Every network administrator needs to have a strategy to address the transition to the IPv6 Internet. Various transition mechanisms have been defined that are intended to make it as easy as possible for organizations to get on the IPv6 Internet using their current IPv4 network infrastructure. For many organizations, the easiest and fastest way to get applications up and running on the IPv6 Internet is to use a transition mechanism called an IPv6 tunnel.
One of the most common issues when an organization begins to support IPv6 is how to allow IPv6 enabled devices to communicate over those portions of the network that are not IPv6 enabled. This can include both portions of a corporate intranet as well as Internet connections managed by an Internet Service Provider (ISP) that does not yet provide IPv6 connectivity.
An IPv6 tunnel solves this issue by encapsulating IPv6 packets inside IPv4 packets for transmission over IPv4-only connections.
An IPv6 tunnel is obtained through an IPv6 tunnel broker. An IPv4 connection is established between a system at your site (in this case,
There are a number of tunnel brokers providing IPv6 tunnels to various geographical regions. In general, you should pick a tunnel broker that maintains tunnel servers that are geographically close to your location for best performance.
This chapter describes how you can set up an IPv6 tunnel. Hurricane Electric (HE), one of the leading IPv6 tunnel brokers, provides an easy way to configure a tunnel that uses the 6in4tunneling protocol. Note that a 6in4 tunnel from any tunnel broker can be used and requires the same basic commands on FortiADC to establish your tunnel -- only the required setup on the tunnel broker’s website will be different. Hurricane Electric offers an easy to use web interface that allows you to request and configure a tunnel usually within a few hours.
Note that a number of different tunneling protocols exist, and the tunneling protocols supported vary between tunnel brokers, so check a tunnel broker’s website to be sure they support 6in4 tunnels before you request one.
For example, Hurricane Electric provides what they call “regular” tunnels and “BGP” tunnels. For FortiADC, you would choose a “regular” Hurricane Electric tunnel, which is a 6in4 tunnel.
A 6in4 tunnel allows a user to access the IPv6 internet by tunneling over an existing IPv4 connection from an IPv6-enabled host to one of Hurricane Electric's IPv6 routers on the internet. Once a tunnel is established, the IPv6 enabled host sends IPv6 traffic over the local IPv4 network by encapsulating IPv6 packets inside IPv4 packets. These packets are sent to the IPv6 routers operated by the tunnel broker, unencapsulated, and then the IPv6 packets are forwarded to the IPv6 internet.
|
Note - You can use IPv6 cluster addresses without establishing a tunnel on FortiADC if your organization already has established an IPv6 tunnel and FortiADC can send IPv6 traffic through the local tunnel endpoint. In this configuration, you would simply assign cluster IPv6 addresses from the subnet associated with the already established tunnel and route the IPv6 traffic through the tunnel endpoint. This is done with the standard subnet configuration commands. |
Setting up an IPv6 tunnel on
Once the tunnel is configured, you can perform additional tasks required to get FortiADC clusters on the IPv6 Internet, including:
Creating a "6in4" IPv6 Tunnel (CLI)