Article Detail

Description

Starting in Junos 22.2R1, IPIPv6 is supported on SRX platform.

This article describes configuration example of IPIPv6 with IPv6 address acquired by DHCPv6

Symptoms

Example topology:

PC (IPv4) 192.168.1.254 --- ge-0/0/1 (IPv4) SRX ge-0/0/2 (IPv6) ---- 2001:db8:254::1 DHCPv6 server (ISP)

Solution

DHCPv6 configuration examples:
*Please chose either case1 or case2 depending on your network requirement.

case1 : DHCPv6 PD (statefull)

set interfaces ge-0/0/2 unit 0 family inet6 dhcpv6-client client-type stateful
set interfaces ge-0/0/2 unit 0 family inet6 dhcpv6-client client-ia-type ia-pd
set interfaces ge-0/0/2 unit 0 family inet6 dhcpv6-client client-identifier duid-type duid-ll
set interfaces ge-0/0/2 unit 0 family inet6 dhcpv6-client req-option dns-server
set interfaces ge-0/0/2 unit 0 family inet6 dhcpv6-client update-router-advertisement interface ge-0/0/1.0

*When persistent IPv6 prefix assignment is required, interface-identifier option is available.
This option was introduced on Junos release 22.2R1.

set interfaces ge-0/0/0 unit 0 family inet6 dhcpv6-client update-router-advertisement interface ge-0/0/1.0 interface-identifier ::10

Case2 : DHCPv6 RA (stateless)

set interfaces ge-0/0/2 unit 0 family inet6 dhcpv6-client client-type autoconfig
set interfaces ge-0/0/2 unit 0 family inet6 dhcpv6-client client-ia-type ia-na
set interfaces ge-0/0/2 unit 0 family inet6 dhcpv6-client client-identifier duid-type duid-ll
set interfaces ge-0/0/2 unit 0 family inet6 dhcpv6-client req-option dns-server

*When persistent IPv6 prefix assignment is required, interface-identifier option is available.
This option was introduced on Junos release 22.2R1.

set interfaces ge-0/0/0 unit 0 family inet6 dhcpv6-client interface-identifier ::10

Enable IPv6 flow mode:

set security forwarding-options family inet6 mode flow-based

Enable RA on ge-0/0/2:

set protocols router-advertisement interface ge-0/0/2.0 passive-mode

Interface configuration:
*For DHCPv6 PD, specify IPv6 address assigned on ge-0/0/1 as source ip-0/0/0 address.
*For DHCPv6 RA, specify IPv6 address assigned on ge-0/0/2 as source ip-0/0/0 address.

set interfaces ge-0/0/1 unit 0 family inet address 192.168.1.1/24
set interfaces ip-0/0/0 unit 0 tunnel source 2001:db8:1::1
set interfaces ip-0/0/0 unit 0 tunnel destination 2001:db8:254::1
set interfaces ip-0/0/0 unit 0 family inet address 192.168.10.1/24

IPv4 route:

set routing-options static route 0.0.0.0/0 next-hop ip-0/0/0.0

Security zone configuration:

set security zones security-zone LAN host-inbound-traffic system-services all
set security zones security-zone LAN interfaces ge-0/0/1.0
set security zones security-zone INTERNET host-inbound-traffic system-services dhcpv6
set security zones security-zone INTERNET interfaces ge-0/0/2.0
set security zones security-zone INTERNET interfaces ip-0/0/0.0

Source NAT configuration:

set security nat source rule-set internet-access from zone LAN
set security nat source rule-set internet-access to zone INTERNET
set security nat source rule-set internet-access rule r1 match source-address 0.0.0.0/0
set security nat source rule-set internet-access rule r1 then source-nat interface

Verifications:
DHCPv6 PD (statefull)

*IPv6 address is assigned on ge-0/0/1 interface.

root@SRX> show interfaces ge-0/0/1 terse
Interface Admin Link Proto Local Remote
ge-0/0/1 up up
ge-0/0/1.0 up up inet 192.168.1.1/24
inet6 2001:db8:1::1/80
fe80::5604:1eff:fe00:3173/64

*DHCPv6 state is BOUND

root@SRX> show dhcpv6 client binding

IP/prefix Expires State ClientType Interface Client DUID
2001:db8:1::/64 86280 BOUND STATEFUL ge-0/0/2.0 LL0x3-56:04:1e:00:4d:e4

root@SRX> show dhcpv6 client binding detail

Client Interface/Id: ge-0/0/2.0
Hardware Address: 56:04:1e:00:43:e4
State: BOUND(DHCPV6_CLIENT_STATE_BOUND)
ClientType: STATEFUL
Lease Expires: 2025-01-02 00:00:00 JST
Lease Expires in: 85173 seconds
Lease Start: 2025-01-01 00:00:00 JST
Bind Type: IA_PD
Preferred prefix length 0
Sub prefix length 0
Client DUID: LL0x3-56:04:1e:00:4d:e4
Rapid Commit: Off
Server Identifier: fe80::5604:1eff:fe00:51cd
Update Server Yes
Client IP Prefix: 2001:db8:1::/64

DHCP options:
Name: server-identifier, Value: VENDOR0x00000583-0x34633a36
Name: dns-recursive-server, Value: 2001:db8:254::1

Update RA interfaces:
Interface: ge-0/0/1.0
RA Prefix: 2001:db8:1::/80

DHCPv6 RA (stateless)

*IPv6 address is assigned on ge-0/0/2 interface.

root@SRX> show interfaces ge-0/0/2 terse Interface Admin Link Proto Local Remote ge-0/0/2 up up ge-0/0/2.0 up up inet6 2001:db8:254::10 fe80::5604:1eff:fe00:3173/64

*DHCPv6 state is BOUND

root@SRX> show dhcpv6 client binding

IP/prefix Expires State ClientType Interface Client DUID
2001:db8:254::10/128 2591999 BOUND AUTO ge-0/0/0.0 LL0x3-56:04:1e:00:4d:e4
2001:db8:254::/64 2591999 BOUND AUTO ge-0/0/0.0 LL0x3-56:04:1e:00:4d:e4

root@SRX> show dhcpv6 client binding detail

Client Interface/Id: ge-0/0/2.0
Hardware Address: 56:04:1e:00:43:e4
State: BOUND(DHCPV6_CLIENT_STATE_BOUND)
ClientType: AUTO
Lease Expires: 2025-01-03 00:00:00 JST
Lease Expires in: 2591993 seconds
Lease Start: 2025-01-01 00:00:00 JST
Bind Type: IA_NA
Preferred prefix length 0
Sub prefix length 0
Client DUID: LL0x3-56:04:1e:00:4d:e4
Rapid Commit: Off
Server Identifier: ::/0
Client IP Address: 2001:db8:254::10/128
Client IP Prefix: 2001:db8:254::/64

DHCP options:
Name: server-identifier, Value: VENDOR0x00000583-0x34633a36
Name: dns-recursive-server, Value: 2001:db8:254::1

IPIPv6

*IPv4 traffic is forwarded to ip-0/0/0 interface

root@SRX> show security flow session
Session ID: 53138, Policy name: N/A, Timeout: N/A, Session State: Valid
In: 2001:db8:254::1/1 --> 2001:db8:1::1/1;ipip, Conn Tag: 0x0, If: ge-0/0/2.0, Pkts: 0, Bytes: 0,

Session ID: 53139, Policy name: N/A, Timeout: N/A, Session State: Valid
In: 2001:db8:254::1/1 --> 2001:db8:1::1/1;ipv6, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 0, Bytes: 0,

Session ID: 53144, Policy name: default-policy-logical-system-00/2, Timeout: 2, Session State: Valid
In: 192.168.1.254/25116 --> 192.168.3.254/1494;icmp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 1, Bytes: 84,
Out: 192.168.3.254/1494 --> 192.168.10.1/29543;icmp, Conn Tag: 0x0, If: ip-0/0/0.0, Pkts: 1, Bytes: 84,

Modification History

2025-01-23 : Article Created

Related Information

KB30509 Configuring the SRX as a DHCPv6 client with auto-prefix delegation [juniper.net]