F3726, F3211, F3174, R5135, R3816-HP Firewalls and UTM Devices VPN Configuration Guide-6PW100

# Configure a static route whose destination address is 2002::/16 and next-hop is the tunnel

interface.

[FirewallB] ipv6 route-static 2002:: 16 tunnel 0

382BVerifying the configuration

# Ping Host B from Host A. The ping operation succeeds.

D:\>ping6 -s 2002:201:101:1::2 2001::2

Pinging 2001::2

from 2002:201:101:1::2 with 32 bytes of data:

Reply from 2001::2: bytes=32 time=13ms

Reply from 2001::2: bytes=32 time=1ms

Reply from 2001::2: bytes=32 time<1ms

Ping statistics for 2001::2:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 13ms, Average = 3ms

28B

Configuring an ISATAP tunnel

The following matrix shows the feature and hardware compatibility:

Hardware ISATAP tunnel

com

atible

F1000-A-EI/F1000-S-EI Yes

F1000-E Yes

F5000 Yes

Firewall module Yes

U200-A Yes

U200-S No

143BConfiguration prerequisites

Configure an IP addresses for the interface (such as a VLAN interface, Ethernet interface, or loopback

interface) to be configured as the source interface of the tunnel interface.

144BConfiguration guidelines

Follow these guidelines when you configure an ISATAP tunnel:

• No destination address needs to be configured for an ISATAP tunnel because the destination IPv4

address is embedded in the ISATAP address.

• Because automatic tunnels do not support dynamic routing, you must configure a static route

destined for the destination IPv6 network at each tunnel end. You can specify the local tunnel

interface as the output interface of the route or specify the IPv6 address of the peer tunnel interface