HE.NET Tunnel Issues On Cisco 2851 (Protocol 41 NOT Blocked (Inbound atleast))

[zodiack]

Hello and good day to all of you!

I'm at the end of my rope with this and I'm turning to you, the community collective for help!

The Problem:
-------------

The Tunnel0 interface comes up/up and I can see Protocol 41 traffic (via a logging access-list) hitting my router (from the Internet) but it looks like my return (outbound) traffic is failing because I can't successfully IPv6 ping myself from the outside world (with no filters/access-lists applied).

NOTE: All IPv4 connectivity is working 100% with no issues; I can ping the TB server and it/they can ping me.

The Topology:
--------------

Cisco IOS Software, 2800 Software (C2800NM-ADVENTERPRISEK9-M), Version 15.1(4)M3, RELEASE SOFTWARE (fc1)

LAN <----> Gi0/1 [CISCO 2851] Gi0/0 <-------> Motorola SB5100 Modem <-------------> Internet

The Cisco Configuration:
-----------------------

ipv6 unicast-routing
ipv6 cef
ipv6 route ::/0 Tunnel0

core-r1#sh ip int bri | inc Tunnel
Tunnel0                    unassigned      YES unset  up                    up
core-r1#

interface Tunnel0
 description Hurricane Electric IPv6 Tunnel Broker
 no ip address
 ipv6 address <tunnel-routed-64-block>::2/64
 ipv6 enable
 tunnel source <my.external.ipv4.address>
 tunnel mode ipv6ip
 tunnel destination 209.51.161.14
end

interface GigabitEthernet0/0
 description WAN Gateway
 ip address dhcp
 ip access-group 100 in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip accounting access-violations
 ip nat outside
 ip virtual-reassembly in
 load-interval 30
 duplex auto
 speed auto
 no cdp enable
end

core-r1#sh ip access 100
Extended IP access list 100
    10 permit 41 any any log
    20 permit ip any any
core-r1#

The Results:
------------

When I try to ping my <tunnel-routed-64-block>::2/64 from the HE.NET Looking Glass, I see five (5) "Timed Out" ping attempts on the web interface.

HOWEVER... if I do:

core-r1#sh ip access 100 | inc permit 41
     10 permit 41 any any log (5 matches)
core-r1#

I see the 5 ping probes from the HE.NET Looking Glass reach my router!

But when I do:

core-r1#ping <tunnel-routed-64-block>::1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to <tunnel-routed-64-block>::1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
core-r1#

Here's the IPv6 Routing Table:

S   ::/0 [1/0]
     via Tunnel0, directly connected
C   <tunnel-routed-64-block>::/64 [0/0]
     via Tunnel0, directly connected
L   <tunnel-routed-64-block>::2/128 [0/0]
     via Tunnel0, receive

The Conclusion:
---------------

Am I crazy? 
Is Protocol 41 allowed INBOUND from my ISP (Rogers) but then blocked OUTBOUND?
Am I overlooking something in my configuration?

Many thanks would be showered upon the scholar who can figure this one out!

Thanks in advance,

  - zodi

[zodiack]

Hey SomeJoe7777,

Thanks for the reply!

I've tried to re-configure the tunnel using the interface as the tunnel source instead of the ip address but it exhibits the same behavior:

core-r1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
core-r1(config)#int tun0
core-r1(config-if)#shut
core-r1(config-if)#no tunnel source
core-r1(config-if)#tunnel source gi0/0
core-r1(config-if)#no shut
core-r1(config-if)#^Z
core-r1#

core-r1#clear ip access-l counters

<ping tun0 IPv6 address from lg.he.net>

core-r1#sh ip access 100 | inc permit 41
    280 permit 41 any any log (5 matches)
core-r1#

If I turn on "debug ipv6 icmp" and take a look at my logs, I have 5 entries identical to this:

Dec 17 20:36:15.539 EST: ICMPv6: Received echo request, Src=2001:470:0:1EF::2, Dst=2001:470:X:X::2
Dec 17 20:36:15.539 EST: ICMPv6: Sent echo reply, Src=2001:470:X:X::2, Dst=2001:470:0:1EF::2

I've tried it wide open with no access-list and still no luck.  It's almost like an asynchronous routing issue, traffic from outside/HE.NET gets too me, but traffic from me never gets to the outside/HE.NET.  The default IPv6 route is there, my router knows to send it out (in IPv4) via the tunnel destination

I've talked to my ISP and they swear up and down that they don't filter anything (like protocol 41) anywhere in their network.

I'm not sure what else do to at this point, perhaps a new ISP for for a month for "testing purposes"

Thanks again,

Cheers,

  - zodi

[zodiack]

Hey guys, thanks for the replies and Happy New Year!

I've confirmed that the "Client IPv6 Address" is what I'm using on my Tunnel0 interface and I'm pinging the "Server IPv6 Address". 

I didn't bother setting up the Routed /64 on my LAN until I could get the tunnel point-to-point up!

core-r1#clear logging
Clear logging buffer [confirm]y

core-r1#debug ipv6 icmp
  ICMP Packet debugging is on

core-r1#ping ipv6 2001:470:X:X::1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:470:X:X::1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
core-r1#

Jan  1 14:19:16.466 EST: ICMPv6: Sent echo request, Src=2001:470:X:X::2, Dst=2001:470:X:X::1
Jan  1 14:19:18.466 EST: ICMPv6: Sent echo request, Src=2001:470:X:X::2, Dst=2001:470:X:X::1
Jan  1 14:19:20.466 EST: ICMPv6: Sent echo request, Src=2001:470:X:X::2, Dst=2001:470:X:X::1
Jan  1 14:19:22.466 EST: ICMPv6: Sent echo request, Src=2001:470:X:X::2, Dst=2001:470:X:X::1
Jan  1 14:19:24.466 EST: ICMPv6: Sent echo request, Src=2001:470:X:X::2, Dst=2001:470:X:X::1

core-r1#sh run int tun0
Building configuration...

Current configuration : 231 bytes
!
interface Tunnel0
 description Hurricane Electric IPv6 Tunnel Broker
 no ip address
 ipv6 address 2001:470:X:X::2/64                                (Client IPv6 Address)
 ipv6 enable
 tunnel source GigabitEthernet0/0
 tunnel mode ipv6ip
 tunnel destination 209.51.161.14                                (Server IPv4 Address)
end

core-r1#

<relevant config>

ipv6 unicast-routing
ipv6 cef

interface GigabitEthernet0/0
 description WAN Gateway
 ip address dhcp                                                       (Client IPv4 Address)
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip accounting access-violations
 ip nbar protocol-discovery
 ip nat outside
 ip virtual-reassembly in
 load-interval 30
 duplex auto
 speed auto
 no cdp enable

ipv6 route ::/0 Tunnel0


Thanks guys!

Cheers,

  - zodi

[antillie]

The working config on my 3745 running 12.4(25d) Adv. Enterprise is pretty much the same as yours:

Code:

ipv6 unicast-routing
no ipv6 source-route
ipv6 cef

interface Tunnel0
 description Hurricane Electric IPv6 Tunnel Broker
 no ip address
 ipv6 address 2001:470:1F0E:6CA::2/64
 ipv6 enable
 ipv6 traffic-filter Block-IPv6-SSH in
 no ipv6 redirects
 ipv6 verify unicast reverse-path
 tunnel source 70.114.48.211
 tunnel destination 216.218.224.42
 tunnel mode ipv6ip
!
interface FastEthernet0/0
 ip address 10.1.1.1 255.255.255.252
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
 ipv6 address 2001:470:B98A:1::/64 eui-64
 ipv6 mtu 1480
 ipv6 nd prefix 2001:470:B98A:1::/64
!
interface FastEthernet0/1
 ip address dhcp
 no ip redirects
 no ip unreachables
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
 crypto map vpn_alpha
 
ip nat inside source list 2000 interface FastEthernet0/1 overload

access-list 2000 deny ip 192.168.100.0 0.0.0.255 192.168.250.0 0.0.0.255
access-list 2000 deny ip 192.168.200.0 0.0.0.255 192.168.250.0 0.0.0.255
access-list 2000 deny ip 10.1.1.0 0.0.0.3 192.168.250.0 0.0.0.255
access-list 2000 deny ip 172.30.1.0 0.0.0.255 192.168.250.0 0.0.0.255
access-list 2000 permit ip any any

ipv6 route ::/0 2001:470:1F0E:6CA::1
ipv6 route 2001:470:B98A::/48 FastEthernet0/0 FE80::21F:9EFF:FE45:2422
ipv6 route 2001:DB8::/32 Null0
ipv6 route FC00::/7 Null0

ipv6 access-list Block-IPv6-SSH
 deny tcp any any eq 22
 permit ipv6 any any

I did notice that I am using the actual IPv6 address of HE's side of the tunnel as my next hop in my default route. Which shouldn't really matter but who knows.