Good old RFC4554 says:

2.1.  IPv6 Routing over VLANs

   In a typical scenario where connectivity is to be offered to a number
   of existing IPv6 internal subnets, one IPv6 router could be deployed,
   with both an external interface and one or more internal interfaces.
   The external interface connects to the wider IPv6 internet, and may
   be dual-stack if some tunnel mechanism is used for external
   connectivity, or IPv6-only if a native external connection is
   available.

   The internal interface(s) can be connected directly to a VLAN-capable
   switch.  It is then possible to write VLAN tags on the packets sent
   from the internal router interface based on the target IPv6 link
   prefix.  The VLAN-tagged traffic is then transported across the
   internal VLAN-capable site infrastructure to the target IPv6 links
   (which may be dispersed widely across the site network).

   Where the IPv6 router is unable to VLAN-tag the packets, a protocol-
   based VLAN can be created on the VLAN-capable device connected to the
   IPv6 router, causing IPv6 traffic to be tagged and then redistributed
   on (congruent) IPv4 subnet links that lie in the same VLAN.

...thus answering my (uneducated) question. Now, the fun part - figuring out what's being filtered where. I have plenty to learn.

Bear with me, I'm learning you see.

With the tag, tcpdump shows IPV6 leaving the henet interface bound for HE, but nothing is received.

When untagged frames leave my equipment, the next piece of equipment tags them immediately anyway! The addition and subsequent stripping of the tag by various managed switches between here and there - doesn't break the HE tunnel at all.  

So just to be clear - the henet interface should work regardless of what layer 2 does? (assuming layer 2 is setup correctly)

Maybe it's protocol 41 being dropped somewhere along the way on that particular route?

Ah, it appears I have mistaken the seven layer model for bean dip... 

An untagged interface exposed to the net works great for an HE tunnel!  No complaints there!

(insert employer/ISP upgrade here)

Now, my HE tunnel just doesn't work at all on a tagged interface. Yet ipv4 is ok, the interface has an accessible public address. I can't spot any filtering of services that I bring up on that interface. I poke around at the problem a while, then in addition to the work requirements I setup an untagged interface with a public address going through the same network upgrade (as a regular customer would) and HE tunnel and IPV6 is back and working!

Employer/ISP says great you got it working and we understand your quest towards IPV6 cert, but keep all your traffic tagged on these particular vlans as soon as possible...   

Ideally, I have an IPV6 tunnel and a happy employer, perhaps one willing to embrace IPV6 in the near future.

Before I crank up tcpdump, anybody else run into a similar problem with an HE tunnel and tags?

Am I Doing It Wrong™ ?

Cool, thanks very much!

Hi,

I'm having fun working through the IPV6 certification but I've run into a wall.

When I started the certification, I was using ipv6testing.dyndns-free.com. That got me through the first couple of tests ok until I needed to add an MX record, so I switched over to ipv6testing.mooo.com (afraid.org) and that got me through to Professional level.

Now, for the Guru test, I'm hooped, because my only option is to use a subdomain of ipv6testing.dyndns-free.com.

I'm trying to avoid starting from scratch, although that wouldn't be so bad. I could use my own nameserver right from the beginning that way.