Description

This article explains why IPv6 static route to IPv4-mapped IPv6 address NH (ffff:x.x.x.x) is not supported on Junos. 
The provided example shows the configuration in RI but the same is true for main RI as well.

Solution

Topology:



Relevant Configuration on R1 and R2 routers:

R1:
set interfaces lo0 unit 0 family inet6 address 2600:9000:10c2:ffff:ffff:ffff:ffff:ffff/128

set routing-options rib inet6.0 static route 1111::1/128 next-hop 2600:9000:ddd:1:8000:0:645d:407
set routing-options rib inet6.0 static route 2402:bc07:ffff:ffff:ffff:ffff:ffff:ffff/128 next-hop 2600:9000:ddd:1:8000:0:645d:407

R2:

R2 is the DUT here where IPv6 static route to IPv4-mapped IPv6 address would be configured 

set routing-instances CUST1 routing-options rib CUST1.inet6.0 static route 0::0/0 next-hop ::ffff:52.1.1.1
set routing-instances CUST1 routing-options rib CUST1.inet6.0 static route 0::0/0 resolve
set routing-instances CUST1 instance-type forwarding

set firewall family inet filter CF-TRAFFIC-CLASSIFY term CUST1-TRAFFIC from source-address 71.1.1.0/24
set firewall family inet filter CF-TRAFFIC-CLASSIFY term CUST1-TRAFFIC then routing-instance CUST1

set firewall family inet6 filter CF-TRAFFIC-CLASSIFY-V6 term CUST1-TRAFFIC from source-address 2600:9000:10c2::/48
set firewall family inet6 filter CF-TRAFFIC-CLASSIFY-V6 term CUST1-TRAFFIC then routing-instance CUST1

root@R2_re> show mpls lsp 
Ingress LSP: 2 sessions
To              From            State Rt P     ActivePath       LSPname
52.1.1.1         1.1.1.1         Up     0 *     PRI              R2-to-R3_COLOR1

root@R2_re> show route table inet6.3 

inet6.3: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

::ffff:3.3.3.3/128 *[RSVP/7/1] 01:00:38, metric 50
                    >  to 100.1.3.2 via ae13.0, label-switched-path R2-to-R3_COLOR1
::ffff:52.1.1.1/128
                   *[LDP/9] 01:00:34, metric 50
                    >  to 100.1.3.2 via ae13.0, label-switched-path R2-to-R3_COLOR1
 

A Ping is initiated from R1 to R4:

root@R1_re> ping 2402:bc07:ffff:ffff:ffff:ffff:ffff:ffff source 2600:9000:10c2:ffff:ffff:ffff:ffff:ffff rapid count 1000                        
PING6(56=40+8+8 bytes) 2600:9000:10c2:ffff:ffff:ffff:ffff:ffff --> 2402:bc07:ffff:ffff:ffff:ffff:ffff:ffff
............................................................................................................................................................................^C
--- 2402:bc07:ffff:ffff:ffff:ffff:ffff:ffff ping6 statistics ---
173 packets transmitted, 0 packets received, 100% packet loss

The ping will fail. The reason is IPV6 traffic is carried over IPV4 MPLS LSP and reaches R3. R3 is enabled with explicit null for LDPoRSVP. Egress router-R3 sees explicit NULL and assumes payload is IPV4. Since payload is IPV6 header check fails and packet is dropped. This is an unsupported feature on Junos from day one.

The Egress router-R3 will show 'bad IPv4 hdr' exceptions incrementing.
VMX-0(R3_re vty)# show jnh 0 exceptions terse    

Reason                             Type           Packets      Bytes
==================================================================
Packet Exceptions
----------------------
bad IPv4 hdr                       DISC( 11)          321      17976


VMX-0(R3_re vty)# show jnh 0 exceptions terse    

Reason                             Type           Packets      Bytes
==================================================================
Packet Exceptions
----------------------
bad IPv4 hdr                       DISC( 11)          329      18424

Dumping the trapcode will give a clear idea on the packet contents. As seen in the below trap code packet dump, the router R3 receives this packet with a top label of 0 (Explicit Null for IPv4). Seeing this, R3 expects the underlying payload to be IPv4. However, the underlying payload is an IPv6 payload.
 
Frame 1: 74 bytes on wire (592 bits)
Ethernet II
MultiProtocol Label Switching Header
0000 0000 0000 0000 0000 .... .... .... = MPLS Label: IPv4 Explicit-Null (0)
.... .... .... .... .... 000. .... .... = MPLS Experimental Bits: 0
.... .... .... .... .... ...1 .... .... = MPLS Bottom Of Label Stack: 1
.... .... .... .... .... .... 0011 1111 = MPLS TTL: 63
Internet Protocol Version 6
0110 .... = Version: 6
.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
.... .... .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
Payload Length: 16
Next Header: ICMPv6 (58)
Hop Limit: 63
Source Address: 2600:9000:10c2:ffff:ffff:ffff:ffff:ffff
Destination Address: 2402:bc07:ffff:ffff:ffff:ffff:ffff:ffff
 

Instead of IPv4-mapped IPv6 address as the NH, the static route can be pointed to LSP-NH as specified in below configuration. 

regress@R2_re> show configuration routing-instances |display set 
set routing-instances  CUST1   routing-options rib CUST1.inet6.0 static route 0::0/0 lsp-next-hop R2-to-R3_COLOR1
set routing-instances CUST1 instance-type forwarding

If the static route is pointing to LSP-NH, then the Ping from R1 to R4 succeeds.

root@R1_re> ping 2402:bc07:ffff:ffff:ffff:ffff:ffff:ffff source 2600:9000:10c2:ffff:ffff:ffff:ffff:ffff rapid count 1000     
PING6(56=40+8+8 bytes) 2600:9000:10c2:ffff:ffff:ffff:ffff:ffff --> 2402:bc07:ffff:ffff:ffff:ffff:ffff:ffff
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!^C
--- 2402:bc07:ffff:ffff:ffff:ffff:ffff:ffff ping6 statistics ---
223 packets transmitted, 222 packets received, 0% packet loss
round-trip min/avg/max/std-dev = 3.320/4.257/9.804/0.936 ms