What tunneling options exist for carrying IPv6 over IPv4, and how do you configure a 6in4 tunnel?
Show the answer
Say this first
6in4 (also called a manual or configured tunnel) puts the IPv6 packet directly inside IPv4 with protocol 41.
GRE does the same with a 4-byte GRE header and can carry routing protocols and multicast. Older automatic
methods (6to4, ISATAP, Teredo) are obsolete. Providers use 6rd to give IPv6 over an
IPv4 access network, and DS-Lite or MAP to carry IPv4 over IPv6. On IOS 6in4 is tunnel mode ipv6ip.
Go deeper
The options
| Method | Encapsulation | Status |
|---|---|---|
| 6in4 (manual) | IPv4 protocol 41 | fine for static site links and tunnel brokers |
| GRE | IPv4, GRE, IPv6 | fine, adds 4 bytes, carries multicast |
| 6to4 | protocol 41, 2002::/16 addresses | deprecated, relays unreliable (RFC 7526) |
| ISATAP | protocol 41 inside a site | obsolete |
| Teredo | UDP 3544 through NAT, 2001::/32 | obsolete, avoid |
| 6rd (RFC 5969) | protocol 41 with the ISP's own prefix | ISP deployments |
| DS-Lite (RFC 6333) | IPv4 inside IPv6 to a carrier NAT | IPv4 over IPv6-only access |
6in4 on IOS
interface Tunnel0
description 6in4 to ISP1
no ip address
ipv6 address 2001:db8:ffff:100::2/64
tunnel source GigabitEthernet0/0/1
tunnel destination 203.0.113.9
tunnel mode ipv6ip
!
ipv6 route ::/0 Tunnel0The IPv6 MTU over a 1500-byte IPv4 path is 1480. For GRE (tunnel mode gre ip) it is 1476.
Things that go wrong
- NAT in the path: protocol 41 has no ports, so PAT cannot track it. 6in4 through a home router's NAT usually fails; Teredo exists for that case.
- Firewalls: protocol 41 and UDP 3544 tunnels can carry IPv6 straight past IPv4-only policy. Block them at the edge unless you use them.
- MTU: Packet Too Big messages from the tunnel ingress must reach the sender.
They will ask next
Why prefer GRE over 6in4 between two of your own routers?
GRE carries multicast and many protocols, so the same tunnel can run OSPFv3, IPv4 and IPv6 together, and it is easy to wrap in IPsec. 6in4 has 4 bytes less overhead and nothing else.
How is a tunnel interface route different from an Ethernet interface route?
A tunnel is point-to-point, so
ipv6 route ::/0 Tunnel0works without a next hop. On Ethernet an interface-only route makes the router try neighbor discovery for every destination.
Traps
- Recommending 6to4 or Teredo for a new design.
- Forgetting that protocol 41 does not pass through PAT.