Routing

Hi, I'm experimenting with dual-stack on Juniper devices and would like some suggestions and tips from the Juniper Community. I'm running a test lab with MX104, SRX340 and SRX650. The backbone is MPLS-IPv4. The network is running OSFPv2, LDP, MPLS, BGP and VRF. We would like to implement IPv6 alongside IPv4. I've been researching the different techniques of dual stacking and found a few solutions. I would like a verification from you guys just to know if I understand it correctly:

• Dual stack on Junos OS is called Dual-stack Lite (DS-Lite). So If a device does not support this (on Pathfinder is says that SRX340 does not support DS-Lite), I cannot implement this technique.
• Dual stack can have impact on resources since every devices will run two stacks at the same time.

Which technique do you guys recommend to implement, dual-stack or tunneling (such as 6PE)? The goal is to keep running these routing protocols alongside IPv6. Which technique has the least impact on resources as well as on network configuration.

I appreciate every reply of you guys.

DS-Lite is not a Juniper stuff or dual stack solution: it is a IPv4 to IPv6 tunneling migration solution to deal with end user customers/subscribers (and with CGNAT). This is probably not what your are looking for at all.

On our MPLS-IPv4 (ISIS, LDP, VRF) MX backbone, we use 6PE (in the master/global table) and 6VPE (in the VRFs). All the IPv6 routes (and their labels) are in the MP-BGP. No IPv6 for IGP or internal MPLS intercos. Worked well for years.

Hi, I'm experimenting with dual-stack on Juniper devices and would like some suggestions and tips from the Juniper Community. I'm running a test lab with MX104, SRX340 and SRX650. The backbone is MPLS-IPv4. The network is running OSFPv2, LDP, MPLS, BGP and VRF. We would like to implement IPv6 alongside IPv4. I've been researching the different techniques of dual stacking and found a few solutions. I would like a verification from you guys just to know if I understand it correctly:

• Dual stack on Junos OS is called Dual-stack Lite (DS-Lite). So If a device does not support this (on Pathfinder is says that SRX340 does not support DS-Lite), I cannot implement this technique.
• Dual stack can have impact on resources since every devices will run two stacks at the same time.

Which technique do you guys recommend to implement, dual-stack or tunneling (such as 6PE)? The goal is to keep running these routing protocols alongside IPv6. Which technique has the least impact on resources as well as on network configuration.

I appreciate every reply of you guys.

Hi Olivier thank you for your reply.

That does not sound like a lot of work, does it? We have our own public IPv6 ranges that we want to advertise to our clients. When it comes to implementing 6PE/6VPE, which security concerns do I need to think of? Do you have any tips that I can use?

Much appreciated.

------------------------------
MOHAMAMD AYASH

Original Message:
Sent: 03-23-2023 06:35
From: Olivier Benghozi
Subject: Dual Stack implementation on Juniper Network Devices

DS-Lite is not a Juniper stuff or dual stack solution: it is a IPv4 to IPv6 tunneling migration solution to deal with end user customers/subscribers (and with CGNAT). This is probably not what your are looking for at all.

On our MPLS-IPv4 (ISIS, LDP, VRF) MX backbone, we use 6PE (in the master/global table) and 6VPE (in the VRFs). All the IPv6 routes (and their labels) are in the MP-BGP. No IPv6 for IGP or internal MPLS intercos. Worked well for years.

------------------------------
Olivier Benghozi

Original Message:
Sent: 03-22-2023 07:11
From: MOHAMAMD AYASH
Subject: Dual Stack implementation on Juniper Network Devices

Hi, I'm experimenting with dual-stack on Juniper devices and would like some suggestions and tips from the Juniper Community. I'm running a test lab with MX104, SRX340 and SRX650. The backbone is MPLS-IPv4. The network is running OSFPv2, LDP, MPLS, BGP and VRF. We would like to implement IPv6 alongside IPv4. I've been researching the different techniques of dual stacking and found a few solutions. I would like a verification from you guys just to know if I understand it correctly:

• Dual stack on Junos OS is called Dual-stack Lite (DS-Lite). So If a device does not support this (on Pathfinder is says that SRX340 does not support DS-Lite), I cannot implement this technique.
• Dual stack can have impact on resources since every devices will run two stacks at the same time.

Which technique do you guys recommend to implement, dual-stack or tunneling (such as 6PE)? The goal is to keep running these routing protocols alongside IPv6. Which technique has the least impact on resources as well as on network configuration.

I appreciate every reply of you guys.

------------------------------
MOHAMAMD AYASH
------------------------------

Very simple, really.

6PE tunneling:

set protocols mpls ipv6-tunneling

We also use this for various reasons (have working VRFs and traceroutes):

set protocols mpls traffic-engineering mpls-forwarding

set protocols mpls icmp-tunneling

For 6PE, while it seems strange, you must add family inet6 on internal MPLS interfaces (without any specific IP address), probably with setting a jumbo MTU - like you would do in IPv4 internally:

set interfaces <All-internal-MPLS-interfaces> unit <blah> family inet6 mtu 9158 (or your current IPv4 internal jumbo MTU, don't forget to remove 20 bytes)

set interfaces <All-internal-MPLS-interfaces> unit <blah> family inet6 dad-disable (really useless feature here)

You will add 6PE and 6VPE address families in your I-MP-BGP group(s) – which make your IBGP sessions flap at commit:

set protocols bgp group My_IBGP_Group family inet6 labeled-unicast explicit-null

set protocols bgp group My_IBGP_Group family inet6-vpn unicast

With ISIS you would have to make sure to disable ipv6-unicast for each internal interface (as you're using 6PE), but with OSPF (v2) there's no IPv6 so nothing to do.

Then add an IPv6 on your lo0, don't forget to configure an inbound  firewall family inet6 filter on this lo0 to protect your router, same thing within the VRFs if they have a loopback interface configured.

Hi Olivier thank you for your reply.

That does not sound like a lot of work, does it? We have our own public IPv6 ranges that we want to advertise to our clients. When it comes to implementing 6PE/6VPE, which security concerns do I need to think of? Do you have any tips that I can use?

Much appreciated.

DS-Lite is not a Juniper stuff or dual stack solution: it is a IPv4 to IPv6 tunneling migration solution to deal with end user customers/subscribers (and with CGNAT). This is probably not what your are looking for at all.

On our MPLS-IPv4 (ISIS, LDP, VRF) MX backbone, we use 6PE (in the master/global table) and 6VPE (in the VRFs). All the IPv6 routes (and their labels) are in the MP-BGP. No IPv6 for IGP or internal MPLS intercos. Worked well for years.

Hi, I'm experimenting with dual-stack on Juniper devices and would like some suggestions and tips from the Juniper Community. I'm running a test lab with MX104, SRX340 and SRX650. The backbone is MPLS-IPv4. The network is running OSFPv2, LDP, MPLS, BGP and VRF. We would like to implement IPv6 alongside IPv4. I've been researching the different techniques of dual stacking and found a few solutions. I would like a verification from you guys just to know if I understand it correctly:

• Dual stack on Junos OS is called Dual-stack Lite (DS-Lite). So If a device does not support this (on Pathfinder is says that SRX340 does not support DS-Lite), I cannot implement this technique.
• Dual stack can have impact on resources since every devices will run two stacks at the same time.

Which technique do you guys recommend to implement, dual-stack or tunneling (such as 6PE)? The goal is to keep running these routing protocols alongside IPv6. Which technique has the least impact on resources as well as on network configuration.

I appreciate every reply of you guys.

About inet6 firewall filters, to match Layer4 protocol you'll have to use «match next-header» for loopback filters, and «match payload-protocol» for interface filters on MX (but probably next-header on SRX, not too sure). Annoying.

Very simple, really.

6PE tunneling:

set protocols mpls ipv6-tunneling

We also use this for various reasons (have working VRFs and traceroutes):

set protocols mpls traffic-engineering mpls-forwarding

set protocols mpls icmp-tunneling

For 6PE, while it seems strange, you must add family inet6 on internal MPLS interfaces (without any specific IP address), probably with setting a jumbo MTU - like you would do in IPv4 internally:

set interfaces <All-internal-MPLS-interfaces> unit <blah> family inet6 mtu 9158 (or your current IPv4 internal jumbo MTU, don't forget to remove 20 bytes)

set interfaces <All-internal-MPLS-interfaces> unit <blah> family inet6 dad-disable (really useless feature here)

You will add 6PE and 6VPE address families in your I-MP-BGP group(s) – which make your IBGP sessions flap at commit:

set protocols bgp group My_IBGP_Group family inet6 labeled-unicast explicit-null

set protocols bgp group My_IBGP_Group family inet6-vpn unicast

With ISIS you would have to make sure to disable ipv6-unicast for each internal interface (as you're using 6PE), but with OSPF (v2) there's no IPv6 so nothing to do.

Then add an IPv6 on your lo0, don't forget to configure an inbound  firewall family inet6 filter on this lo0 to protect your router, same thing within the VRFs if they have a loopback interface configured.

Hi Olivier thank you for your reply.

That does not sound like a lot of work, does it? We have our own public IPv6 ranges that we want to advertise to our clients. When it comes to implementing 6PE/6VPE, which security concerns do I need to think of? Do you have any tips that I can use?

Much appreciated.

DS-Lite is not a Juniper stuff or dual stack solution: it is a IPv4 to IPv6 tunneling migration solution to deal with end user customers/subscribers (and with CGNAT). This is probably not what your are looking for at all.

On our MPLS-IPv4 (ISIS, LDP, VRF) MX backbone, we use 6PE (in the master/global table) and 6VPE (in the VRFs). All the IPv6 routes (and their labels) are in the MP-BGP. No IPv6 for IGP or internal MPLS intercos. Worked well for years.

Hi, I'm experimenting with dual-stack on Juniper devices and would like some suggestions and tips from the Juniper Community. I'm running a test lab with MX104, SRX340 and SRX650. The backbone is MPLS-IPv4. The network is running OSFPv2, LDP, MPLS, BGP and VRF. We would like to implement IPv6 alongside IPv4. I've been researching the different techniques of dual stacking and found a few solutions. I would like a verification from you guys just to know if I understand it correctly:

• Dual stack on Junos OS is called Dual-stack Lite (DS-Lite). So If a device does not support this (on Pathfinder is says that SRX340 does not support DS-Lite), I cannot implement this technique.
• Dual stack can have impact on resources since every devices will run two stacks at the same time.

Which technique do you guys recommend to implement, dual-stack or tunneling (such as 6PE)? The goal is to keep running these routing protocols alongside IPv6. Which technique has the least impact on resources as well as on network configuration.

I appreciate every reply of you guys.

Hi, I'm experimenting with dual-stack on Juniper devices and would like some suggestions and tips from the Juniper Community. I'm running a test lab with MX104, SRX340 and SRX650. The backbone is MPLS-IPv4. The network is running OSFPv2, LDP, MPLS, BGP and VRF. We would like to implement IPv6 alongside IPv4. I've been researching the different techniques of dual stacking and found a few solutions. I would like a verification from you guys just to know if I understand it correctly:

• Dual stack on Junos OS is called Dual-stack Lite (DS-Lite). So If a device does not support this (on Pathfinder is says that SRX340 does not support DS-Lite), I cannot implement this technique.
• Dual stack can have impact on resources since every devices will run two stacks at the same time.

Which technique do you guys recommend to implement, dual-stack or tunneling (such as 6PE)? The goal is to keep running these routing protocols alongside IPv6. Which technique has the least impact on resources as well as on network configuration.

I appreciate every reply of you guys.

I agree and reiterate Olivier's comments.... 

I do 6VPE, which I understand is IPv6 over L3VPN.  My Internet and CDN links are dual stacked.

I already had IPv4 L3VPN.  Then sometime later, I needed to dual stack.  I had to change the edge of my sp core.  I only had to add IPv6 addressing on the pre-existing PE-CE connections

The underlying MP-BGP L3VPN work, was adding the "...family inet6-vpn unicast" to the pre-existing mp-bgp peering sessions.  Be careful, they bounce.  Hopefully you have redundant route reflector hub architecture.  If so, do each neighbor one at a time, and wait for it to settle before doing the next one.

I do not understand the need for 6PE.  I don't think I had to do 6PE for 6VPE to work.

Yeah security is something you will have to replicate everything you've ever learned and implemented in the IPv4 world... but now in the IPv6 world.  The attack surface is now doubled with IPv6 entry to/from your network.

Below are some old jnsp mail list chats that I had with others that proved to be quite helpful to me when I was learning.

https://puck.nether.net/pipermail/juniper-nsp/2016-June/032973.html
https://puck.nether.net/pipermail/juniper-nsp/2016-June/032974.html
https://puck.nether.net/pipermail/juniper-nsp/2016-June/032975.html
https://puck.nether.net/pipermail/juniper-nsp/2016-June/032985.html
https://puck.nether.net/pipermail/juniper-nsp/2016-June/032986.html
https://puck.nether.net/pipermail/juniper-nsp/2016-June/032987.html
https://puck.nether.net/pipermail/juniper-nsp/2016-June/032990.html

btw, I think the junos ipv6 static route command is weird... so sharing here

set routing-instances one routing-options rib one.inet6.0 static route 2626:2626:0:53::/64 next-hop 2626:2626:0:5f::1

Hi, I'm experimenting with dual-stack on Juniper devices and would like some suggestions and tips from the Juniper Community. I'm running a test lab with MX104, SRX340 and SRX650. The backbone is MPLS-IPv4. The network is running OSFPv2, LDP, MPLS, BGP and VRF. We would like to implement IPv6 alongside IPv4. I've been researching the different techniques of dual stacking and found a few solutions. I would like a verification from you guys just to know if I understand it correctly:

• Dual stack on Junos OS is called Dual-stack Lite (DS-Lite). So If a device does not support this (on Pathfinder is says that SRX340 does not support DS-Lite), I cannot implement this technique.
• Dual stack can have impact on resources since every devices will run two stacks at the same time.

Which technique do you guys recommend to implement, dual-stack or tunneling (such as 6PE)? The goal is to keep running these routing protocols alongside IPv6. Which technique has the least impact on resources as well as on network configuration.

I appreciate every reply of you guys.

I agree and reiterate Olivier's comments.... 

I do 6VPE, which I understand is IPv6 over L3VPN.  My Internet and CDN links are dual stacked.

I already had IPv4 L3VPN.  Then sometime later, I needed to dual stack.  I had to change the edge of my sp core.  I only had to add IPv6 addressing on the pre-existing PE-CE connections

The underlying MP-BGP L3VPN work, was adding the "...family inet6-vpn unicast" to the pre-existing mp-bgp peering sessions.  Be careful, they bounce.  Hopefully you have redundant route reflector hub architecture.  If so, do each neighbor one at a time, and wait for it to settle before doing the next one.

I do not understand the need for 6PE.  I don't think I had to do 6PE for 6VPE to work.

Yeah security is something you will have to replicate everything you've ever learned and implemented in the IPv4 world... but now in the IPv6 world.  The attack surface is now doubled with IPv6 entry to/from your network.

Below are some old jnsp mail list chats that I had with others that proved to be quite helpful to me when I was learning.

https://puck.nether.net/pipermail/juniper-nsp/2016-June/032973.html
https://puck.nether.net/pipermail/juniper-nsp/2016-June/032974.html
https://puck.nether.net/pipermail/juniper-nsp/2016-June/032975.html
https://puck.nether.net/pipermail/juniper-nsp/2016-June/032985.html
https://puck.nether.net/pipermail/juniper-nsp/2016-June/032986.html
https://puck.nether.net/pipermail/juniper-nsp/2016-June/032987.html
https://puck.nether.net/pipermail/juniper-nsp/2016-June/032990.html

btw, I think the junos ipv6 static route command is weird... so sharing here

set routing-instances one routing-options rib one.inet6.0 static route 2626:2626:0:53::/64 next-hop 2626:2626:0:5f::1

Hi, I'm experimenting with dual-stack on Juniper devices and would like some suggestions and tips from the Juniper Community. I'm running a test lab with MX104, SRX340 and SRX650. The backbone is MPLS-IPv4. The network is running OSFPv2, LDP, MPLS, BGP and VRF. We would like to implement IPv6 alongside IPv4. I've been researching the different techniques of dual stacking and found a few solutions. I would like a verification from you guys just to know if I understand it correctly:

• Dual stack on Junos OS is called Dual-stack Lite (DS-Lite). So If a device does not support this (on Pathfinder is says that SRX340 does not support DS-Lite), I cannot implement this technique.
• Dual stack can have impact on resources since every devices will run two stacks at the same time.

Which technique do you guys recommend to implement, dual-stack or tunneling (such as 6PE)? The goal is to keep running these routing protocols alongside IPv6. Which technique has the least impact on resources as well as on network configuration.

I appreciate every reply of you guys.