Cisco 831 and IPv6 Configuration...

[josepena]

Hello everyone...
I got assigned IPv6 and I get the step to set my cisco 831, this is the configuration I have...

configure terminal
interface Tunnel0
 description Hurricane Electric IPv6 Tunnel Broker
 no ip address
 ipv6 enable
 ipv6 address 2001:470:1f04:1c63::2/64
 tunnel source 70.70.70.70
 tunnel destination 72.52.104.74
 tunnel mode ipv6ip
ipv6 route ::/0 Tunnel0
end

Can't ping the server ipv6: 2001:470:1f04:1c63::1/64? I already set
ipv6 unicast-routing

what else do I need to ping the server or any other IPv6 address.

Thanks in advance for your help.

Jos.

[cholzhauer]

You're not behind a NAT are you?

[josepena]

My cisco router is the font of the network, that one that it has the public IPv4, I'm doing ping from the cisco router. No, I'm not behind NAT.

Thanks.

[josepena]

I allow all outgoing traffic, and allow specific traffic for incoming: http, https, dns, ports for remote access basically.
Do I have to add a rule to allow any outgoing traffic from tunnel0?
or
do I have to create acl or rules for tunnel0?

Thanks for your help.

Jos.

[cholzhauer]

I allow all outgoing traffic, and allow specific traffic for incoming: http, https, dns, ports for remote access basically.
Do I have to add a rule to allow any outgoing traffic from tunnel0?
or
do I have to create acl or rules for tunnel0?

Thanks for your help.

Jos.

Are you allowing protocol41?

[josepena]

adamfulcher2000:
the rule sampel you gave me: 101, that it should be a new one or the acl in WAN?
I copied acl given for HE to my router, do I have to add anything additional to them? 'cause we have the same router, may be I can get a little bit more help.
I have an acl for WAN where I allow specific traffic.

LATER:
ADAFULCHER.... Never mind about my previous questions... I added the permit 41 to one of my interfaces and it started to work... Other questions here are:

* I have an IPv6 IP to the tunnel... to deploy, do I have to set an IP to the WAN, LAN and each host in LAN? other questiosn is... In what interface I set the rules for IPv6... for example... I created some rules to allow specific traffic from Internet to my WAN, only the desired traffic. I have my web and mail server in LAN, where I set the rule to allow that traffic from IPv6 Internet to my internal server?

Regards

regards.

[antillie]

Here is how I setup my 2621xm running IOS 12.4 to work with the tunnel to HE:

Code:

cerberus#sho run
Building configuration...

Current configuration : 5981 bytes
!
! Last configuration change at 11:54:38 CST Mon Sep 12 2011 by antillie
! NVRAM config last updated at 21:19:57 CST Mon Aug 22 2011 by antillie
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname cerberus
!
boot-start-marker
boot-end-marker
!
no logging console
enable secret 5 X
!
aaa new-model
!
aaa group server radius AD-RADIUS
 server 192.168.100.8 auth-port 1812 acct-port 1813
!
aaa authentication login userauth local
aaa authentication login ssh-access group AD-RADIUS enable
aaa authorization exec default group AD-RADIUS if-authenticated
aaa authorization network groupauth local
!
aaa session-id common
clock timezone CST -6
no network-clock-participate slot 1
no network-clock-participate wic 0
no ip source-route
ip cef
!
no ip bootp server
ip domain name local.lan
ip name-server 192.168.100.8
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
ipv6 unicast-routing
no ipv6 source-route
ipv6 cef
!
username antillie secret 5 X
username kandrida secret 5 X
!
ip ssh version 2
!
interface Tunnel0
 description Hurricane Electric IPv6 Tunnel Broker
 no ip address
 ipv6 address 2001:470:1F0E:6CA::2/64
 ipv6 enable
 ipv6 traffic-filter Block-IPv6-SSH in
 no ipv6 redirects
 ipv6 verify unicast reverse-path
 tunnel source 70.114.48.211
 tunnel destination 216.218.224.42
 tunnel mode ipv6ip
!
interface FastEthernet0/0
 ip address 10.1.1.1 255.255.255.252
 ip nat inside
 ip virtual-reassembly
 ip route-cache same-interface
 ip route-cache flow
 duplex auto
 speed auto
 ipv6 address 2001:470:B98A:1::/64 eui-64
 ipv6 mtu 1480
 ipv6 nd prefix 2001:470:B98A:1::/64
!
interface Serial0/0
 no ip address
 shutdown
!
interface FastEthernet0/1
 ip address dhcp
 no ip redirects
 no ip unreachables
 ip nat outside
 ip virtual-reassembly
 ip route-cache same-interface
 ip route-cache flow
 duplex auto
 speed auto
!
router eigrp 150
 redistribute connected
 redistribute static
 passive-interface FastEthernet0/1
 passive-interface Tunnel0
 network 10.1.1.0 0.0.0.3
 no auto-summary
!
no ip forward-protocol nd
!
no ip http server
no ip http secure-server
ip nat inside source list 2000 interface FastEthernet0/1 overload
!
ip radius source-interface FastEthernet0/0
access-list 2000 permit ip any any
no cdp run
ipv6 route 2001:470:B98A::/48 FastEthernet0/0 FE80::21F:9EFF:FE45:2422
ipv6 route 2001:DB8::/32 Null0
ipv6 route FC00::/7 Null0
ipv6 route ::/0 2001:470:1F0E:6CA::1
!
radius-server host 192.168.100.8 auth-port 1812 acct-port 1813 key 7 X
!
ipv6 access-list Block-IPv6-SSH
 deny tcp any any eq 22
 permit ipv6 any any
!
control-plane
!
line con 0
line aux 0
line vty 0 4
 exec-timeout 0 0
 login authentication ssh-access
 transport input ssh
line vty 5 15
 exec-timeout 0 0
 login authentication ssh-access
 transport input ssh
!
ntp clock-period 17180108
ntp server 206.246.118.250
ntp server 64.236.96.53
ntp server 68.216.79.113
!
end

You should be able to use this as a template for almost any fairly modern version of IOS to get basic IPv6 connectivity working via an HE.net tunnel.