CloudLabBox
Try the free demo

IPv6 in practice lab 11 of 12

Troubleshooting 2: firewall, BGP and tunnel faults at the edge

IPv4 is fine and IPv6 is not. Seven faults sit across a Junos firewall, an IOS edge router, a RouterOS provider and a tunnel to the branch, and each one looks like something else until you check it.

Run this lab

It needs Standard: its 8 nodes are set to 9 vCPU and 7,424 MB in total.

In your workspace: Shared, then IPv6 in practice across vendors guided labs, then 11 - Troubleshooting 2 - firewall BGP and tunnel faults at the edge

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 9 vCPU and 7,424 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
9 vCPU, 7,424 MB
Smallest plan
Standard

The scenario

Harbour Fibre has just turned up native IPv6 for Kestrel Freight, and the branch reaches head office over a 6in4 tunnel across an IPv4-only carrier. Three teams each say their part is done. Nothing works. The design below is right, and there are seven faults across the devices. Every fault can be fixed in a few lines.

SegmentPrefixAddresses
Head-office LAN2001:db8:100:10::/64SRX1 ge-0/0/1 ::1, H1 ::10
SRX1 to R12001:db8:100:a::/64SRX1 ge-0/0/0 ::2, R1 Gi0/0 ::1
R1 to CHR12001:db8:e:1::/64R1 Gi0/1 ::1, CHR1 ether1 ::2
Provider LAN2001:db8:e000:1::/64CHR1 ether2 ::1, H2 ::10, a web server
Tunnel02001:db8:100:f0::/64R1 ::1, R2 ::2
Carrier, IPv4 only203.0.113.0/30, 203.0.113.4/30R1 .1, R3 .2; R3 .5, R2 .6
Branch LAN2001:db8:100:20::/64R2 Gi0/1 ::1, H3 by SLAAC

The design:

  • OSPFv3 area 0 runs between R1 and SRX1, and R1 gives SRX1 a default route.
  • R1 peers with CHR1 by eBGP for IPv6, AS 64510 to AS 64520, and announces 2001:db8:100::/48.
  • SRX1's zones: trust holds the LAN, and untrust faces R1. Everything may go out. Only the branch may come in.
  • The branch uses SLAAC, and no DHCPv6 is planned.
DeviceRunsHow to log in
SRX1Juniper vSRX 23.4lab / lab123. It takes about 10 minutes to boot.
R1, R3, R2Cisco IOSv 15.9The console opens at >; enable has no password.
CHR1MikroTik RouterOS 7.14admin / Lab-admin1
H1, H2, H3Alpine Linuxroot, no password.

What you’ll practise

  • Find an SRX zone that doesn't accept OSPFv3, and a policy that only matches IPv4
  • Tell an established BGP session from one that carries IPv6 routes
  • Explain why a network statement announces nothing
  • Diagnose a tunnel that's up at both ends and carries nothing
  • Fix an overzealous ICMPv6 filter and a branch LAN that tells hosts not to use SLAAC

The tasks

  1. Start the Linux hosts
  2. Get head office out of the door
  3. Make the BGP exchange real
  4. Ping the provider
  5. The tunnel that's up and carries nothing
  6. The branch LAN

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Troubleshooting 2 - firewall BGP and tunnel faults at the edge8 nodes, 7 links. Every link is listed as text below the diagram.SRX1R1CHR1R3R2H1H2H3Gi0/2Gi0/0eth0ge-0/0/1ether2eth0Gi0/1eth0ge-0/0/0Gi0/0Gi0/1Gi0/0Gi0/1ether1
8 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • H1 eth0 to SRX1 ge-0/0/1
  • SRX1 ge-0/0/0 to R1 Gi0/0
  • R1 Gi0/1 to CHR1 ether1
  • CHR1 ether2 to H2 eth0
  • R1 Gi0/2 to R3 Gi0/0
  • R3 Gi0/1 to R2 Gi0/0
  • R2 Gi0/1 to H3 eth0
Nodes in Troubleshooting 2: firewall, BGP and tunnel faults at the edge, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SRX1Juniper vSRX NextGen templatevsrxng-23.4R2-S3.92 vCPU, 4,096 MB
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
CHR1MikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
R3Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H2Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H3Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder IPv6 in practice across vendors guided labs.

  3. Open 11 - Troubleshooting 2 - firewall BGP and tunnel faults at the edge and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More IPv6 in practice labs

All IPv6 in practice labs

Related labs in other courses

CloudLabBox is independent of Cisco, CompTIA, Juniper Networks and MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.