juniper

After using my old netscreen 5GT for years to terminate my IPv6 tunnel, I replaced it with an SRX100. IPv6 support on the SRX is still fairly new compared to the netscreen but so far I haven't had any problems with it and some of the limitations that existed in netscreen have been removed as well. Netscreen is stable as a rock, but SRX is a lot more fun :)

My goal was to configure an IPv6 tunnel on my SRX and performing stateful firewalling. I mention stateful firewalling explicitly because the SRX can be configured in either packet-mode or flow-mode. In packet mode it will simply route the IPv6 packets but bypass the security module, in flow-mode it will send everything through the security module as well. Packet-mode is useful for routers, but my SRX is running as a firewall, so I need flow-mode.

The first step is to decide which Junos version to run. This is a bit of a challenge because IPv6 tunnel support in flow-mode worked in some versions but not others. To my knowledge support looks a bit like this:

Quite a challenge. See this thread on the juniper forums for more details. It also contains a workaround for 10.4. I like testing out new features, so my setup is running 11.1R2. If you are running one of these older versions, you might want to try out packet-mode first (which has been working for ages) and once that works, switch to flow-mode.

Example network

As an example, I'll set up a tunnel to a tunnel broker with the following settings:

• Tunnel broker ipv4 address: 127.34.8.97
• My public ipv4 address: 127.78.134.3
• Tunnel ipv6 address: 2001:db8:202:123::2/64
• Internal ipv6 subnet: 2001:db8:8aa:1::/64

Note that I'm using a fixed IPv4 address on my firewall here, which is required by the SRX configuration. I don't really have a fixed IP, but I'm using a small event script which alters my configuration each time my external IP changes. I'll include that below. That's the power of Junos, you can automate a lot. More on that later.

Tunnel setup

Creating the tunnel is as easy as creating a new IP tunnel interface and adding it to a security zone.

[edit interfaces ip-0/0/0]
unit 0 {
    tunnel {
        source 127.78.134.3;
        destination 127.34.8.97;
    }
    family inet6 {
        mtu 1280;
        address 2001:db8:202:123::2/64;
    }
}
[edit security zones security-zone untrust]
interfaces {
    ip-0/0/0.0 {
        host-inbound-traffic {
            system-services {
                ping;
            }
        }
    }
}

That's it, now you should be able to ping IPv6 addresses from the SRX itself.

Internal networks

To assign addresses to internal machines, SLAAC is used. The SRX sends out router-advertisements containing the prefix assigned to the network and clients will chose an address from that range. DHCPv6 could be used as an alternative, but that's a topic for a future blog.

[edit configuration protocols router-advertisement]
interface fe-0/0/1.0 {
    prefix 2001:db8:8aa:1::/64 {
        on-link;
        autonomous;
    }
}
[edit configuration interfaces fe-0/0/1]
unit 0 {
    family inet6 {
        address 2001:db8:8aa:1::/64;
    }
}
[edit security zones security-zone trust]
interfaces {
    fe-0/0/1;
}

At this point, internal machines should be assigned an IPv6 address and should be able to ping the SRX.

Security Policy

Configuring security policies can be done just like IPv4 policies. Unlike netscreen, you can even combine IPv4 and IPv6 addresses in policies. So the following default policy will allow full internet access to you're internal machines on both IPv4 and IPv6:

[edit security policies from-zone trust to-zone untrust]
policy trust-to-untrust {
    match {
        source-address any;
        destination-address any;
        application any;
    }
    then {
        permit;
    }
}

Terminating the tunnel on a dynamic IP

To terminate the IPv6 tunnel on a dynamic IP address, first you'll need to run some utility on an internal machine to update the tunnel broker side of the tunnel. This is specific to whichever service you are using.

As you can see in the config above, you need to specify your public IP address in the SRX tunnel setup. Each time that address changes, you would have to re-configure the SRX. That is a lot of work but this can be done automatically by running an event script on the SRX. This script will run each time the address of the interface changes and will update the config accordingly.

The script (ipv6-tunnel-update.slax) is attached to this article, it's not pretty but it works. Before copying this to the SRX, edit it and replace "fe-0/0/0.0" with the name of your uplink interface.
To activate the script, copy it to /var/db/scripts/event on the SRX and add the following to the config:

[edit configuration event-options]
policy ipv6-tunnel-endpoint-update {
    events SYSTEM;
    attributes-match {
        SYSTEM.message matches "EVENT Add";
    }
    then {
        event-script ipv6-tunnel-update.slax;
    }
}
event-script {
    file ipv6-tunnel-update.slax;
}

The script was based on this one but altered to support non-PPP interfaces. I would love to see the automation guru's write a more generic version.