Description

This article provides a summary of information about IPv4 and IPv6 IP-IP tunnel supported features and limitations in SRX series devices encountered while configuring IKE peer gateway addresses as IPv6 addresses.

Symptoms

When you try to configure IKE peer gateway addess as IPv6 address, then SRX returns the following  error messages:

error: invalid ip address or hostname:
error: statement creation failed:

Solution

 

 As of Junos OS Release 12.1X46-D10, the following tunnel modes are supported on SRX Series devices:

  • IPv4-in-IPv4 tunnels encapsulate IPv4 packets inside IPv4 packets.

  • IPv6-in-IPv6 tunnels encapsulate IPv6 packets inside IPv6 packets.

  • IPv6-in-IPv4 tunnels encapsulate IPv6 packets inside IPv4 packets.

  • IPv4-in-IPv6 tunnels encapsulate IPv4 packets inside IPv6 packets.

Limitations:

  • IPv6 policy-based VPNs are not supported on high-end SRX Series devices or on branch SRX Series devices in chassis cluster configurations. IPv6 policy-based VPNs are only supported with IPv6-in-IPv6 tunnels on standalone branch SRX Series devices.

  • Only one-to-one site-to-site VPN is supported. Many-to-one site-to-site VPN (NHTB) is not supported. NHTB configuration cannot be committed for tunnel modes other than IPv4-in-IPv4 tunnels.

  • IPsec VPN with active-active mode is supported only on branch SRX Series devices for route-based IPv6 tunnels. IPsec VPN with active-active mode is not supported on high-end SRX Series devices.

  • As with IPv4 tunnels, peer gateway address changes in the DNS name are not supported with IPv6 tunnels.

  • AutoVPN, group VPN, multicast dynamic routing and Xauth or modecfg over IPv6 are not supported.

  • NAT-T is supported only for IPv6-in-IPv4 and IPv4-in-IPv4 tunnel modes with IKEv1. IPv6-in-IPv6 and IPv4-in-IPv6 tunnel modes are not supported. IKEv2 is not supported for NAT-T. NAT-T from IPv6 to IPv4 or from IPv4 to IPv6 is not supported.

  • DPD gateway failover is only supported for different gateway addresses within the same family. Failover from an IPv6 gateway address to an IPv4 gateway address, or vice versa, is not supported.

  • Multiple traffic selector pairs are supported with IKEv1 only.

  • IPv6 extension headers and IPv4 options for IKE and IPsec packets are accepted but are not processed. AH with mutable EHs and options is not supported.

  • IPv6 dynamic endpoint VPNs are blocked during negotiation and IPv6 dialup VPNs are blocked during negotiation.

For more information, refer to the Release notes for 12.1x46 .

Related Information