How did you handle numbers less than 1 and less than zero (Negative Numbers)?

Since ASA firmware 8.3 now supports forwarding proto-41, I’m terminating the tunnel on a Linux VM that is physically inside the firewall. The VM runs on our VMware ESXi infrastructure, and is connected by an IPv4 interface to our inside VLAN, and by an IPv6-only interface to the ‘outside’ VLAN on the ASA 5505. So, I’ve combined v4 and v6 like your suggested.

SixXS routes my /32 subnet through the tunnel, and I route the entire /32 to the Cisco ASA. The ASA routes and advertises a separate /64 to each VLAN.

It would have been a lot easier if the ASA just supported creating 6in4 tunnels but my VM & VLAN solution has allowed me to set all this up without any investment in hardware. Just some spare vSphere capacity and (a lot of) time. Of course the design is relatively complex, so documentation is a must. I’ll keep pushing my ISP for native IPv6.

I did this myself with a 2621xm and an ASA 5505. To avoid having to resatatize my configs I’ll just link to another post I made about how to do this:

http://www.tunnelbroker.net/forums/index.php?topic=356.0

Basically you use some /64′s from the /48 that Hurricane Electric gives you to create networks behind your router. In my case one network to link the ASA and the router and then two more behind the ASA. Since the ASA can’t do dynamic routing protocols like OSPF in IPv6 you need to use static routes to point your /64 networks to the ASA on the router and to make the router the ASA’s default IPv6 gateway. (Ok you could use auto config to make the router the ASA’s gateway but I like to keep things uniform.)

As far as I understand, the segregation of the v4 outside and v6 outside VLans is unnecessary. I’ll likely be moving the v6 address on the ASA to VLan20.

Where is your tunnel endpoint located? In a DMZ? I would love to see a diagram or description of your network layout.

oh yes i hear ya, i ´ve bricked 3 of them

rock on
macbroadcast.org