<html><head></head><body data-blackberry-caret-color="#00a8df" style="background-color: rgb(255, 255, 255); line-height: initial;"><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">I have faced almost same kind of issue with HE, as I was able to ping IPv4 and IPv6 ips but was not been able to establish bgp with HE, as it was shut at their side due to flapping. So for testing you should try to establish BGP whith any other destination ip. It could be HE on tunnel as well.</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Regards</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Imtiaz Sajid</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">IP transport engineer</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Mobilink, Pakistan</div> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br style="display:initial"></div> <div style="font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"></div> <table width="100%" style="background-color:white;border-spacing:0px;"> <tbody><tr><td colspan="2" style="font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"> <div id="_persistentHeader" style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0in 0in; font-family: Tahoma, 'BB Alpha Sans', 'Slate Pro'; font-size: 10pt;"> <div><b>From: </b>Phil Mayers</div><div><b>Sent: </b>Friday, June 28, 2013 7:49 PM</div><div><b>To: </b>ipv6-ops@lists.cluenet.de</div><div><b>Subject: </b>Re: Weird IPv6 problem passing Layer3 traffic</div></div></td></tr></tbody></table><div style="border-style: solid none none; border-top-color: rgb(186, 188, 209); border-top-width: 1pt; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"></div><br><div id="_originalContent" style="">On 28/06/13 15:33, Matthew Huff wrote:<br><br>> We have a Cisco 7204VXR with NPE-G2, running 15.2(4)S1. I have an<br>> identical router with same version connected to another ISP and a<br>> tunnel to HE.net. It's not my first time at the rodeo. We are<br>> connected via metro Ethernet to a sub-interface on a JunOS box (model<br>> and version unknown). My suspicion is that either they have an ACL<br>> that's blocking it, or their BGP process isn't listening on that<br>> sub-interface. But they claim that it isn't their problem. I have<br>> zero JunOS experience and they seem to be flopping around.<br><br>If you can ping it, but not telnet to port 179, it seems pretty clear <br>that port 179 is blocked or not listening, unless they have some kind of <br>TTL-based security going.<br><br>In Catalyst-land I'd suggest getting a SPAN of your output port showing <br>the SYN going out but no ACK coming back - the tcpdump/pcap evidence is <br>hard to argue.<br><br>Most likely, they have a filter on lo0 (which is the JunOS way of <br>protecting the control plane) that doesn't allow IPv6 or BGP/IPv6. First <br>guess, ask them to check the input filter on lo0 of their JunOS box.<br><br>FWIW a working JunOS IPv6 eBGP config looks a little like this:<br><br>interfaces {<br> ge-0/0/0 {<br> unit 0 {<br> family inet {<br> address x.x.x.x/31;<br> }<br> family inet6 {<br> address 2001:y::1/112;<br> }<br> }<br> }<br> lo0 {<br> unit 0 {<br> family inet {<br> filter {<br> input router-protect;<br> }<br> address x.x.x./32;<br> }<br> family inet6 {<br> filter {<br> input ipv6-router-protect;<br> }<br> address 2001:x.x.x/128;<br> }<br> }<br> }<br>}<br>protocols {<br> bgp {<br> group Customerv6 {<br> type external;<br> local-address 2001:y::1;<br> family inet6 {<br> unicast;<br> }<br> peer-as 65000;<br> neighbor 2001:y::2;<br> }<br> }<br>}<br>firewall {<br> family inet6 {<br> filter ipv6-router-protect {<br> term BGP_NEIGHS_1 {<br> from {<br> source-address {<br> 2001:y::/64;<br> }<br> next-header tcp;<br> destination-port bgp;<br> }<br> then accept;<br> }<br> term BGP_NEIGHS_2 {<br> from {<br> source-address {<br> 2001:y::/64;<br> }<br> next-header tcp;<br> source-port bgp;<br> }<br> then accept;<br> }<br> ....<br> }<br> }<br>}<br><br></div></body></html>