Description

 This article provides information on how to ping the IPV6 interface on SRX.

Solution

  1. Configure the interface with the IPV6 address:
    root# set interfaces ge-0/0/0 unit 0 family inet6 address 2001:0660::a/64
  2. Configure the interface in the zone and allow the host inbound service as in a normal IPV4:
    root# set security zones security-zone untrust interfaces ge-0/0/0.0
    root# set security zones security-zone untrust host-inbound-traffic system-services ping
  3. Now if it was an IPV4 address, it would be pinging; but for IPV6 it fails. 
    root> ping inet6 2001:660::a 
PING6(56=40+8+8 bytes) 2001:660::a --> 2001:660::b
^C
--- 2001:660:1000:8c00::a ping6 statistics ---
4 packets transmitted, 0 packets received, 100% packet loss
  4. Now this is very important and different from the normal IPV4 ping. You have to enable IPV6 flow in the security forwarding-options and then reboot the device. 
    root# set security forwarding-options family inet6 mode flow-based

root# exit

root> request system reboot

root> ping inet6 2001:660:1000:8c00::a 
PING6(56=40+8+8 bytes) 2001:660::a --> 2001:660::b
16 bytes from 2001:660::a, icmp_seq=0 hlim=64 time=9.474 ms
16 bytes from 2001:660::a, icmp_seq=1 hlim=64 time=13.399 ms
16 bytes from 2001:660::a, icmp_seq=2 hlim=64 time=8.276 ms
^C
--- 2001:660::a ping6 statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/std-dev = 8.276/10.383/13.399/2.188 ms

Modification History

2020-06-25: Article reviewed for accuracy; no changes required.

Related Information