ZBF in a mixed ipv4 and ipv6 environment, don't touch ipv4

I have a dual stacked router for both ipv4 and ipv6. Ipv4 traffic should pass the zbf untouched due to the fact that there is another rock solid ipv4 firewall egress of the inside Interface. Is there a way that a class map like this could function on ipv6 traffic only?:
class-map type inspect match-any fullproto
description Permitted Traffic to internet
match protocol http
match protocol https
match protocol dns
match protocol imaps
match protocol icmp
match protocol ftp
match protocol ntp
match protocol rtsp
match protocol realmedia
match protocol netshow
match protocol appleqtc
match protocol streamworks
match protocol vdolive
match protocol ssh
match protocol user-rdp
So far there is only a CBAC solution in place for ipv6.
I'm showing my Interfaces:
interface FastEthernet0/0
description *** Inside IPV6 ***
no ip address
speed auto
full-duplex
ipv6 address FE80::1 link-local
ipv6 address ????:????:????:10::1/64
ipv6 nd other-config-flag
ipv6 dhcp relay destination ?:?:?:10::12
ipv6 traffic-filter inne6-inn in
no cdp enable
no mop enabled
interface FastEthernet0/0.4
description *** Inside IPV4 ***
encapsulation dot1Q 4
ip address 82.?.?.129 255.255.255.248
no cdp enable
interface FastEthernet0/1
description *** Outside ***
ip address 82.?.?.42 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
speed auto
full-duplex
ipv6 address FE80::2 link-local
ipv6 address ?:599::2/126
ipv6 enable
ipv6 nd prefix default no-advertise
ipv6 nd prefix ?:599::/126 no-advertise
ipv6 nd managed-config-flag
ipv6 nd other-config-flag
ipv6 nd router-preference High
ipv6 inspect ipv6-cbac out
ipv6 traffic-filter ut-inn6 in
no cdp enable
no mop enabled
Please advise.
Regards,
Henning

I didn't test it, but what about the following:
Configure a new class-map where you match on an ipv6 access-list "any to any"
Configure a third class map of type ""match all" where you match on your "fullproto" class-map and also the above ipv6 class-map. For this class map you configure your inspections.
For ipv4-traffic you configure a class with a "pass" action in both directions.

Similar Messages

Best way to pass IPv4 and IPv6 traffic over a GRE Tunnel

Hello,
We have two 3825 routers with Advanced Enterprise IOS 12.4.9(T). Each of them serves many IPv4 (private and public) and IPv6 networks on their respective site.
We have created a wireless link between the two, using 4 wireless devices, with IP Addresses 10.10.2.2, 3, 4, 5 respectively (1 and 6 are the two end Ethernet interfaces on the routers).
Then we created a GRE tunnel over this link using addresses 172.16.1.1 and 2 (for the two ends) to route traffic over this link.
Now we want to route IPv6 traffic over the same link. However, we found that simply routing the IPv6 traffic over the above GRE / IP tunnel did not work.
Questions:
Is there a way we can use the same (GRE / IP) tunnel to transport both IPv4 and IPv6 traffic?
If not, can we setup two GRE tunnels over the same wireless link, that is, one GRE / IP for IPv4 traffic and a second one GRE / IPv6 for IPv6 traffic?
In brief, what is the suggested way to transport IPv4 and IPv6 traffic over the aforementioned (wireless) link?
I have read http://www.cisco.com/c/en/us/td/docs/ios/12_4/interface/configuration/guide/inb_tun.html#wp1061361 and other Internet material, however I am still confused.
Please help.
Thanks in advance,
Nick

We have set up two tunnels over the same link, one GRE / IP for the IPv4 traffic and one IPv6 / IP ("manual") for the IPv6 traffic. This setup seems to be working OK.
If there are other suggestions, please advise.
Thanks,
Nick

WRT54G v6 not working with new Motorola SB6141 on Comcast (IPv4 and IPv6)

My WRT54G v6 not working with a new Motorola SB6141 Cable Modem on Comcast (IPv4 and IPv6).
Yesterday, I had my old DOCSIS 1.1 cable modem and the WRT54G had been working just fine for the past 8 years.
Last night, I swap in the DOCSIS 3.0 SB6141 cable modem, and now the WRT54G keeps losing the internet connection. When I go into the status page for the WRT54G, I often do not see DNS servers and sometimes do not even see an IP address.
If I connect a PC directly to the SB6141 cable modem, I have no problems whatsoever. But whenever I connect through the WRT54G and power cycle both devices, then I have internet connectivity for about an hour before it drops out. I have noticed my gateway IP address and DNS servers change at that time as well. I can also force the Linksys to lose connectivity by doing a DHCP release/renew on the Linksys status page.
Is this behavior because of the dual stack (IPv4 and IPv6) coming through the cable modem from Comcast now? Is there any way I can keep using my WRT54G v6 now that I have the SB6141 cable modem?

You just have to install it correctly.
http://kb.linksys.com/Linksys/ukp.aspx?pid=80&login=1&app=search&vw=1&articleid=3686

Dynamic DNS for ipv4 AND ipv6?

tl;dr: do you know any dynamic dns service and updater daemon that supports both ipv4 and ipv6?
Hi,
ever since my provider supplied me with a proper dual stack account (real ipv4, real ipv6) for internet access I got some kind of little problem regarding the services I host at home. So this is mainly about email. I have a server sitting behind my router that has an open submission and IMAPS port. For ipv4 I've been using the NAT and dyndns features of my router (fritzbox) without any problem. For ipv6 there is no NAT (at least as far as my router is concerned). What I can do though is to open the firewall for incoming ports dynamically based on the interface identifier. So if someone wants to connect to an ipv6 address that would map to my server the router knows to not block the traffic. For this to work though I need update a dynamic DNS record with the public ipv6 address that my server gets to use (something out of the prefix my provider assignes me). This server is an arch linux box. I tried to use inadyn-mt with some systemd unit file I found through google but this does not seem to work right. When I'm in ipv4-only networks (on a mobile connection for example) I often can't resolve the right ip address of my server through dyndns. The thing is that my server doesn't know about a changed ipv4 address because this is handled by the router. It does only know about when his own ipv6 address changes/expires. Based on when this happens inadyn-mt might fire an update to dyndns and with that also pick up the new ipv4 address, but this is not guaranteed.
Any suggenstions, tool and/or service proposals? Is there a way dns-wise to add a CNAME alias just for A records and not for AAAA?

I currently use cloudflare as the DNS servers for my domain as it's free and allows to update certain records with their API. I only use it for IPv4, but since they support AAAA records, I assume it will work for IPv6 just as well. It should be quite simple for you to update the script to get the ip of a given interface instead of fetching it from the net.
#!/bin/sh
# modified by jfro from http://www.cnysupport.com/index.php/linode-dynamic-dns-ddns-update-script
# Uses curl to be compatible with machines that don't have wget by default
# modified by Ross Hosman for use with cloudflare.
cfkey=<your api key>
cfuser=<your username>
cfhost=<hostname you want to update>
WAN_IP=`curl -s http://icanhazip.com/`
if [ -f $HOME/.wan_ip-cf.txt ]; then
OLD_WAN_IP=`cat $HOME/.wan_ip-cf.txt`
else
OLD_WAN_IP=""
fi
perl -i -pe 'chomp if eof' /var/log/cfclient.log
if [ "$WAN_IP" = "$OLD_WAN_IP" ]; then
echo -ne "." >> /var/log/cfclient.log
else
echo $WAN_IP > $HOME/.wan_ip-cf.txt
echo -ne "\nUpdating IP to $WAN_IP\n" >> /var/log/cfclient.log
curl -s https://www.cloudflare.com/api.html?a=DIUP\&hosts="$cfhost"\&u="$cfuser"\&tkn="$cfkey"\&ip="$WAN_IP" >> /var/log/cfclient.log
fi
echo -ne "\n" >> /var/log/cfclient.log

Problem running apache dual stack IPv4 and IPv6

Hello!
I am running a single Lion-Server with one public IPv4 address. Because my Provider is able to support IPv6 now, I ordered a public IPv6 address for my server. (To learn IPv6)
I setup IPv6 address and setup the firewall with ip6fw - everything works fine, I can connect to ssh and afp via IPv4 or IPv6 but when I try to connect to my wiki over IPv6 I get the certificate question (unknown certificate ... blah) click continue and the certificate is loeded againe - I end up in an infinte loop of certificate questions.
The part of the firewall config looks like this:
20515 allow tcp from any to any 443
20516 allow tcp from any to any 8443
20517 allow tcp from any to any 1640
I looked into apache config:
/etc/apache2/sites/virtual_host_global.conf has this entries:
Listen *:443
NameVirtualHost *:443
Listen *:80
NameVirtualHost *:80
I have only one domain and only one single virtual host as defined in /etc/apache2/sites/0000_any_443_.conf:
## Default Virtual Host Configuration
<VirtualHost *:443>
        ServerAdmin [email protected]
        DocumentRoot "/Library/Server/Web/Data/Sites/Default"
        DirectoryIndex index.html index.php /wiki/ default.html
        CustomLog "/var/log/apache2/access_log" combinedvhost
        ErrorLog "/var/log/apache2/error_log"
        <IfModule mod_ssl.c>
                SSLEngine On
                SSLCipherSuite "ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM"
                SSLProxyEngine On
                SSLProtocol -ALL +SSLv3 +TLSv1
                SSLCertificateFile "/etc/certificates/www.ABCDE.de.1A00F8DFC2738F25D26E3248A4C8F687D7EA7F32.cert.p em"
                SSLCertificateKeyFile "/etc/certificates/www.ABCDE.de.1A00F8DFC2738F25D26E3248A4C8F687D7EA7F32.key.pe m"
                SSLCertificateChainFile "/etc/certificates/www.ABCDE.de.1A00F8DFC2738F25D26E3248A4C8F687D7EA7F32.chain. pem"
                SSLProxyProtocol -ALL +SSLv3 +TLSv1
        </IfModule>
        <Directory "/Library/Server/Web/Data/Sites/Default">
                Options All +MultiViews -ExecCGI -Indexes
                AllowOverride None
                <IfModule mod_dav.c>
                        DAV Off
                </IfModule>
        </Directory>
</VirtualHost>
I have not modified the apache config by hand until now - but this was an upgrade from Snow Leopard Server. At the moment I am a littel scared to upgrade to Mountain Lion server because this server runs mail and calender services for my company.
I tried to setup "Listen" entry with dedicated IP-addresses, one for IPv4 and one for IPv6 but this only leads to the same problem - IPv4 works, IPv6 ends in an infinte loop.
I found somewhere that I had to duplicate virtual hosts setup for IPv4 and IPv6 but afaik "Server.app" will overwrite it, right?
Every hint is welcome, bye
Christoph
P.S. Sorry just saw that I posted to ML-Server discussions not Lion-Server, but maybe someone can tell me that I can upgrade without scare.
Message was edited by: Christoph Ewering1

Hello!
Did some more testing and found that FireFox works with the loopback-address.
https://[::1]/
So, the address above works with FireFox after accepting the certificate - Safari loops in the dialog accepting the certificate.
Then I tried the link-local-address but it looks like apache does not listen to that address at all
Then I tried the global-address and got to:
Safari looping in the certificate dialog
FireFox brings an alert „sec_err_bad_database"
BTW this tests were made on the server that runs the apache. So no firewall between the browser and the server.
No one using Mac OS X server in a dual stack enviroment?
Bye,
eweri

EA4500 loses IPv4 and IPv6 information

No changes made but router will lose all information for IPv connectivity. I have paid twice to support to fix this issue and it still occurs every few months.
I tried rebooting router, and doing an IP Release/ Renew and router does not get IP address. I'd prefer not to have to pay again to fix this router. Any ideas?

Sorry - thought I had info:
I don't see anything on the router indicating a model other than EA4500. There is a serial number. Its plugged directly into a
Toshiba PCX2500 modem. If I connect my PC directly to the modem I have internet.
The router maintains all settings that Cisco helped me set up before except there are not IPv4 or IPv6 settings. I have screen shots from the setup. The Cisco rep had to clone the MAC of the modem to get the router to work. (Admin tab).
I unplugged modem and router and rebooted each. Everything appears to come up normally except for no IPv4/6 settings. I tried a release/renew but those settings stay blank.
I have internal network connectivity with the router, just no internet. I use Road Runner. I have a second network also on Road Runner but on a different modum and domain that is working fine. Unfortunately I have hard wired connections and kids games that rely on the EA4500

How to configure a COM domain, IPv4 and IPv6

Hi,
I am a new user on the Mac Server, but I have experience in Linux, my problem would be to understand how I configure the Mac Mini Server during installation or after installation, to assign a COM domain.
I would like to configure only the service Apache, FTP, MySQL.
My internet provider, today provided me 4 static IPs IPv4 and 4 IPv6, to use, now I want also to configure two local DNS if possible:
IPv4:
www.mydomain.com
ftp.mydomain.com
mysql.mydomain.com
IPv6:
www6.mydomain.com
For if I can configure DNS in Dual Stack or if I have to record them in a different way.
A control panel is currently not able to find it, you can advise me if something is well accepted, the important it is for business use as I would like to configure the server is for private use.
I hope I was clear, I'm sorry but I do not speak perfect English.
Thanks in advance to all.

To be clear, in your example you only have one domain - mydomain.com - all the other entries are just host records within that domain.
For your IPv4 hosts just add standard A records:
ftp A 1.2.3.4
www A 1.2.3.5
mysql A 1.2.3.6
For your IPv6 hosts just add AAAA records:
www6 AAAA 1234::ab:cd:ef
I seriously doubt you want to put your MySQL server on a public IP address, though, so I'd look carefully at your network setup before going much further.

Mixed SCCP and SIP environment on UC560

Hi,
Is it possible to have a mixed SCCP and SIP enviroment on a UC560?
We would like to keep the current 7XXX series phones on SCCP and add a SIP conference station and door phone.
Thanks,
Neil

Hi Neil
Yes, this should work. As the UC560 runs CUCME, this should be fine.
HTH
Barry Hesk
Intrinsic Network Solutions

How to configure DNS to support ipv4 and ipv6

I have a 2008 r2 domain controller in my lab.
i'm doing Exchange 2007, 2010 and 2013. I have mix Windows 2008 r2 servers for other applications.
i'm running into issues where i'm thinking it is time to have both IPV4 & IPV6 to run on all lab machines.
I can't get a clear picture on how to accomplish a mix environment. in the DNS administrator do I create a new "reverze lookup zone" with only the IPV6? or do I have to create a new record in the "forward lookup zone" to with both IPV4
& IPV6 which the later points to the new "reverse lookup zone".
I see a lot of internet article but little on "how to".
or on the DC should I enable the DHCP role to support the IPV6?

1. You assign an IPv6 address to the domain controller/DNS server
One method is letting this site (legitimate) create a random private IPv6 range for you:
http://www.simpledns.com/private-ipv6.aspx
For example:
fd06:fcde:8b4e:d6bd:xxxx:xxxx:xxxx:xxxx
You can configure the x's like this (you cannot leave the x's there):
fd06:fcde:8b4e:d6bd:0000:0000:0000:0001
If you close and open IPv6 properties, or do an "ipconfig /all" you'll see that the IPv6 is abbreviated as follows:
fd06:fcde:8b4e:d6bd::1
That's normal.
If you look in your forward lookup zone, you'll now see this IPv6 address (you may have to register that manually - ipconfig /registerdns - but it seemed to happen automatically for me.
So there is no need to create a separate forward lookup zone for IPv6.
OK, but what about the reverse zone?
2. Create reverse lookup
In DNS Manager (what you call administrator), right-click on reverse lookup zone, select New Zone, click, Next, Next (default values are fine) until you choose between IPv6 and IPv4. Selecft IPv6 of course.
Then enter your prefix as shown here:
That's it. The reverse lookup information is configured automatically (your prefix " backwards").
Now, unlike with the forward lookup zone, my domain controller does not seem to be registering its name in the reverse IPv6 zone: there's only the SOA and NS record.
But that's another question.
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

FF unable to comprehend PROXY.PAC file with IPv4 and IPv6 rules in it

My intranet setup involves users going through Squid proxy on a server discoverable by WPAD. Everything worked well until I introduced IPv6 into the network. Now I want their FFs to go IPv4 proxied and go IPv6 direct. I wrote proxy.pac ( http://pastebin.com/UFwVBzcN ) but FF8 throws "XPCSafeJSObjectWrapper is not defined" error. How can this be done?

Hi guigs2,
thanks for your response. As we only use myIpAddress once within our pac-File and only rely on dnsDomainIs(), ==-Comparisons and shExpMatch() and the sum of all pac-Executions was about 4 seconds compared to 40 seconds overall load time, I do not think that dns resolving is our issue.
I checked the seetings of the configuration you mentioned above. It is set to "false", so the client would try the resolve the dns names. Our admin told, that we do not use socks-Proxies, only http-Proxies.
Regarding sequential load of the contents included on www.bild.de from other web sites, I attached a screenthot.
Please note the red highlights. These show the start time in milliseconds of the pac-execution. I added this as a kind of id which represents a unique identifier together with the URL if the log items are mixed. But they are not, instead they are cleanly ordered by URL (for all 360 pac-file calls).
Moreover in the picture you can see the delay between the end of the last pac-file execution and the next one (blue timestamp in millisonds compared to the red timestamp of the next row saying "entered proxy.pac"). The delay sum up exactly to the 40 seconds the FF took to load the page completely.
Alone the fragment shown represents a delay of 630ms between the pac-file executions. If the contents would be loaded in parallel, there should be no such delay.

Context Directory Agent ipv4 and ipv6 mappings

I have the context directory agent 1.0 patch 2 installed and running. It works good mostly. We have a duel stack running ipv6 and ipv4 on our workstations. They connect to the AD with ipv6, so the mapping is for ipv6. Is there a way to get the ipv4 mappings?
We need to map both addresses for the Web Filtering on the CX.

Same question.

DNS in a mixed OES and AD environment

I have a mixed environment where most of my DNS is handled by OES servers with our main domain and a subdomain that is handled by Active Directory. For the AD domain, my OES servers are secondaries. I think I may not have something setup quite right because I'm getting the following error in /var/log/messages on my OES (secondary) servers except for the designated secondary:
[NCPL]: Error zone not loaded occurred while getting the db for zone adzone.xxx.xxx.xxx
[NCPL]: Error zone not loaded occurred while writing info for zone adzone_xxx_xxx_xxx.DNSDHCP.XXX to /var/opt/novell/log/named/named_zones.info
The AD zone and the reverse are both owned by the same AD server and the designated secondary is getting this message. Should I *not* have all my other OES secondaries in the "Authoritative DNS servers" list for that zone?
Thanks,
Toney.

You need to tell your AD DNS to allow zone transfers. Otherwise, the OES servers will never get the zone.
--El
Originally Posted by toneyc
I have a mixed environment where most of my DNS is handled by OES servers with our main domain and a subdomain that is handled by Active Directory. For the AD domain, my OES servers are secondaries. I think I may not have something setup quite right because I'm getting the following error in /var/log/messages on my OES (secondary) servers except for the designated secondary:
[NCPL]: Error zone not loaded occurred while getting the db for zone adzone.xxx.xxx.xxx
[NCPL]: Error zone not loaded occurred while writing info for zone adzone_xxx_xxx_xxx.DNSDHCP.XXX to /var/opt/novell/log/named/named_zones.info
The AD zone and the reverse are both owned by the same AD server and the designated secondary is getting this message. Should I *not* have all my other OES secondaries in the "Authoritative DNS servers" list for that zone?
Thanks,
Toney.

Multihomed servers with IPv4 and IPv6

We have a set up where we have virtual servers with two NIC's. One NIC is connected to our corporate network and the other NIC is connected (via layer 2 over MPLS) to the customer network. The NIC on our network is only assigned an IPv6 address
and the NIC on the customer network is only assigned an IPv4 address from the customer DHCP server. The problem we are running into is when the server does an NSLOOKUP for a URL that is associated with a server located on our network (the server has
an IPv6 and IPv4 address and is publicly accessable to the internet) the traffic goes out the customer NIC then out their internet connection and back to our public facing load balancer. Our application that runs on the server needs to communicate with
a server at the customer site and then send that data to a server on our side. We believe this behavior is happening because the customer server is responding as an "Authoritative" DNS server. We are trying to avoid using the HOSTS file
if possible (when we use the HOSTS file and specify the FQDN with the IPv6 address our application works fine and goes out our NIC).
Any help would be appreciated
Thanks,

Thanks for the idea Bruno, however we did try this already. I moved the adapter with IPv6 to the top of the binding order and rebooted the VM. However when I run NSLOOKUP it still goes out the adapter with IPv4 which is now second in the binding
order.
Side question. When I do an IPCONFIG /all what determines the order of listed adapters? I have changed the adapter names (so it isn't alphabetical), I have looked at the adapters in device manager and it isn't based on which one is #1 next to
it. And now I have changed the binding order and it still hasn't changed. The adapter with IPv4 is always listed first. Not sure if that means anything but just an observation.
Any other ideas?
Thanks,
Adam

Need help understanding how ipv4 and ipv6 co-exist

I'm trying to understand something that happened in our network recently. Current, we're all ipv4 based, but a few machines here and there have ipv6 enabled by mistake. Everything has been working ok, but recently we had some dhcp issues. I'm trying to understand how exactly ipv6 and ipv4 work together.
Questions:
- if we have workstations with ipv6 enabled but no dhcpv6 servers, does the ff02::1:2 multicast address exist on the network? If something starts up a dhcpv6 server somewhere, would that explain why several workstations have started sending out dhcpv6 solicit messages?
- If workstations attempt to get an address via dhcpv6 and get no response, will it try dhcp with ipv4, or will it just assign a 169.254.*.* address?

Muse allows you to create websites without knowing HTML / CSS etc...
If you can use Indesign you'll be able to use Muse.
A site created in Muse can be published with just a couple of clicks to Business Catalyst.
However Business Catalyst can do much more ~ it can allow you to create and manage the website of almost any kind of business.
Here is a short blurb from the BC / FAQ:
"Once your clients log in, they will have immediate access to their contact database, orders, web form submissions, products, catalogs, web pages, and email marketing campaigns from one central location — all built to work together."
find out more here: http://www.adobe.com/products/business-catalyst/faq.html

MPLS migration from IPv4 and IPv6

                   Hello,
i have existing MPLS VPN setup using IPv4 between all devices (P,PE,CPE), i want to start to migrate to IPv6 but i want to start the migration for one link between P and PE and all other devices will be the same (IPv4). Can you please tell me how i can acheive this scenario without impcat the services because is life.
Thanks

Dear All,
when i configured IPv6 between PE and CPE the neighbor between them is idle the following the configuration between PE and CPE:
PE:
router bgp 100
bgp router-id 10.200.200.3
no bgp default ipv4-unicast
bgp log-neighbor-changes
neighbor MPLS-Group peer-group
neighbor MPLS-Group remote-as 100
neighbor MPLS-Group update-source Loopback0
neighbor MPLS-Group-IPV6 peer-group
neighbor MPLS-Group-IPV6 remote-as 100
neighbor MPLS-Group-IPV6 update-source Loopback0
neighbor 10.200.200.5 peer-group MPLS-Group
neighbor 2002:10:200:200::5 peer-group MPLS-Group-IPV6
address-family ipv4
no synchronization
no auto-summary
exit-address-family
address-family vpnv4
neighbor MPLS-Group send-community both
neighbor MPLS-Group next-hop-self
neighbor 10.200.200.5 activate
exit-address-family
address-family vpnv6
neighbor MPLS-Group-IPV6 send-community both
neighbor MPLS-Group-IPV6 next-hop-self
neighbor 2002:10:200:200::5 activate
exit-address-family
address-family ipv4 vrf TEST
no synchronization
redistribute connected
neighbor 10.225.0.2 remote-as 101
neighbor 10.225.0.2 activate
exit-address-family
address-family ipv6 vrf TEST
redistribute connected
no synchronization
neighbor 2002:10:225::2 remote-as 101
neighbor 2002:10:225::2 activate
exit-address-family
ipv6 router ospf 200
router-id 10.200.200.3
log-adjacency-changes
mpls ldp router-id Loopback0
CPE:
interface Loopback0
ip address 10.225.100.1 255.255.255.255
ipv6 address 2002:10:225:100::1/128
interface FastEthernet0/0
no ip address
shutdown
duplex half
interface GigabitEthernet1/0
ip address 10.225.0.2 255.255.255.252
negotiation auto
ipv6 address 2002:10:225::2/126
router bgp 101
no synchronization
bgp router-id 10.225.100.1
bgp log-neighbor-changes
network 10.225.100.1 mask 255.255.255.255
neighbor 10.225.0.1 remote-as 100
neighbor 2002:10:225::1 remote-as 100
no auto-summary
address-family ipv6
no synchronization
network 2002:10:225:100::1/128
neighbor 2002:10:225::1 activate
exit-address-family
CPE-1#show ip bgp summary
BGP router identifier 10.225.100.1, local AS number 101
BGP table version is 4, main routing table version 4
2 network entries using 242 bytes of memory
2 path entries using 104 bytes of memory
3/2 BGP path/bestpath attribute entries using 228 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 598 total bytes of memory
BGP activity 4/0 prefixes, 4/0 paths, scan interval 60 secs
Neighbor        V    AS MsgRcvd MsgSent   TblVer InQ OutQ Up/Down State/PfxRcd
10.225.0.1      4   100       6       5        4    0    0 00:01:50        1
2002:10:225::1 4   100       0       0        0    0    0 never    Idle
and i received this error:
*Nov 24 15:40:17.715: %BGP-5-ADJCHANGE: neighbor 2002:10:225::2 vpn TEST                                                                                        Up
*Nov 24 15:40:19.079: %BGP-5-ADJCHANGE: neighbor 10.225.0.2 vpn vrf TEST Up
*Nov 24 15:40:23.067: %BGP-3-NOTIFICATION: sent to neighbor 2002:10:225::2 passi                                                                                        ve 2/8 (no supported AFI/SAFI) 3 bytes 000101
Thanks

ZBF in a mixed ipv4 and ipv6 environment, don't touch ipv4

Similar Messages

Maybe you are looking for