DIA (direct internet access) in pure IPv6 environment

[jgeralsky]

Hello,

I am struggling to find the minimum supported release of Cisco IOS XE  and Cisco vManage if I want to use DIA with IPv6 addresses.

Thank you for help.

Jan

[Kanan Huseynli · Accepted solution]

Hi,

depends on what you exactly doing (NAT66 or NAT64 or dual stack etc.).

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/nat/nat-book-xe-sdwan/configure-nat66.html

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/nat/nat-book-xe-sdwan/configure-nat64.html

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/system-interface/ios-xe-17/systems-interfaces-book-xe-sdwan/ipv6-functionality.html

[jgeralsky]

Hi Kanan,

thank you for update.

I am looking for the minimum supported release of Cisco IOS XE  and Cisco vManage for DIA feature when I use  only IPv6 (global unicast addresses) in the whole network environment.

It means. I don't need NAT64, dual stack as well as NAT66. 

Do you know the answer ?  

[Kanan Huseynli · Accepted solution]

So,

the problem is from service-side you need somehow route to VPN0. I checked and currently, ipv6 route leaking is not supported.

See restrictions: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/routing/ios-xe-17/routing-book-xe/m-routing-leaking-for-service-sharing.html#Cisco_Concept.dita_cdce2692-c9f3-4438-a25b-67fe0e4acd9f

I tried "tricky way" using NAT66 with identity nat (translating itself), but no luck. Will try again.

[jgeralsky]

Kanan,

thank you for valuable answer.

I am wondering, what IPv6 options for DIA solution I  have in case I will use the dual stack.

We will be in the same situation, in case we will use dual stack, and IPv6 global unicast address from vpn 500 (service side), will need to route to VPN0 (because of DIA), --> it will not be possible, because the route leaking for IPv6 address family is not supported. --> Am I right ?

[syaifulnizamshamsudin]

i have update to ipV6 now