
border router R1 is 172.16.101.1. The IPv4 address of the border router R2 is 172.16.102.1. IPv4
connectivity between these two R1 and R2 is provided by IPv4 RIP routing protocol.
We need to derive 6to4 prefix from IPv4 addresses 172.16.101.1 and 172.16.102.1 by converting the
decimal components of the IPv4 address to hexadecimal and then prefixing 2002 to the resulting
hexadecimal numbers. Look at the following conversion table:
DEC
172
16
101
1
1-888-677-2669
R1
HEX
AC
10
65
01
DEC
172
16
102
1
R2
HEX
AC
10
66
01

Revision: 1.0 (11/30/2006)
So the 6to4 prefix for the IPv6 R1 node in your network is 2002:AC10:6501:: and
2002:AC10:6601::. What is a prefix length?
You can assign 2002:AC10:6501::/128 and 2002:AC10:6601::/128 on the tunnel interfaces. Lets think
what is going to happen:
1. Configure tunnel interfaces on both routers R1 and R2:
R1:
interface Tunnel12
no ip address
ipv6 address 2002:AC10:6501::/128
tunnel source 172.16.101.1
tunnel mode ipv6ip 6to4
R2:
interface Tunnel12
no ip address
ipv6 address 2002:AC10:6601::/128
tunnel source 172.16.102.1
tunnel mode ipv6ip 6to4
Note: You specify only IPv4 tunnel source, the destination will be calculated, well talk about this
calculation in a minute.
2. Lets try to ping the other end of the tunnel, run debug ipv6 packet detail meanwhile:
R1#ping 2002:AC10:6601::
Sending 5, 100-byte ICMP Echos to 2002:AC10:6601::, timeout is 2 seconds:
*Mar 1 04:16:37.206: IPv6: SAS picked source 13::13:1 for 2002:AC10:6601:: (Serial1/1)
*Mar 1 04:16:37.210: IPv6: source 13::13:1 (local)
*Mar 1 04:16:37.210:
dest 2002:AC10:6601::
*Mar 1 04:16:37.214:
traffic class 0, flow 0x0, len 100+0, prot 58, hops 64, Route
not found.
So it is complaining about route not being found. Lets check the routing table:
R1#show ipv6 route
C
13::/64 [0/0]
via ::, Serial1/1
L
13::13:1/128 [0/0]
via ::, Serial1/1
LC 2002:AC10:6501::/128 [0/0]
via ::, Tunnel12
L
FE80::/10 [0/0]
1-888-677-2669

Revision: 1.0 (11/30/2006)
via ::, Null0

FF00::/8 [0/0]
via ::, Null0
L
R1#
There is only one 2002:AC10:6501::/128 entry from the 2002 range, so the R1 does not have a route to
dest 2002:AC10:6601:: We need to direct packet with the destination dest 2002:AC10:6601:: to the tunnel
12 interface so the tunnel can do its 6to4 encapsulation magic.
3. We are going to add a static route saying that if the destination starts with 2002 send it via tunnel 12
interface:
R1(config)#ipv6 route 2002::/16 tunnel 12
And try to ping again:

R1#ping 2002:AC10:6601::
*Mar 1 04:24:52.586: IPv6: SAS picked source 2002:AC10:6501:: for 2002:AC10:6601::
(Tunnel12)
*Mar 1 04:24:52.590: IPv6: source 2002:AC10:6501:: (local)
*Mar 1 04:24:52.594:
dest 2002:AC10:6601:: (Tunnel12)
*Mar 1 04:24:52.598:
traffic class 0, flow 0x0, len 100+0, prot 58, hops 64,
originating
*Mar 1 04:24:52.598: IPv6: Sending on Tunnel12.
Of course you are not going to get any replies from R2 because you need to add static route there too. But
the good thing is that R1 is sending via the Tunnel interface. Add ipv6 route 2002::/16 Tunnel12 on R2.
Ping from R1 again, and if you do the debug tunnel you will see this:
R1#ping 2002:AC10:6601::
.....
Success rate is 0 percent (0/5)
R1#ping 2002:AC10:6601::
!!!!!
R1#
*Mar 1 04:28:03.558: Tunnel12: IPv6/IP to classify 172.16.102.1->172.16.101.1 (len=120
ttl=254 tos=0x0)
*Mar 1 04:28:03.562: Tunnel12: to decaps IPv6/IP packet 172.16.102.1->172.16.101.1
(len=120, ttl=254)
*Mar 1 04:28:03.566: Tunnel12: decapsulated IPv6/IP packet
*Mar 1 04:28:03.570:
2002:AC10:6601:: -> 2002:AC10:6501:: (len=60 ttl=64)
4. What if I want to ping something beyond the tunnel end point for example 24::24:2 which is a serial
interface of R2 connected to R4? Our educated guess tells us that it is not doing to work at this point
1-888-677-2669

Revision: 1.0 (11/30/2006)
because R1 does not have a route to 24::24:2. We have to add a static route on R1, lets do it and see
what happens:
R1#deb ipv6 packet det
IPv6 unicast packet debugging is on (detailed)
R1#ping 24::24:2
*Mar 1 04:33:48.038: IPv6: SAS picked source 13::13:1 for 24::24:2 (Serial1/1)
*Mar 1 04:33:48.042: IPv6: source 13::13:1 (local)
*Mar 1 04:33:48.046:
dest 24::24:2
*Mar 1 04:33:48.046:
not found.
Lets add the static route:

R1(config)#ipv6 route 24::/64 tu 12
And ping again

R1#debug ipv6 packet
IPv6 unicast packet debugging is on
R1#debug tunnel
R1#ping 24::24:2
*Mar 1 04:41:51.178:
*Mar 1 04:41:51.182:
*Mar 1 04:41:51.182:
*Mar 1 04:41:51.186:
originating
*Mar 1 04:41:51.190:
*Mar 1 04:41:53.190:
*Mar 1 04:41:53.194:
*Mar 1 04:41:53.198:
*Mar 1 04:41:53.198:
originating
*Mar 1 04:41:53.202:
*Mar 1 04:41:55.206:
*Mar 1 04:41:55.210:
*Mar 1 04:41:55.214:
*Mar 1 04:41:55.214:
originating
*Mar 1 04:41:55.218:
*Mar 1 04:41:57.222:
*Mar 1 04:41:57.226:
*Mar 1 04:41:57.230:
*Mar 1 04:41:57.230:
originating
*Mar 1 04:41:57.234:
*Mar 1 04:41:59.238:
*Mar 1 04:41:59.242:
*Mar 1 04:41:59.246:
*Mar 1 04:41:59.246:
originating
1-888-677-2669
IPv6: SAS picked source 2002:AC10:6501:: for 24::24:2 (Tunnel12)

IPv6: source 2002:AC10:6501:: (local)
dest 24::24:2 (Tunnel12)
IPv6: Sending on Tunnel12.

Revision: 1.0 (11/30/2006)
*Mar 1 04:41:59.250: IPv6: Sending on Tunnel12.

Success rate is 0 percent (0/5)
R1#
As you noticed the forwarding of IPv6 packet to 24::24:2 destination is fine now, but the tunneling is not
triggered. Why? At this point R1 does not have enough information to encapsulate IPv6 packet using 6to4
scheme. It has a configured IPv4 tunnel source 172.16.101.1 (from the tunnel configuration), but it does
not know what IPv4 address should be used for a tunnel destination. The IPv4 address is derived from the
R2s tunnel address ipv6 address 2002:AC10:6601::/128, which is 172.16.102.1
Therefore you have to create a static route to 24::/64 not via the tunnel interface and via the next hop IPv6
address 2002:AC10:6601::
R1(config)#no ipv6 route 24::/64 tu 12
R1(config)#ipv6 route 24::/64 2002:AC10:6601::
R1(config)#
Important! Networks that are reachable via 6to4 IPv6 tunnels must be listed with the 6to4 like next hop
IPv6 address.
S
24::/64 [1/0]
via 2002:AC10:6601::
Try to ping it again and run only debug tunnel otherwise the output of debug ipv6 packet makes your
screen too busy.
R1#debug tunnel
R1#ping 24::24:2
!!!!!
R1#
ttl=254 tos=0x0)
(len=120, ttl=254)
*Mar 1 04:48:55.098:
24::24:2 -> 2002:AC10:6501:: (len=60 ttl=64)
5. You can configure a static default route 0::/0 to provide a route to all IPv6 destinations and lets do it to
finish this 6to4 tunnel configuration with the static routes:
R1#conf t
R1(config)#no ipv6 route 24::/64 2002:AC10:6601::
R1(config)#ipv6 route 0::/0 2002:AC10:6601::
R1(config)#
R1#show ipv6 route
1-888-677-2669

Revision: 1.0 (11/30/2006)

S
::/0 [1/0]
via 2002:AC10:6601::
R1#ping 24::24:2
!!!!!
R1#
Can we avoid configuring a static route to 2002::/16 via tunnel 12? Yes if we provide a routing entry for all
6to4 tunnel endpoints via connected IPv6 entry.
Lets find out common bits of IPv6 addresses of both tunnel interfaces of R1 and R2
2002:AC10:6501::
2002:AC10:6601::
0010000000000010: 1010110000010000: 0110010100000001::

0010000000000010: 1010110000010000: 0110011000000001::
Green highlighted area is 38 bits that are common for both addresses. So if we specify addresses
2002:AC10:6501::/38 and 2002:AC10:6601::/38 on the tunnel interfaces R1 and R2 will know that the
other end is reachable via connected /38 network. /38 is the longest connected prefix you can configure to
provide reachability to these two specific IPv6 addresses. Of course you can go with the less specific
prefixes /37, /36, etc. as well.
1-888-677-2669

Revision: 1.0 (11/30/2006)
1. Reconfigure IPv6 address on both ends of the tunnel:

R1(config-if)# ipv6 address 2002:AC10:6501::/38
R1(config-if)#
R2(config)#int tu12
R2(config-if)#ipv6 address 2002:AC10:6601::/38
2. Remove a static route to tunnel interface:

R1(config)#no ipv6 route 2002::/16 Tunnel12
R2(config)#no ipv6 route 2002::/16 Tunnel12
3. Verify if you still can ping 24::24:2 from R1:

R1#ping 24::24:2
!!!!!
R1#
And you can because you have a prefix in the routing table, that provides reachability to the other end of
the tunnel 2002::AC10:6601::/38
R1#show ipv6 route
S
::/0 [1/0]
via 2002:AC10:6601::
C
13::/64 [0/0]
via ::, Serial1/1
L
13::13:1/128 [0/0]
via ::, Serial1/1
C
2002:AC10:6400::/38 [0/0]
via ::, Tunnel12
L
2002:AC10:6501::/128 [0/0]
via ::, Tunnel12
L
FE80::/10 [0/0]
via ::, Null0
L
FF00::/8 [0/0]
via ::, Null0
R1#
What if we do not want to use any static routes? Is it possible with 6to4 tunnels? The answer is yes, but
with the BGP routing protocol only. Since IPv6 IGPs such as OSPF, RIP, EIGRP form and exchange
updates between the IPv6 link local interfaces, the 6to4 encapsulation scheme with the derived IPv4
address does not work. On the other hand, the BGP routing process uses TCP peers to exchange the
routing updates and the TCP sessions can be established between any IPv6 addresses.
1-888-677-2669

Revision: 1.0 (11/30/2006)
Lets consider a following scenario:

IPV6_manual_tunnel_4_routers_init.net, IPV6_6to4_BGP_tunnel_final.net
R1 and R2 are in BGP AS1 and AS2 respectively and will form peer relationship over 6to4 tunnel. BGP will
be used to provide reachability to two IPv6 RIP domains. The ultimate goal is to ping from 13::13:3 of R3
the 24::24:4 address of R4. No static routes will be used in this scenario.
1. Remove the default static routes from R1 and R2:
R1(config)#no ipv6 route ::/0 2002:AC10:6601::
R2(config)#no ipv6 route ::/0 2002:AC10:6501::
2. Configure BGP on both routers and peer them using the IPv6 addresses configured on the 6to4
tunnel:
R1(config)#router bgp 1
R1(config-router)#neighbor 2002:AC10:6601:: remote-as 2
R1(config-router)#
1-888-677-2669

Revision: 1.0 (11/30/2006)
R2(config-router)#neighbor 2002:AC10:6501:: remote-as 1
In a moment you should get the following status messages:

R1(config-router)#
*Mar 1 01:10:13.483: %BGP-5-ADJCHANGE: neighbor 2002:AC10:6601:: Up
R2#
*Mar
1 01:10:12.651: %BGP-5-ADJCHANGE: neighbor 2002:AC10:6501:: Up
3. Configured IPv6 RIP instance on the interfaces on links between R1-R3 and R2-R4.
R1(config-if)#
4. Mutually redistribute BGP and RIP on R1 and R2 and activate the BGP IPv6 updates exchange.
R1(config-router)#address-family ipv6 unicast
R1(config-router-af)#neighbor 2002:AC10:6601:: activate
R1(config-router-af)#redistribute rip RIPoTU include-connected
R1(config-router-af)#ipv6 router rip RIPoTU
R1(config-rtr)#redistribute bgp 1 include-connected
R1(config-rtr)#
R2(config-router-af)#neighbor 2002:AC10:6501:: activate
R2(config-rtr)#
1-888-677-2669

Revision: 1.0 (11/30/2006)
Check the IPv6 BGP tables and IPv6 forwarding routing table on both routers R1 and R2:
R1#sh bgp ipv6 unicast
BGP table version is 3, local router ID is 172.16.101.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Network
*> 13::/64
*> 24::/64
Next Hop
::
2002:AC10:6601::
Metric LocPrf Weight Path

0
32768 ?
0
0 2 ?
R1#
R1#show ipv6 route bgp
B
24::/64 [20/0]
via 2002:AC10:6601::
R1#
Network
*> 13::/64
Next Hop
2002:AC10:6501::
0
0 1 ?
*> 24::/64
::
0
32768 ?
R2#
B
13::/64 [20/0]
via 2002:AC10:6501::
R2#
R1 and R2 have remote IPv6 RIP prefixes learned via the 6to4 tunnel IPv6 address as a next hop, thats
what we want to see in the routing table.
5. Check IPv6 routing tables on R3 and R4 and if they look good try to ping R4 from R3:
R
24::/64 [120/2]
via FE80::CE00:1FF:FEFC:0, Serial1/0
R3#
1-888-677-2669

Revision: 1.0 (11/30/2006)
R4#sho ipv6 route rip

R
13::/64 [120/2]
R4#
R3#ping 24::24:4
!!!!!
R3#
1-888-677-2669

Revision: 1.0 (11/30/2006)
1.5
IPv4 Compatible IPv6 Tunnel
Characteristics of the IPv4 compatible 6to4 tunnel
Allows isolated IPv6 domains to be connected over an IPv4 network to remote IPv6 networks.
The tunnel is not point-to-point; it is point-to-multipoint.
The IPv4 address embedded in the IPv6 address is used to find the other end of the automatic
tunnel.
Using IPv4-compatible tunnels is an easy method to create tunnels for IPv6 over IPv4, but the
technique does not scale for large networks.
IPv4-compatible tunnels were initially supported for IPv6, but are being deprecated. Cisco
recommends that you use the IPv6 ISATAP tunneling technique
This solution is limited to static or BGP4+ routing.
IPv4 Compatible IPv6 Tunnel Configuration

IPV6_manual_tunnel_4_routers_init.net, IPV4_IPV6_BGP_tunnel_final.net
IPv4 compatible tunnel will be setup between two border routers R1 and R2. The IPv4 address of the
border router R1 is 172.16.101.1. The IPv4 address of the border router R2 is 172.16.102.1. IPV4
connectivity between these two R1 and R2 is provided by IPv4 RIP routing protocol.
IPv4 addresses 172.16.101.1 and 172.16.102.1 will be used for the tunnel source on R1 and R2
respectively. The tunnel destination s automatically determined by the IPv4 address in the low-order 32
bits of an IPv4-compatible IPv6 address. Specifically, the IPv6 prefix 0:0:0:0:0:0 is concatenated to an
IPv4 address (in the format 0:0:0:0:0:0:A.B.C.D or ::A.B.C.D) to create the IPv4-compatible IPv6 address.
1-888-677-2669

Revision: 1.0 (11/30/2006)
1. Configure IPv4 compatible IPv6 Tunnel 12 on both routers R1 and R2:

R1(config-if)# no ip redirects
R1(config-if)# tunnel mode ipv6ip auto-tunnel
R2(config-if)# no ip redirects
R2(config-if)# tunnel mode ipv6ip auto-tunnel
Check the properties of interface and IPv6 interface:
R1#show int tunnel 12
Hardware is Tunnel
Keepalive not set
Tunnel source 172.16.101.1, destination UNKNOWN
Tunnel protocol/transport IPv6 auto-tunnel
1-888-677-2669

Revision: 1.0 (11/30/2006)

R1#
IPv6 is enabled, link-local address is FE80::AC10:6501
::172.16.101.1, subnet is ::/96 [NEG]
FF02::1
FF02::2
FF02::1:FF10:6501
MTU is 1480 bytes
ND DAD is not supported
R1#
You will see similar outputs on R2.

2. On R1 ping the tunnel endpoint of R2 and run debug tunnel:
R1#debug tunnel
R1#ping ::172.16.102.1
Sending 5, 100-byte ICMP Echos to ::172.16.102.1, timeout is 2 seconds:
!!!!!
R1#
ttl=254 tos=0x0)
(len=120, ttl=254)
*Mar 1 00:27:44.395:
::172.16.102.1 -> ::172.16.101.1 (len=60 ttl=64)
ttl=254 tos=0x0)
(len=120, ttl=254)
*Mar 1 00:27:44.503:
::172.16.102.1 -> ::172.16.101.1 (len=60 ttl=64)
ttl=254 tos=0x0)
1-888-677-2669

Revision: 1.0 (11/30/2006)

(len=120, ttl=254)
*Mar 1 00:27:44.571
R1#:
::172.16.102.1 -> ::172.16.101.1 (len=60 ttl=64)
ttl=254 tos=0x0)
(len=120, ttl=254)
*Mar 1 00:27:44.679:
::172.16.102.1 -> ::172.16.101.1 (len=60 ttl=64)
ttl=254 tos=0x0)
(len=120, ttl=254)
*Mar 1 00:27:44.767:
::172.16.102.1 -> ::172.16.101.1 (len=60 ttl=64)
R1#
3. Lets ping the 24::24:2 from R1 and debug ip packet detail

R1#ping 24::24:2
*Mar 1 00:33:32.411:
*Mar 1 00:33:32.415:
*Mar 1 00:33:32.419:
originating
*Mar 1 00:33:32.419:
*Mar 1 00:33:32.443:
*Mar 1 00:33:32.447:
*Mar 1 00:33:32.447:
*Mar 1 00:33:32.451:
not found.
IPv6: source FE80::CE00:1FF:FEFC:0 (local)

dest FF02::9 (Serial1/1)
IPv6: Sending on Serial1/1
IPv6: SAS picked source 13::13:1 for 24::24:2 (Serial1/1)
IPv6: source 13::13:1 (local)
dest 24::24:2
It is a similar issue to what we saw in 6to4 tunnels. You need to create a static route to 24::/64 to send via
::172.16.102.1. Address ::172.16.102.1 will be used by IPv4 compatible IPv6 scheme to derive the IPv4
address 172.16.102.1 for the tunnel destination
R1(config)#ipv6 route 24::/64 ::172.16.102.1
R1(config)#
R1#ping 24::24:2
!!!!!
R1#
IPv4 compatible IPv6 tunnels are similar to 6to4 tunnels in a respect of how they use the next hop address
to derive the IPV4 address for the tunnel destination.
I think we are ready to connect two IPv6 RIP domains with the BGP peer relationship between R1 and R2.
Please look at the following diagram:
1-888-677-2669

Revision: 1.0 (11/30/2006)
R1 and R2 are in BGP AS1 and AS2 respectively and will form peer relationship over IPv4 Compatible
IPv6 tunnel. BGP will be used to provide reachability between two IPv6 RIP domains. The ultimate goal is
to ping from 13::13:3 of R3 the 24::24:4 address of R4. No static routes will be used in this scenario.
6. Remove static route from R1:
R1(config)#no ipv6 route 24::/64 ::172.16.102.1
tunnel:
R1(config-router)#neighbor ::172.16.102.1 remote-as 2
R1(config-router)#
R2(config-router)#neighbor ::172.16.101.1 remote-as 1

R1(config-router)#
*Mar 1 01:10:13.483: %BGP-5-ADJCHANGE: neighbor ::172.16.102.1 Up
R2#
*Mar
1 01:10:12.651: %BGP-5-ADJCHANGE: neighbor ::172.16.101.1 Up
1-888-677-2669

Revision: 1.0 (11/30/2006)
8. Configured IPv6 RIP instance on the interfaces on links between R1 R3 and R2 R4.
R1(config-router-af)#neighbor ::172.16.102.1 activate
R1(config-rtr)#
R2(config-router-af)#neighbor ::172.16.101.1 activate
R2(config-rtr)#
Network
*> 13::/64
*> 24::/64
R1#
Next Hop
::
::172.16.102.1

0
32768 ?
0
0 2 ?

1-888-677-2669

Revision: 1.0 (11/30/2006)

24::/64 [20/0]
via ::172.16.102.1
B
R1#

Network
Next Hop
*> 13::/64
::172.16.101.1
0
0 1 ?
*> 24::/64
::
0
32768 ?
B
13::/64 [20/0]
via ::172.16.101.1
R2#
R1 and R2 have remote IPv6 RIP prefixes learned via the IPv4 compatible IPv6 tunnel IPv6 address as a
next hop, thats what we want to see in the routing table.
R
24::/64 [120/2]
R3#
R
13::/64 [120/2]
R4#
R3#ping 24::24:4
!!!!!
R3#
1-888-677-2669

Revision: 1.0 (11/30/2006)
1.6
ISATAP Tunnel
Characteristics of the automatic 6to4 tunnel
ISATAP is an automatic overlay tunneling mechanism that uses the underlying IPv4 network as a
NBMA link layer for IPv6.
SATAP is designed for transporting IPv6 packets within a site where a native IPv6 infrastructure is
not yet available; for example, when sparse IPv6 hosts are deployed for testing. ISATAP tunnels
allow individual IPv4 or IPv6 dual-stack hosts within a site to communicate with other such hosts
on the same virtual link, basically creating an IPv6 network using the IPv4 infrastructure.
The ISATAP router provides standard router advertisement network configuration support for the
ISATAP site. This feature allows clients to automatically configure themselves as they would do if
they were connected to an Ethernet.
It can also be configured to provide connectivity out of the site.
ISATAP uses a well-defined IPv6 address format composed of any unicast IPv6 prefix (/64), which
can be link local, or global (including 6to4 prefixes), enabling IPv6 routing locally or on the
Internet.
The IPv4 address is encoded in the last 32 bits of the IPv6 address, enabling automatic IPv6-inIPv4 tunneling.
Although the ISATAP tunneling mechanism is similar to other automatic tunneling mechanisms,
such as IPv6 6to4 tunneling, ISATAP is designed for transporting IPv6 packets within a site, not
between sites.
The Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) is an automatic overlay tunneling
mechanism that uses the underlying IPv4 network as a NBMA link layer for IPv6. ISATAP uses a welldefined IPv6 address format composed of any unicast IPv6 prefix (/64), which can be link-local, or global
(including 6to4 prefixes), enabling IPv6 routing locally or on the Internet. The IPv4 address is encoded in
the last 32 bits of the IPv6 address, enabling automatic IPv6-in-IPv4 tunneling. ISATAP uses unicast
addresses that include a 64-bit IPv6 prefix and a 64-bit interface identifier. The interface identifier is
created in modified EUI-64 format in which the first 32 bits contain the value 000:5EFE to indicate that the
address is an IPv6 ISATAP address:
or
1-888-677-2669

Revision: 1.0 (11/30/2006)
Table 27 IPv6 ISATAP Address Format

64 Bits
32 Bits
32 Bits
link local or global IPv6 unicast prefix
0000:5EFE
IPv4 address of the

ISATAP link
ISATAP Tunnel Configuration

IPV6_manual_tunnel_4_routers_init.net, IPV6_ISATAP_BGP_tunnel_final.net
ISATAP tunnel will be setup between two border routers R1 and R2. The IPv4 address of the border router
R1 is 172.16.101.1. The IPv4 address of the border router R2 is 172.16.102.1. IPV4 connectivity between
these two R1 and R2 is provided by IPv4 RIP routing protocol.
IPv4 addresses 172.16.101.1 and 172.16.102.1 will be used for the tunnel source on R1 and R2
respectively. The tunnel destination s automatically determined by the ISATAP encapsulation schema.
1-888-677-2669

Revision: 1.0 (11/30/2006)
1. Configure ISATAP IPv6 Tunnel 12 on both routers R1 and R2:

R1(config-if)# ipv6 address 12:12::/64 eui-64
R1(config-if)# tunnel mode ipv6ip isatap
R2(config-if)# ipv6 address 12:12::/64 eui-64
R2(config-if)# tunnel mode ipv6ip isatap
Check the properties of interface and IPv6 interface:

R1#show int tunnel 12
Hardware is Tunnel
Keepalive not set
Tunnel source 172.16.101.1, destination UNKNOWN
Tunnel protocol/transport IPv6 ISATAP
R1#
IPv6 is enabled, link-local address is FE80::5EFE:AC10:6501
12:12::5EFE:AC10:6501, subnet is 12:12::/64 [EUI]
FF02::1
FF02::2
FF02::1:FF10:6501
MTU is 1480 bytes
ND DAD is not supported
R1#
You will see similar outputs on R2.

1-888-677-2669

Revision: 1.0 (11/30/2006)
2. On R1 ping the tunnel endpoint of R2 and run debug tunnel:

R1#ping 12:12::5EFE:AC10:6601
Sending 5, 100-byte ICMP Echos to 12:12::5EFE:AC10:6601, timeout is 2 seconds:
!!!!!
R1#
ttl=254 tos=0x0)
(len=120, ttl=254)
*Mar 1 01:28:59.483:
12:12::5EFE:AC10:6601 -> 12:12::5EFE:AC10:6501 (len=60
ttl=64)
ttl=254 tos=0x0)
(len=120, ttl=254)
*Mar 1 01:28:59.607:
12:12::5EFE:AC10:6601 -> 12:12::5EFE:AC10:6501 (len=60
ttl=64)
ttl=254 tos=0x0)
(len=120, ttl=254)
*Mar 1 01:28:59.731:
12:12::5EFE:AC10:6601 -> 12:12::5EFE:AC10:6501 (len=60
ttl=64)
ttl=254 tos=0x0)
(len=120, ttl=254)
*Mar 1 01:28:59.831:
12:12::5EFE:AC10:6601 -> 12:12::5EFE:AC10:6501 (len=60
ttl=64)
ttl=254 tos=0x0)
(len=120, ttl=254)
*Mar 1 01:28:59.951:
12:12::5EFE:AC10:6601 -> 12:12::5EFE:AC10:6501 (len=60
ttl=64)
R1#
You can ping even link local IPv6 address of the opposite endpoint of the ISATAP tunnel:
R1#deb tunn
R1#ping FE80::5EFE:AC10:6601
Output Interface: tunnel12
Sending 5, 100-byte ICMP Echos to FE80::5EFE:AC10:6601, timeout is 2 seconds:
Packet sent with a source address of FE80::5EFE:AC10:6501
!!!!
ttl=254 tos=0x0)
(len=120, ttl=254)
1-888-677-2669

Revision: 1.0 (11/30/2006)
*Mar 1 01:31:28.099:
FE80::5EFE:AC10:6601 -> FE80::5EFE:AC10:6501 (len=60
ttl=64)
ttl=254 tos=0x0)
(len=120, ttl=254)
*Mar 1 01:31:28.207:
ttl=64)
ttl=254 tos=0x0)
(len=120, ttl=254)
*Mar 1 01:31:28.363:
ttl=64)
ttl=254 tos=0x0)
(len=120, ttl=254)!
*Mar 1 01:31:28.483:
ttl=64)
ttl=254 tos=0x0)
(len=120, ttl=254)
*Mar 1 0
3. Lets ping the 24::24:2 from R1 and debug ip packet detail

R1#ping 24::24:2
*Mar 1 00:33:32.411:
*Mar 1 00:33:32.415:
*Mar 1 00:33:32.419:
originating
*Mar 1 00:33:32.419:
*Mar 1 00:33:32.443:
*Mar 1 00:33:32.447:
*Mar 1 00:33:32.447:
*Mar 1 00:33:32.451:
not found.
IPv6: source FE80::CE00:1FF:FEFC:0 (local)

dest FF02::9 (Serial1/1)
IPv6: Sending on Serial1/1
IPv6: SAS picked source 13::13:1 for 24::24:2 (Serial1/1)
IPv6: source 13::13:1 (local)
dest 24::24:2
It is a similar issue to what we saw in 6to4 and IPv4 compatible IPv6 tunnels. You need to create a static
route to 24::/64. The next hop of this static route can be either the tunnel interface with the link local IPv6
address of ISATAP tunnel interface of R2.
R1(config)#ipv6 route 24::/64 tunnel 12 FE80::5EFE:AC10:6601
R1#ping 24::24:2
!!!!!
R1#
1-888-677-2669

Revision: 1.0 (11/30/2006)
Or Global IPv6 address of the ISATAP tunnel of R2

R1(config)#no ipv6 route 24::/64 tunnel 12 FE80::5EFE:AC10:6601
R1(config)#ipv6 route 24::/64 12:12::5EFE:AC10:6601
R1(config)#
R1#ping 24::24:2
!!!!!
R1#
Addresses
FE80::5EFE:AC10:6601 or
FE80::5EFE:AC10:6601 will be used by the ISATAP
encapsulation scheme to derive the IPv4 address 172.16.102.1 for the tunnel destination.
IPv4 compatible IPv6 tunnels are similar to 6to4 tunnels in a respect of how they use the next hop address
to derive the IPV4 address for the tunnel destination.
Lets connect two IPv6 RIP domains with the BGP peer relationship between R1 and R2. Please look at
the following diagram:
1-888-677-2669

Revision: 1.0 (11/30/2006)
R1 and R2 are in BGP AS1 and AS2 respectively and will form peer relationship over IPv4 Compatible
IPv6 tunnel. BGP will be used to provide reachability between two IPv6 RIP domains. The ultimate goal is
to ping from 13::13:3 of R3 the 24::24:4 address of R4. No static routes will be used in this scenario.
4. Remove static route from R1:
R1(config)#no ipv6 route 24::/64 ::172.16.102.1
tunnel:
R1(config-router)#neighbor 12:12::5EFE:AC10:6601 remote-as 2
R1(config-router)#
R2(config-router)#neighbor 12:12::5EFE:AC10:6501 remote-as 1

R1(config-router)#
*Mar 1 01:10:13.483: %BGP-5-ADJCHANGE: neighbor 12:12::5EFE:AC10:6601 Up
R2#
*Mar
1 01:10:12.651: %BGP-5-ADJCHANGE: neighbor 12:12::5EFE:AC10:6501 Up
6. Configured IPv6 RIP instance on the interfaces on links between R1 R3 and R2 R4.
R1(config-router-af)#neighbor 12:12::5EFE:AC10:6601 activate
1-888-677-2669

Revision: 1.0 (11/30/2006)

R1(config-rtr)#
R2(config-router-af)#neighbor 12:12::5EFE:AC10:6501 activate
R2(config-rtr)#
Network
*> 13::/64
*> 24::/64
Next Hop
::
0
32768 ?
12:12::5EFE:AC10:6601
0
0 2 ?
R1#
B
24::/64 [20/0]
via 12:12::5EFE:AC10:6601
R1#

Network
*> 13::/64
*> 24::/64
R2#
Next Hop
12:12::5EFE:AC10:6501
0
0 1 ?
::
0
32768 ?

B
13::/64 [20/0]
via 12:12::5EFE:AC10:6501
R2#
1-888-677-2669

Revision: 1.0 (11/30/2006)
R1 and R2 have remote IPv6 RIP prefixes learned via the IPv4 compatible IPv6 tunnel IPv6 address as a
next hop, thats what we want to see in the routing table.
R
24::/64 [120/2]
R3#

R
13::/64 [120/2]
R4#
R3#ping 24::24:4
!!!!!
R3#
1-888-677-2669

Revision: 1.0 (11/30/2006)
1.7
Initial Configuration Scripts
hostname R1
!
ip tcp synwait-time 5
!
no ip domain lookup
!
!
interface Loopback101
ip address 172.16.101.1 255.255.255.0
!
interface Serial1/0
ip address 172.16.12.1 255.255.255.0
no shutdown
!
interface Serial1/1
ip address 172.16.13.1 255.255.255.0
ipv6 address 13::13:1/64
no shutdown
!
!
router rip
network 172.16.0.0
!
!
banner motd #
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+
+
+
NETMASTERCLASS Class On Demand: IPv6 Module
+
+
IPv6-over-IPv4 Tunneling
+
+
+
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
#
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
line vty 0 4
privilege level 15
no login
line vty 5 15
privilege level 15
no login
!
!
end
================================================================================
hostname R2
!
!
no ip domain lookup
!
!
1-888-677-2669

Revision: 1.0 (11/30/2006)
interface Loopback102
ip address 172.16.102.1 255.255.255.0
!
interface Serial1/0
ip address 172.16.12.2 255.255.255.0
no shutdown
!
interface Serial1/1
ip address 172.16.24.2 255.255.255.0
no shutdown
!
!
router rip
network 172.16.0.0
!
!
banner motd #
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+
+
+
+
+
+
+
+
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
#
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
line vty 0 4
privilege level 15
no login
line vty 5 15
privilege level 15
no login
!
!
end
================================================================================
hostname R3
!
!
no ip domain lookup
!
!
interface Serial1/0
ip address 172.16.13.3 255.255.255.0
no shutdown
!
banner motd #
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+
+
+
+
+
+
+
+
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1-888-677-2669

Revision: 1.0 (11/30/2006)
#
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
line vty 0 4
privilege level 15
no login
line vty 5 15
privilege level 15
no login
!
!
end
================================================================================
hostname R4
!
!
no ip domain lookup
!
!
interface Serial1/0
ip address 172.16.24.4 255.255.255.0
no shutdown
!
!
banner motd #
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+
+
+
+
+
+
+
+
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
#
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
line vty 0 4
privilege level 15
no login
line vty 5 15
privilege level 15
no login
!
!
end
1-888-677-2669


Ipv6 Ipv4 Tunnel

Загружено:

Сведения о документе

Исходное описание:

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

Ipv6 Ipv4 Tunnel

Загружено:

Авторское право:

Доступные форматы

Revision

NMC-COD IPV6 TUNNELING Page 1

2006 Copyright NetMasterClass, LLC - All rights reserved.

Revision: 1.0 (11/30/2006)

NMC-COD IPV6 TUNNELING Page 2

Cisco Non-Disclosure Agreement Compliance

2006 Copyright NetMasterClass, LLC - All rights reserved.

Revision: 1.0 (11/30/2006)

NMC-COD IPV6 TUNNELING Page 3

NMC-COD: IPv6 Tunneling

Dynamips configuration files ...........................................................................................................4

2006 Copyright NetMasterClass, LLC - All rights reserved.

Revision: 1.0 (11/30/2006)

NMC-COD IPV6 TUNNELING Page 4

Dynamips configuration files

Used IOS version:

2006 Copyright NetMasterClass, LLC - All rights reserved.

Revision: 1.0 (11/30/2006)

NMC-COD IPV6 TUNNELING Page 5

Manual IPv6 Tunnel over IPv4 network

Characteristics of the manual IPv6 tunnel

2006 Copyright NetMasterClass, LLC - All rights reserved.

Revision: 1.0 (11/30/2006)

NMC-COD IPV6 TUNNELING Page 6

Manual Tunnel Configuration:

Configure the tunnel on R1 and R2:

2006 Copyright NetMasterClass, LLC - All rights reserved.

Revision: 1.0 (11/30/2006)

NMC-COD IPV6 TUNNELING Page 7

IPv6/IP to classify 172.16.101.1->172.16.102.1 (len=120

Answer: It is IPv4 protocol number 41 which is according to IANAs PROTOCOL NUMBERS at

Here are some important properties of the tunnel interface:

2006 Copyright NetMasterClass, LLC - All rights reserved.

Revision: 1.0 (11/30/2006)

NMC-COD IPV6 TUNNELING Page 8

R1#show interfaces tunnel 12

172.16.101.1 -> AC10:6501

Likewise on R2 the tunnel source 172.16.102.1 will be translated to AC10:6601

2006 Copyright NetMasterClass, LLC - All rights reserved.

Revision: 1.0 (11/30/2006)

NMC-COD IPV6 TUNNELING Page 9

Routing protocols over a manual IPv6 tunnel

2006 Copyright NetMasterClass, LLC - All rights reserved.

Revision: 1.0 (11/30/2006)

NMC-COD IPV6 TUNNELING Page 10

On R1 check the RIP prefixes learned via the Tunnel12 interface:

Check the routing table on the other routers:

2006 Copyright NetMasterClass, LLC - All rights reserved.

Revision: 1.0 (11/30/2006)

NMC-COD IPV6 TUNNELING Page 11

R3#show ipv6 route rip

2006 Copyright NetMasterClass, LLC - All rights reserved.

Revision: 1.0 (11/30/2006)

NMC-COD IPV6 TUNNELING Page 12

GRE IPv4/IPv6 Tunnel

Characteristics of the GRE IPv4/IPv6 tunnel

2006 Copyright NetMasterClass, LLC - All rights reserved.

Revision: 1.0 (11/30/2006)

NMC-COD IPV6 TUNNELING Page 13

GRE IPv4 Tunnel Configuration:

IPv6 is a passenger protocol.

Configure tunnel on R1 and R2:

2006 Copyright NetMasterClass, LLC - All rights reserved.