I'm terminating my HE IPv6 tunnel on a Cisco 87x which is behind the Thomson Speedtouch provided by my ISP. I've got it mostly working, but with one problem I can't solve.
The config is basically DSL --- SpeedTouch (ether) ----- (ether) Cisco 87x ----- Windows 7 PC
IPv6 access to the internet from the PC works just fine. E.g. http://ip6.me
tells me the correct IPv6 address, I can get to ipv6.google.com etc etc.
However, I can't ping my end of the HE tunnel from outside. I can ping the HE end of the tunnel. Debug on the Cisco router shows that it's not receiving any IPv6 ICMP packets if pinged from outside. I do have an access-list in place, but the counters aren't going up either (and I've tried removing it too). So I'm suspecting that the Speedtouch is doing something odd.
The SpeedTouch is configured with
:service system ifadd name=PING_RESPONDER group=wan
:mapadd intf=O2_ADSL2plus type=nat outside_addr=18.104.22.168 inside_addr=192.168.1.8 access_list=192.168.1.8 mode=inbound weight=10
:connection unbind application=IP6TO4 port=0
Which are various incantations I've previously found via a lot of googling.
I've also tried disabled the ids and firewall on the Speedtouch to no apparent effect.
So what's puzzling is that since it's mostly working, what could the Speedtouch be doing differently with incoming rather than outgoing flows ? It's not smart enough (AFAIK) to actually look at the IPv6 traffic in the tunnel. I'm pretty sure the problem is there rather than with the Cisco config since I'm a lot more confident with my ability to debug IOS IPv6, and I can't see anything wrong with that.