Wen, on the 6RD docwiki link, I think the key thing that's still off is the IPv6 addresses in the picture. The last chunk has too many zero's.
For example: 2001:db80:0000a:: /52
Also, if the BR IPv4 address is 10.0.0.1, shouldn't the CE default route next hop be '2001:db80:a000:001::' or maybe ''2001:db80:a000:1::' ?
Not '2001:db80:a000:0010::' ?
The next thing I'm working on is getting zone rules working. I thought I had it. Basically letting the tunnel traffic in/out from Self and Outside, and then creating a simple inspect rule set from Inside to Tunnel6. Like this:
class-map type inspect match-any IPv6-Out-class
match protocol icmp
match protocol tcp
match protocol udp
policy-map type inspect IPv6-Out
class type inspect IPv6-Out-class
inspect
class class-default
drop log
zone security TunnelZone
zone-pair security Inside-to-Tunnel source in-zone destination TunnelZone
service-policy type inspect IPv6-Out
int tun 6
zone-member security TunnelZone
This worked great. I was seeing the audit logs getting built for the outbound connections, and using an external scan tool, scans were getting properly blocked.
Worked, as in past tense. 24 hours later, the inspect operations appeared to have failed for IPv6. (Still working/logging for IPv4.) They are still passing traffic out, but the audit logs are no longer being created, and the packets are getting dropped on return due to no inbound path. If the rule was completely dead/wrong, it shouldn't be able to pass traffic out at all. The dynamic inspect return path is gone with the oubound logging. (I'm seeing this on a sniffer on the outside interface as well.)
I can create an inbound Tunnel-to-Inside pass rule, and get traffic flowing, but then I'm not blocking anymore.
I tried your tip about turning off IPv6 CEF, no luck.
I'm still learning about ZBF, and could have had this really boogered up and in a fragile state. But it was working.
Does anyone have any working ZBF rules/configs for this type of tunneled IPv6 traffic?
One step forward, two to the side.....
