R3721-F3210-F3171-HP High-End Firewalls VPN Configuration Guide-6PW101

Reply from 10.1.1.1: bytes=56 Sequence=3 ttl=255 time=2 ms

Reply from 10.1.1.1: bytes=56 Sequence=4 ttl=255 time=2 ms

Reply from 10.1.1.1: bytes=56 Sequence=5 ttl=255 time=2 ms

--- 10.1.1.1 ping statistics ---

5 packet(s) transmitted

5 packet(s) received

0.00% packet loss

round-trip min/avg/max = 2/2/2 ms

Configuring a GRE over IPv6 tunnel

NOTE:

The GRE over IPv6 tunnel configuration is available only at the CLI.

Configuration guidelines

• Deleting a tunnel interface also remove the functions configured on this tunnel interface.

• The source address and destination address of a tunnel uniquely identify a path. They must be

configured at both ends of the tunnel and the source address at one end must be the destination

address at the other end and vice versa.

• Tunnel interfaces using the same encapsulation protocol must have different source addresses and

destination addresses.

• If you configure a source interface for a tunnel interface, the tunnel interface takes the primary IP

address of the source interface as its source address.

• You can enable or disable the checksum function at both ends of the tunnel as needed. If the

checksum function is enabled at the local end but not at the remote end, the local end calculates the

checksum of a packet to be sent but does not check the checksum of a received packet. Contrarily,

if the checksum function is enabled at the remote end but not at the local end, the local end checks

the checksum of a received packet but does not calculate the checksum of a packet to be sent.

• When configuring a route through the tunnel, you are not allowed to set up a static route whose

destination address is in the subnet of the tunnel interface. Instead, you can do one of the following:

{ Configure a static route, using the address of the network segment the original packet is

destined for as its destination address and the address of the peer tunnel interface as its next

hop.

{ Enable a dynamic routing protocol on both the tunnel interface and the router interface

connecting the private network, so that the dynamic routing protocol can establish a routing

entry that allows the tunnel to forward packets through the tunnel.

Configuration prerequisites

On each of the peer devices, configure an IP address for the interface to be used as the source interface

of the tunnel interface (for example, a VLAN interface, GigabitEthernet interface, or loopback interface),

and make sure this interface can normally communicate with the interface used as the source interface

of the tunnel interface on the peer device.