Possibilities for IPv4 oder IPv6

[Kyle Lenderlof]

Hello Community,

I found a lot of information to handle an IPv6 over IPv4 communication, but almost nothing about IPv4 over IPv6.

Which possibilities exists integrating IPv4 over IPv6 on a Cisco Router (e.g. 881, or perhaps a Layer 3 Switch)?

Are there tunnel modes like for 6over4 (ipv6ip, gre)?

I attached a little topology to show my thoughts.

Thank you!

Kyle

[Marcin Latosiewicz]

Kyle,

My suggestion is to keep away from NAT-PT (unless it's just for fun).

NAT64 and all similar are what the industry is trying to do recently.

M.

[Kyle Lenderlof]

Yeah that is what I want to test now.

I only try to show up all possibilities to establish a (secure) connection between IPv4 networks over IPv6 internet.

Would "NAT64/46?" on one network and ""NAT64/46?" on the other network work for this scenario, theoretically

and/or practically?

[Kyle Lenderlof]

To come back to the gre-tunnel.

For the tunnel ip addresses I need public ip addresses on both sites for the gre-tunnel to do 4over6?

int tunnel0

ip add 192.169.1.1 255.255.255.0 ???

tunnel source s1/0

tunnel destination 2001:1:1:1::2

tunnel mode gre ipv6

Because in a traceroute (testlab) it give me the 192.169.1.1 back, instead of the destination address 2001:1:1:1::1?

Did I do something wrong? Because it won't work in a productive system if I have a native IPv6 ISP connection.

[Marcin Latosiewicz]

Kyle,

It's expected that IPv4 traceroute will produce IPv4 addresses while IPv6 traceroute should produce IPv6 addresses (I guess this is what you were doing?).

You are free to assign a uniqe IPv6 address on tunnel 0.

Tunnel IP can be public or private, rfc1918 is more common since you will not waste any IP address space.

edit: Just to add, since this GRE tunnel is a "pipe" between your routers, you should not IP addresses of tunnel source and destination if you traceroute through it.

Marcin

[Kyle Lenderlof]

Yes, thats what I'm done

Nevertheless, if there would be no possibility to use private IP addresses for the tunnel, it would be kind of useless for this scenario.

edit: Just to add, since this GRE tunnel is a "pipe" between your routers, you should not see? IP addresses of tunnel source and destination if you traceroute through it.

Thanks again!

edit: Do you know any specific date for the "new" IOS, yet?

edit2: The MTU for this configuration is 1456 (shown on router).

I guess thats, 4 for the gre header and 2x 20 for the ipv4 header.

But isn't the packet transported with an ipv6 header? So there would be 4(gre header)+20(ipv4 header)+40(ipv6 header)

[Kooopobol]

I am also interested in the new IOS release date

[Marcin Latosiewicz]

Kyle,

You can in fact use any addressing you want in case of addressing the tunnel itself, it's almost nnever used by anything bu transit.

What "new" IOS do you refer to?

There should be a difference of:

- IPv4 MTU (ip mtu command)

- IPv6 MTU (ipv6 mtu command)

- IPsec MTU (seen show crypto ipsec sa)

Now a GRE IPv6 header overhead should be 44 bytes +  20 bytes of IPv4 inside (we're not calculating IPsec overhead which could be  tunnel or transport mode)

M.

[Kooopobol]

The IOS version which will allow IPv4 ACL in IPv6 crypto map (and vice versa) and IPv4 traffic in IPv6 VTI (and vice versa).

Enhancement request : http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtu09251

Have you some news about it ?

Armand.

[Marcin Latosiewicz]

Armand,

It's an enhancement request. To have it resolved you need to contact your SE and they should create a business case.

Normally those things do not get resolved by themselves (not in a decent timeline).

Marcin