Very simple, really.
6PE tunneling:
set protocols mpls ipv6-tunneling
We also use these following lines for various reasons: have working VRFs, traceroutes, having internal pathes using IGP metrics even for MPLS/LDP, use explicit null everywhere (but not mandatory at all):
set protocols mpls traffic-engineering mpls-forwarding
set protocols mpls icmp-tunneling
set protocols ldp track-igp-metric
set protocols ldp explicit-null
For 6PE, while it seems strange, you must add family inet6 on internal MPLS interfaces (without any specific IP address), probably with setting a jumbo MTU - like you would do in IPv4 internally:
set interfaces <All-internal-MPLS-interfaces> unit <blah> family inet6 dad-disable (adds IPv6 family, and disable at the same time DAD – really useless feature here)
set interfaces <All-internal-MPLS-interfaces> mtu 9192 (actually, a supported max jumbo MTU compatible with all your gears, but you should already use something like that with MPLS, not specific to IPv6)
You will add 6PE and 6VPE address families in your I-MP-BGP group(s) – which make your IBGP sessions flap at commit (and notice that here, «explicit null» is mandatory for 6PE):
set protocols bgp group My_IBGP_Group family inet6 labeled-unicast explicit-null
set protocols bgp group My_IBGP_Group family inet6-vpn unicast
With ISIS you would have to make sure to disable ipv6-unicast for each internal interface (as you're using 6PE), but with OSPF (v2) there's no IPv6 so nothing to do.
Then add an IPv6 on your lo0, don't forget to configure an inbound firewall family inet6 filter on this lo0 to protect your router, same thing within the VRFs if they have a loopback interface configured.
------------------------------
Olivier Benghozi
------------------------------
Original Message:
Sent: 03-23-2023 09:31
From: MOHAMAMD AYASH
Subject: Dual Stack implementation on Juniper Network Devices
Hi Olivier thank you for your reply.
That does not sound like a lot of work, does it? We have our own public IPv6 ranges that we want to advertise to our clients. When it comes to implementing 6PE/6VPE, which security concerns do I need to think of? Do you have any tips that I can use?
Much appreciated.
------------------------------
MOHAMAMD AYASH
------------------------------
Original Message:
Sent: 03-23-2023 06:35
From: Olivier Benghozi
Subject: Dual Stack implementation on Juniper Network Devices
DS-Lite is not a Juniper stuff or dual stack solution: it is a IPv4 to IPv6 tunneling migration solution to deal with end user customers/subscribers (and with CGNAT). This is probably not what your are looking for at all.
On our MPLS-IPv4 (ISIS, LDP, VRF) MX backbone, we use 6PE (in the master/global table) and 6VPE (in the VRFs). All the IPv6 routes (and their labels) are in the MP-BGP. No IPv6 for IGP or internal MPLS intercos. Worked well for years.
------------------------------
Olivier Benghozi