Description

This article explains whether IPv4/v6 packet mode is supported on SRX IPSec tunnels and what should be done to support the IPv6 mode on these tunnels.

 

Symptoms

When generic routing encapsulation (GRE) is configured over an IPSec tunnel as shown below, the SRX device cannot ping a remote GRE IPv6 address:

  
jtac-SRX320-r007(ge-0/0/4)---(ge-0/0/1)jtac-EX4200-48T-r078(ge-0/0/2)----(ge-0/0/1)jtac-SRX650-r024(ge-0/0/2)---(ge-0/0/3)jtac-SRX345-r012
        GRE tunnel(gr-0/0/0.4) -----------------------------------------------------------------------------------------------------------------------------(gr-0/0/0.400)GRE tunnel
              IPSec tunnel(st0.0) --------------------------------------------------------------------(st0.0)IPSec tunnel


root@jtac-SRX320-r007> show interfaces gr-0/0/0.4 terse
Interface               Admin Link Proto    Local                 Remote
gr-0/0/0.4              up    up   inet     10.148.248.9/31
                                   inet6    2607:4100:1430:201::9/127
                                            fe80::f6a7:3900:2b:c80/64
 

root@jtac-SRX320-r007> show security flow status
  Flow forwarding mode:
    Inet forwarding mode: flow based          <-- HERE
    Inet6 forwarding mode: packet based       <-- HERE
    MPLS forwarding mode: drop
    ISO forwarding mode: drop
    Enhanced route scaling mode: Disabled
  Flow trace status
    Flow tracing status: off
  Flow session distribution
    Distribution mode: RR-based
    GTP-U distribution: Disabled
  Flow ipsec performance acceleration: off
  Flow packet ordering
    Ordering mode: Hardware

root@jtac-SRX320-r007> ping inet6 2607:4100:1430:201::8 source 2607:4100:1430:201::9 rapid count 100      
PING6(56=40+8+8 bytes) 2607:4100:1430:201::9 --> 2607:4100:1430:201::8
..............................................................................................^C
--- 2607:4100:1430:201::8 ping6 statistics ---
96 packets transmitted, 0 packets received, 100% packet loss

 

Solution

The SRX device cannot ping the remote GRE IPv6 address because IPv4 is flow mode and IPv6 is packet mode, and IPSec tunnels are supported only in flow mode.

SRX devices do not support IPSec tunnels in packet mode for both IPv4 and IPv6.

 

To enable this setting, change the IPv6 configuration from packet mode to flow mode. 

root@jtac-SRX320-r007> show security flow status
  Flow forwarding mode:
    Inet forwarding mode: flow based 
    Inet6 forwarding mode: flow based   <-- HERE
    MPLS forwarding mode: drop
    ISO forwarding mode: drop
    Enhanced route scaling mode: Disabled
  Flow trace status
    Flow tracing status: off
  Flow session distribution
    Distribution mode: RR-based
    GTP-U distribution: Disabled
  Flow ipsec performance acceleration: off
  Flow packet ordering
    Ordering mode: Hardware

root@jtac-SRX345-r012> ping inet6 2607:4100:1430:201::9 source 2607:4100:1430:201::8 rapid count 100    
PING6(56=40+8+8 bytes) 2607:4100:1430:201::8 --> 2607:4100:1430:201::9
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
--- 2607:4100:1430:201::9 ping6 statistics ---
100 packets transmitted, 100 packets received, 0% packet loss
round-trip min/avg/max/std-dev = 1.983/2.260/4.421/0.242 ms
 

The SRX device can now ping the remote GRE IPv6 address successfully.