Description

Customer wants to discard all IPv6-in-IPv6 packets received by Juniper routers.

Solution

set firewall family inet6 filter V6-BLOCK-EXTERNAL-IPv6-in-IPv6 term block-external-IPv6-in-IPv6 from next-header ipv6

set firewall family inet6 filter V6-BLOCK-EXTERNAL-IPv6-in-IPv6 term block-external-IPv6-in-IPv6 then count cnt_block-external-IPv6-in-IPv6

set firewall family inet6 filter V6-BLOCK-EXTERNAL-IPv6-in-IPv6 term block-external-IPv6-in-IPv6 then discard

set firewall family inet6 filter V6-BLOCK-EXTERNAL-IPv6-in-IPv6 term default_allow then accept

 

You can use "from next-header 41" to match IPv6-in-IPv6 packet if "next-header ipv6" was not pre-defined.

 

If you just want to discard IPv6-in-IPv6 packets from/to specific addresses or prefixes, please define prefixes

 

set policy-options prefix-list <prefix-name> <prefix>

Modification History

2025-03-02 : Article Created