Automatic 6to4 mechanism


Here is a small animation explaining how automatic 6to4 works. For more details about the deployment please refer to this previous post.

(Note: clear your browser cache to update the latest animation)

 

Click on the image below to go to the flash animation:
Screenshot - 161017 - 16:07:52

Advertisements

6to4 tunneling method comparison


Automatic 6to4 Transition


Unfortunately NOT all Internet Service Providers have switched fully to IPv6 and until a native IPv6 connection is provided to your IPv6 site(s) you will have to use some transition methods like automatic 6to4.

Automatic 6to4 is a point-to-multipoint tunneling method, where the tunnel destination is determined from the border router IPv4 address facing the IPv4 network.

  • The border routers that delimit the 6to4 tunnel must support IPv4 and IPv6 and are not configured in pair.
  • Automatic 6to4 can be used to connect two IPv6 networks as well an IPv6 host to an IPv6 network.
  • IPv6 network is treated as NBMA link.
  • The IPv4 embedded in IPv6 is used to find the other end of the tunnel.
  • Border routers create a tunnel on a per packet basis to other IPv6 Border router.

Don’t share the same tunnel source interface between different tunnels, because it is used for de-multiplex incoming packet to tunnel interface.

Each IPv6 site must have a globally unique IPv4.

The IPv6 address format used for this type of transition method is as follow:

2002

<ipv4 address in HEX>

<subnet_part>

Interface ID

16 bits

32 bits

16 bits

64 bits

The subnet part can be used to number networks within the site

2002:<ipv4 address in HEX>:<subnet_part>:<interface_ID>/64

The configuration commands are quite simple:

ipv6 unicast-routing
!

interface Tunnel <X>

ipv6 address 2002:<ipv4 address in HEX>:<subnet>:<int_ID>/64

tunnel source <src_int>

tunnel mode ipv6ip 6to4

!

ipv6 route 0::0/0 Tunnel<X>

Before starting the configuration, carefully plan your address scheme. All ipv6 addresses are based on the IPv4 addresses assigned to physical interfaces of each site facing the IPv4 network.

IPv6 Addresses are assigned per-site, NOT in pair between border routers.

Make sure you already have successful connectivity between sites through IPv4 network.

Because automatic 6to4 handles tunnel interface as point-to-multipoint and all site traffic (IPv6) should be transported over IPv4 network, a static route to the tunnel interface is required.

In this lab three types of media will be treated : Serial HDLC, Ethernet and Frame Relay.

  1. SERIAL:

Figure 1 depicts the topology used for serial connection:

Figure 1: Topology for serial connection


192.168.0.0/24 is used for the link between East IPv6 site and West IPv6 site:

  • BWest – serial1/0 ipv4 = 192.168.0.1 = c0a8:0001
  • Best – serial1/0 ipv4 = 192.168.0.2 = c0a8:0002

Addressing scheme for West IPv6 site:

The IPv6 address format used is as follow:

2002:

C0a8:0001:

0001:/48

Subnet used for tunnel ipv6 address at BWest

2002:

C0a8:0001:

0001:

::1/64

BWest tunnel ipv6 address.

2002:

C0a8:0001:

0002:/48

Subnet used for network inside West site.

2002:

C0a8:0001:

0002:

::1

BWest Fa0/0 ipv6 address.

2002:

C0a8:0001:

0002:

::2

Westv6 Fa0/0 ipv6 address.

Addressing scheme for Est IPv6 site:

The IPv6 address format used is as follow:

2002:

C0a8:0002:

0001:/48

Subnet used for tunnel ipv6 address at BEst

2002:

C0a8:0002:

0001:

::1/64

BEst tunnel ipv6 address.

2002:

C0a8:0002:

0002:/48

Subnet used for network inside Est site.

2002:

C0a8:0002:

0002:

::1

BEst Fa0/0 ipv6 address.

2002:

C0a8:0002:

0002:

::2

Estv6 Fa1/0 ipv6 address.

Do not forget to enable ipv6 unicast routing on All IPv6 routers, unlike routing protocols, the IOS will not warn you if you are using ipv6 static routing with ipv6 routing disabled.

Make sure you have a static route to 2002::/16 pointing to the tunnel interface.

Configuration commands:

BEast:

ipv6 unicast-routing
!

!

!

interface Tunnel1

ipv6 address 2002:C0A8:2:1::1/64

tunnel source Serial1/0

tunnel mode ipv6ip 6to4

!

interface FastEthernet0/0

ipv6 address 2002:C0A8:2:2::1/64

!

interface Serial1/0

ip address 192.168.0.2 255.255.255.0

!

!

ipv6 route 2002::/16 Tunnel1

Estv6:

ipv6 unicast-routing
!

interface FastEthernet0/0

ipv6 address 2001:B:B:B::B/64

ipv6 address FE80:B:B:B::B link-local

!

interface FastEthernet1/0

ipv6 address 2002:C0A8:2:2::2/64

!

ipv6 route ::/0 2002:C0A8:2:2::1

BWest:

ipv6 unicast-routing
!

!

interface Tunnel1

ipv6 address 2002:C0A8:1:1::1/64

tunnel source Serial1/0

tunnel mode ipv6ip 6to4

!

interface FastEthernet0/0

ipv6 address 2002:C0A8:1:2::1/64

!

interface Serial1/0

ip address 192.168.0.1 255.255.255.0

!

!

ipv6 route 2002::/16 Tunnel1

Westv6

ipv6 unicast-routing
!

interface FastEthernet0/0

ipv6 address 2002:C0A8:1:2::2/64

!

ipv6 route ::/0 2002:C0A8:1:1::1

Troubleshooting:

East6:

Eastv6(config)#do ping 2002:c0a8:1:2::2
Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:C0A8:1:2::2, timeout is 2 seconds:

!!!!!

Success rate is 40 percent (2/5), round-trip min/avg/max = 176/182/188 ms

Eastv6(config)#

BEast:

BEast#sh int tunnel 1
Tunnel1 is up, line protocol is up

Hardware is Tunnel

MTU 1514 bytes, BW 9 Kbit, DLY 500000 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation TUNNEL, loopback not set

Keepalive not set


Tunnel source 192.168.0.2 (Serial1/0),
destination UNKNOWN

Tunnel protocol/transport IPv6 6to4

Fast tunneling enabled

Tunnel transmit bandwidth 8000 (kbps)

Tunnel receive bandwidth 8000 (kbps)


BEast#

Because 6to4 tunnelling is point-to-multipoint, the tunnel destination is not preconfigured “UNKNOWN”.

BEast(config)#do debug tunnel
Tunnel Interface debugging is on

*Mar 1 09:26:48.445: Tunnel1: IPv6/IP to classify 192.168.0.1->192.168.0.2 (len=120 ttl=254 tos=0x0)

*Mar 1 09:26:48.445: Tunnel1: to decaps IPv6/IP packet 192.168.0.1->192.168.0.2 (len=120, ttl=254)

*Mar 1 09:26:48.449: Tunnel1: decapsulated IPv6/IP packet

*Mar 1 09:26:48.449: 2002:C0A8:1:2::2 -> 2002:C0A8:2:2::2 (len=60 ttl=63)

*Mar 1 09:26:50.605: Tunnel1: IPv6/IP to classify 192.168.0.1->192.168.0.2 (len=120 ttl=254 tos=0x0)

*Mar 1 09:26:50.605: Tunnel1: to decaps IPv6/IP packet 192.168.0.1->192.168.0.2 (len=120, ttl=254)

*Mar 1 09:26:50.609: Tunnel1: decapsulated IPv6/IP packet

*Mar 1 09:26:50.609: 2002:C0A8:1:2::2 -> 2002:C0A8:2:2::2 (len=60 ttl=63)

*Mar 1 09:26:52.777: Tunnel1: IPv6/IP to classify 192.168.0.1->192.168.0.2 (len=120 ttl=254 tos=0x0)

*Mar 1 09:26:52.781: Tunnel1: to decaps IPv6/IP packet 192.168.0.1->192.168.0.2 (len=120, ttl=254)

*Mar 1 09:26:52.781: Tunnel1: decapsulated IPv6/IP packet

*Mar 1 09:26:52.781: 2002:C0A8:1:2::2 -> 2002:C0A8:2:2::2 (len=60 ttl=63)

BEast(config)#

  1. ETHERNET:

Another site (North) is added and all sites are connected through an Ethernet switch like illustrated in Figure2.

Figure2: Topology with Ethernet


The previous East and West site address schemas are kept and a new address scheme is designed for North site:

The ipv4 address of 192.168.0.0/24 is used for Ethernet between North, East, and West IPv6 sites:

  • BNorth – serial1/0 ipv4 = 192.168.0.3 = c0a8:0003

Addressing scheme for North IPv6 site:

The IPv6 address format used is as follow:

2002:

C0a8:0003:

0001:/48

Subnet used for tunnel ipv6 address at BNorth

2002:

C0a8:0003:

0001:

::1/64

BNorth tunnel ipv6 address.

2002:

C0a8:0003:

0002:/48

Subnet used for network inside North site.

2002:

C0a8:0003:

0002:

::1

BNorth Fa0/0 ipv6 address.

2002:

C0a8:0003:

0002:

::2

Northv6 Fa0/0 ipv6 address.

Configuration commands:

As follow the configuration of the North site, practically nothing changed, this time we are just dealing with Ethernet media.

BNorth:

ipv6 unicast-routing
!

interface Tunnel1

ipv6 address 2002:C0A8:3:1::1/64

tunnel source FastEthernet1/0

tunnel mode ipv6ip 6to4

!

interface FastEthernet0/0

ipv6 address 2002:C0A8:3:2::1/64

!

interface FastEthernet1/0

ip address 192.168.0.3 255.255.255.0

!

!

ipv6 route 2002::/16 Tunnel1

Northv6:

ipv6 unicast-routing
!

interface FastEthernet0/0

ipv6 address 2002:C0A8:3:2::2/64

!

!

ipv6 route ::/0 2002:C0A8:3:2::1

BWest:

ipv6 unicast-routing
!

interface Tunnel1

ipv6 address 2002:C0A8:1:1::1/64

tunnel source FastEthernet1/0

tunnel mode ipv6ip 6to4

!

interface FastEthernet0/0

ipv6 address 2002:C0A8:1:2::1/64

!

interface FastEthernet1/0

ip address 192.168.0.1 255.255.255.0

!

ipv6 route 2002::/16 Tunnel1

BEst:

ipv6 unicast-routing
!

interface Tunnel1

ipv6 address 2002:C0A8:2:1::1/64

tunnel source FastEthernet1/0

tunnel mode ipv6ip 6to4

!

interface FastEthernet0/0

ipv6 address 2002:C0A8:2:2::1/64

!

interface FastEthernet1/0

ip address 192.168.0.2 255.255.255.0

!

ipv6 route 2002::/16 Tunnel1

Troubleshooting

Northv6:

Northv6(config)#do ping 2002:c0a8:1:2::2 repeat 1
Type escape sequence to abort.

Sending 1, 100-byte ICMP Echos to 2002:C0A8:1:2::2, timeout is 2 seconds:

!

Success rate is 100 percent (1/1), round-trip min/avg/max = 220/220/220 ms

Northv6(config)#do ping 2002:c0a8:2:2::2 repeat 1

Type escape sequence to abort.

Sending 1, 100-byte ICMP Echos to 2002:C0A8:2:2::2, timeout is 2 seconds:

!

Success rate is 100 percent (1/1), round-trip min/avg/max = 220/220/220 ms

Northv6(config)#

BNorth:

BNorth(config)#do debug tunnel
Tunnel Interface debugging is on

BNorth(config)#

*Mar 1 01:01:13.351: Tunnel1: IPv6/IP to classify 192.168.0.1->192.168.0.3 (len=120 ttl=254 tos=0x0)

*Mar 1 01:01:13.355: Tunnel1: to decaps IPv6/IP packet 192.168.0.1->192.168.0.3 (len=120, ttl=254)

*Mar 1 01:01:13.359: Tunnel1: decapsulated IPv6/IP packet

*Mar 1 01:01:13.359: 2002:C0A8:1:2::2 -> 2002:C0A8:3:2::2 (len=60 ttl=63)

BNorth(config)#

*Mar 1 01:01:32.979: Tunnel1: IPv6/IP to classify 192.168.0.2->192.168.0.3 (len=120 ttl=254 tos=0x0)

*Mar 1 01:01:32.983: Tunnel1: to decaps IPv6/IP packet 192.168.0.2->192.168.0.3 (len=120, ttl=254)

*Mar 1 01:01:32.987: Tunnel1: decapsulated IPv6/IP packet

*Mar 1 01:01:32.987: 2002:C0A8:2:2::2 -> 2002:C0A8:3:2::2 (len=60 ttl=63)

BNorth(config)#

BNorth(config)#

Note that automatic 6to4 determine each time the needed tunnel destination address and send each packet accordingly.

To reach the Eastern isolated IPv6 network it uses the IP packet with addresses 192.168.0.3->192.168.0.2 that encapsulates IPv6 packet 2002:C0A8:3:2::2 -> 2002:C0A8:2:2::2.

To reach the Western isolated IPv6 network it uses the IP packet with addresses 192.168.0.3->192.168.0.1 that encapsulates IPv6 packet 2002:C0A8:3:2::2 -> 2002:C0A8:1:2::2; and what we see in the previous debug is return traffic.

The following trace command output illustrates the different path taken each time to reach different destination tunnel.

Northv6(config)#do trace 2002:c0a8:2:2::2
Type escape sequence to abort.

Tracing the route to 2002:C0A8:2:2::2

1 2002:C0A8:3:2::1 104 msec 32 msec 56 msec

2 2002:C0A8:2:1::1 232 msec 88 msec 120 msec

3 2002:C0A8:2:2::2 280 msec 168 msec 108 msec

Northv6(config)#

Northv6(config)#do trace 2002:c0a8:1:2::2

Type escape sequence to abort.

Tracing the route to 2002:C0A8:1:2::2

1 2002:C0A8:3:2::1 76 msec 24 msec 40 msec

2 2002:C0A8:1:1::1 200 msec 120 msec 64 msec

3 2002:C0A8:1:2::2 216 msec 152 msec 124 msec

Northv6(config)#

Northv6(config)#

  1. FR NBMA point-to-multipoint(figure3):

The same thing here, except for the FR Connectivity with point-multipoint there is no change to 6to4 configuration, first make sure that FR connectivity is successful and then you can set the 6to4 transition method using the interface ipv4.

Figure3: Topology FR


FR configuration commands:

BNorth:

interface Serial1/0
no ip address

encapsulation frame-relay

serial restart-delay 0

!

interface Serial1/0.123 multipoint

ip address 192.168.0.3 255.255.255.0

frame-relay map ip 192.168.0.1 102 broadcast

frame-relay map ip 192.168.0.2 101 broadcast

BNorth(config-if)#do sh frame map
Serial1/0.123 (up): ip 192.168.0.1 dlci 102(0x66,0x1860), static,

broadcast,

CISCO, status defined, active

Serial1/0.123 (up): ip 192.168.0.2 dlci 101(0x65,0x1850), static,

broadcast,

CISCO, status defined, active

BNorth(config-if)#

BEast:

interface Serial1/0
no ip address

encapsulation frame-relay

no frame-relay inverse-arp

!

interface Serial1/0.123 multipoint

ip address 192.168.0.2 255.255.255.0

frame-relay map ip 192.168.0.1 203 broadcast

frame-relay map ip 192.168.0.3 110 broadcast

BEast(config-subif)#do sh frame map
Serial1/0.123 (up): ip 192.168.0.1 dlci 203(0xCB,0x30B0), static,

broadcast,

CISCO, status defined, active

Serial1/0.123 (up): ip 192.168.0.3 dlci 110(0x6E,0x18E0), static,

broadcast,

CISCO, status defined, active

BEast(config-subif)#

BWest:

interface Serial1/0
no ip address

encapsulation frame-relay

no frame-relay inverse-arp

!

interface Serial1/0.123 multipoint

ip address 192.168.0.1 255.255.255.0

frame-relay map ip 192.168.0.2 302 broadcast

frame-relay map ip 192.168.0.3 201 broadcast

BWest(config-subif)#do sh frame map
Serial1/0.123 (up): ip 192.168.0.2 dlci 302(0x12E,0x48E0), static,

broadcast,

CISCO, status defined, active

Serial1/0.123 (up): ip 192.168.0.3 dlci 201(0xC9,0x3090), static,

broadcast,

CISCO, status defined, active

BWest(config-subif)#

FR Connectivity Check:

BNorth(config-if)#do ping 192.168.0.2
Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.0.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 32/58/96 ms

BNorth(config-if)#do ping 192.168.0.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.0.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 32/61/108 ms

BNorth(config-if)#

Automatic 6to4 configuration:

BNorth:

ipv6 unicast-routing
!

!

interface Tunnel1

ipv6 address 2002:C0A8:3:1::1/64

tunnel source Serial1/0.123

tunnel mode ipv6ip 6to4

!

ipv6 route 2002::/16 Tunnel1

BNorth(config)#do ping 2002:c0a8:2:1::1
Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:C0A8:2:1::1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 28/70/112 ms

BNorth(config)#do ping 2002:c0a8:1:1::1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:C0A8:1:1::1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 36/62/112 ms

BNorth(config)#

BEast:

ipv6 unicast-routing
!

!

interface Tunnel1

ipv6 address 2002:C0A8:2:1::1/64

tunnel source Serial1/0.123

tunnel mode ipv6ip 6to4

!

ipv6 route 2002::/16 Tunnel1

BEast(config)# do ping 2002:c0a8:3:1::1
Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:C0A8:3:1::1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 44/71/120 ms

BEast(config)# do ping 2002:c0a8:1:1::1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:C0A8:1:1::1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 12/56/156 ms

BEast(config)#

BWest:

ipv6 unicast-routing
!

!

interface Tunnel1

ipv6 address 2002:C0A8:1:1::1/64

tunnel source Serial1/0.123

tunnel mode ipv6ip 6to4

!

ipv6 route 2002::/16 Tunnel1

BWest(config-if)#do ping 2002:c0a8:3:1::1
Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:C0A8:3:1::1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 40/76/132 ms

BWest(config-if)#do ping 2002:c0a8:2:1::1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:C0A8:2:1::1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 12/62/156 ms

BWest(config-if)#

Now the final check guys!

Ping and trace route from Westv6 and to Eastv6 and Northv6:

Westv6(config)#do ping 2002:c0a8:2:2::2
Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:C0A8:2:2::2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 88/182/428 ms

Westv6(config)#do ping 2002:c0a8:3:2::2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2002:C0A8:3:2::2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 104/164/228 ms

Westv6(config)#do trace 2002:c0a8:2:2::2

Type escape sequence to abort.

Tracing the route to 2002:C0A8:2:2::2

1 2002:C0A8:1:2::1 64 msec 56 msec 32 msec

2 2002:C0A8:2:1::1 228 msec 64 msec 72 msec

3 2002:C0A8:2:2::2 152 msec 124 msec 56 msec

Westv6(config)#do trace 2002:c0a8:3:2::2

Type escape sequence to abort.

Tracing the route to 2002:C0A8:3:2::2

1 2002:C0A8:1:2::1 64 msec 56 msec 28 msec

2 2002:C0A8:3:1::1 136 msec 120 msec 32 msec

3 2002:C0A8:3:2::2 124 msec 72 msec 112 msec

Westv6(config)#

Another opportunity to show you that mastering each technology separately will make your life easier when dealing with many technologies combined together.

%d bloggers like this: