Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

DS-Lite Softwires

 

Configuring a DS-Lite Softwire Concentrator

DS-Lite is supported on Multiservices 100, 400, and 500 PICs on M Series routers, and on MX Series routers equipped with Multiservices DPCs. Starting in Junos OS release 17.4R1, DS-Lite is supported on MX Series routers with MS-MPCs and MS-MICs.Starting in Junos OS release 19.2R1, DS-Lite is supported on MX Virtual Chassis and MX Broadband Network Gateway (BNG) routers.

To configure a DS-Lite softwire concentrator:

  1. Assign a name to the DS-Lite softwire concentrator.
  2. Specify the address of the softwire tunnel.
  3. Specify the MTU for the softwire tunnel.
    Note

    The mtu-v6 option is supported on MX Series routers equipped with MS-DPCs. Starting in Junos OS release 18.1R1, the mtu-v6 option is supported on MX Series routers with MS-MPCs or MS-MICs.

    This option sets the maximum transmission unit when encapsulating IPv4 packets into IPv6. If the final length is greater than the MTU, the IPv6 packet will be fragmented. This option is mandatory since it depends on other network parameters under administrator control.

  4. To copy DSCP information from the IPv6 header into the decapsulated IPv4 header, include the copy-dscp statement. This statement is not supported on MS-MPCs and MS-MICs.
  5. Specify the maximum number of flows for the softwire.

Configuring IPv6 Multicast Interfaces

Configure multicast filters on Ethernet interfaces when IPv6 NAT is used for neighbor discovery. This enables the router to process softwire-initiated flows in both directions.

To configure IPv6 multicast interfaces:

  1. Access the softwire hierarchy.
  2. Include the ipv6-multicast-interfaces statement for an individual interface.

    Or configure all softwire interfaces as IPv6 multicast.

Example: Basic DS-Lite Configuration

DS-Lite employs IPv4-over-IPv6 tunnels to cross an IPv6 access network to reach a carrier-grade IPv4-IPv4 NAT. This facilitates the phased introduction of IPv6 on the Internet by providing backward compatibility with IPv4. See Understanding IPv6 Dual-Stack Lite.

Requirements

The following hardware components can perform DS-Lite:

  • M Series Multiservice Edge routers with Multiservices PICs.

  • T Series Core routers with Multiservices PICs.

  • MX Series 5G Universal Routing Platforms with Multiservices DPCs. Starting in Junos OS release 17.4R1, DS-Lite is supported on MX Series routers with MS-MPCs and MS-MICs.Starting in Junos OS release 19.2R1, DS-Lite is supported on MX Virtual Chassis and MX Broadband Network Gateway (BNG) routers.

    Note

    This example is based on a MS-DPC style IP services. As a result a sp-x/x/x interface is used to direct traffic into the service engine. When using a MS-MPC or MS-MIC the services interface takes the form of ms-x/x/x. Be sure to adapt this example as needed for the specifics of your hardware.

Configuration Overview and Topology

This example describes how configure an MX Series router with an MS-DPC as an AFTR to facilitate the flow shown in Figure 1.

Figure 1: DS-Lite Topology
DS-Lite Topology

In this example, the DS-Lite softwire concentrator, or AFTR, is an MX Series router with two Gigabit interfaces and a Services DPC. The interface facing the B4 element is ge-3/1/5 and the interface facing the Internet is ge-3/1/0.

Configuration

Chassis Configuration

Step-by-Step Procedure

To configure the service PIC (FPC 0 Slot 0) with the Layer 3 service package:

  1. Enter the edit chassis hierarchy level.
  2. Configure the Layer 3 service package.

Interfaces Configuration

Step-by-Step Procedure

To configure interfaces facing the B4 (softwire initiator) and facing the Internet:

  1. Go the [edit interfaces] edit hierachy level for ge-3/1/0, which faces the Internet.
  2. Define the interface.
  3. Go to the [edit interfaces] hierachy level for ge-3/1/5, which faces the B4.
  4. Define the interface.
  5. Go to the [edit interfaces] hierarchy level for sp-0/0/0, used to host the DS-Lite AFTR.Note

    The services interface is used to enable a number of routing services such as stateful firewall filters, IPSec, and Network Address Translation (NAT). Within a Services Router, packets are routed to this internal interface for encapsulation or processing, depending on the service that is configured. The services interface is an internal interface and is not associated with a physical medium. You must configure the service interface in order to use it for a service set.

  6. Configure the services interface.

Results

user@host# show interfaces ge-3/1/0
user@host# show interfaces ge-3/1/5
user@host# show interfaces sp-o/o/o

Network Address and Port Translation Configuration

Step-by-Step Procedure

To configure NAPT:

  1. Go to the [edit services nat] hierarchy level.
  2. Define a NAT pool p1.
  3. Define a NAT rule, beginning with the match direction.
  4. Define a term for the rule, beginning with a from clause.
  5. Define the desired translation in a then clause. In this case, use dynamic source translation.
  6. (Optional) Configure logging of translation information for the rule.

Results

user@host# show services nat

Softwire Configuration

Step-by-Step Procedure

To configure the DS-Lite softwire concentrator, static route, and associated rules:

  1. Go to the [edit services softwire] hierarchy level.
  2. Define the DS-Lite softwire concentrator. This includes the softwire IPv6 address. This address is used to support an IPv4 over IPv6 tunnel with the B4 router. A corresponding IP over IP tunnel is defined on the B4 router. Typically a static route is used at both ends to direct traffic destined for the remote end of the tunnel over the IPv6 link connecting the B4 and AFTR routers.
  3. Define the softwire rule.
  4. Define the static route to the B4 end of the IP over IP tunnel. In this example the B4 router uses the IPv6 address 5002::1/128 address to source traffic sent over the IP tunnel to the AFTR node. This address is assigned to a loopback interface so it can be used as the tunnel source address.

Results

user@host# show services softwire
user@host# show routing-options rib inet6.0

Service Set Configuration

Step-by-Step Procedure

Configure a service set that includes softwire and NAT rules and specifies either interface-service or next-hop service. This example uses a next-hop service.

  1. Go to the [edit services service-set] hierarchy level, naming the service set.
  2. Define the NAT rule to be used for IPv4-to-IPv4 translation.
  3. Define the softwire rule to define the softwire tunnel.
  4. Define the interface service,
    Tip

    In order to avoid or minimize IPv6 fragmentation, you can configure a TCP maximum segment size (MSS) for your service set.

  5. (Optional) Define a TCP MSS.

Results

user@host# show services service-set

Example: Configuring DS-Lite and 6rd in the Same Service Set

Requirements

The following hardware components can perform DS-Lite:

  • M Series Multiservice Edge routers with Multiservices PICs.

  • T Series Core routers with Multiservices PICs.

  • MX Series 5G Universal Routing Platforms with Multiservices DPCs. Starting in Junos OS release 17.4R1, DS-Lite is supported on MX Series routers with MS-MPCs and MS-MICs.Starting in Junos OS release 19.2R1, DS-Lite is supported on MX Virtual Chassis and MX Broadband Network Gateway (BNG) routers.Starting in Junos OS release 20.2R1, DS-Lite is supported for CGNAT Next Gen Services on MX240, MX480 and MX960 routers.

Overview

This example describes a softwire solution that includes DS-Lite and 6rd in the same service set.

Configuration

Chassis Configuration

Step-by-Step Procedure

To configure the chassis:

  1. Configure the ingress interface.

    Here the service set is applied on the inet (IPv4) and inet6 (IPv6) families of subunit 0. Both DS-Lite IPv6 traffic and 6rd IPv4 traffic hits the service filter and is sent to the services PIC.

  2. Configure the egress interface (IPv6 Internet). The IPv4 server that the DS-Lite clients are trying to reach is at 200.200.200.2/24, and the IPv6 server is at 3ABC::2/16.
  3. Configure the services PIC.

Results

[edit interfaces]
user@host# show

Softwire Concentrator, Softwire Rule, Stateful Firewall Rule Configuration

Step-by-Step Procedure

To configure the softwire concentrator, softwire rule, and stateful firewall rule:

  1. Configure the DS-Lite and 6rd softwire concentrators.
  2. Configure the softwire rules.

    The following routes are added by the services PIC daemon on the Routing Engine:

    user@host# run show route 30.30.30.1
    user@host# run show route 1001::1
  3. Configure a stateful firewall rule.

Results

[edit services softwire]
user@host# show
[edit services stateful-firewall]
user@host# show

NAT Configuration for DS-Lite

Step-by-Step Procedure

To configure NAT for DS-Lite:

  1. Configure a NAT pool for DS-Lite.
  2. Configure a NAT rule.

Results

[edit services nat]
user@host# show

Because of this NAT rule, the following NAT routes are installed for the reverse DS-Lite traffic:

user@host# run show route 33.33.33.0/24

The NAT rule triggers address translation for the traffic coming from 20.20.0.0/16 to public address range 33.33.33.1 to 33.33.33.32.

Service Set Configuration

Step-by-Step Procedure

This service set has a stateful firewall rule and 6rd rule for 6rd service. The service set also includes a softwire rule for DS-Lite and a NAT rule to perform address translation for all DS-Lite traffic. The NAT rule performs NAPT translation in the forward direction on the source address and port of the DS-Lite traffic.

To configure the service set:

  1. Define the service set.
  2. Configure the service set rules.
  3. Configure the service set interface-service.

Results

[edit services service-set]
user@host# show

DS-Lite Subnet Limitation

DS-Lite Per Subnet Limitation Overview

Junos OS enables you to limit the number of softwire flows from a subscriber’s basic bridging broadband (B4) device at a given point in time, preventing subscribers from excessive use of addresses within the subnet. This limitation reduces the risk of denial-of-service (DoS) attacks. This limitation is supported on MX Series routers equipped with MS-DPCs. Starting in Junos OS Release 18.2R1, MS-MPCs and MS-MICs also support the subnet limitation feature.Starting in Junos OS Release 19.2R1, MX Virtual Chassis and MX Broadband Network Gateway (BNG) routers also support the subnet limitation feature.Starting in Junos OS release 20.2R1, DS-Lite is supported for CGNAT Next Gen Services on MX240, MX480 and MX960 routers.

A household using IPv6 with DS-Lite is a subnet, not just an individual IP address. The subnet limitation feature associates a subscriber and mapping with an IPv6 prefix instead of an IPv6 address. A subscriber can use any IPv6 addresses in that prefix as a DS-Lite B4 address and potentially exhaust carrier-grade NAT resources. The subnet limitation feature enables greater control of resource utilization by identifying a subscriber with a prefix instead of a specific address.

The subnet limit provides the following features:

  • Flows utilize the complete B4 address.

  • Prefix length can be configured per service set under softwire-options for the individual service-set.

  • Port blocks are allocated per prefix of the subscriber B4 device, and not on each B4 address (if the prefix length is less than 128). If the prefix length is 128, then each IPv6 address is treated as a B4. Port blocks are allocated per 128-bit IPv6 address.

  • Session limit, defined under the DS-Lite softwire concentrator configuration, limits the number of IPv4 sessions for the prefix.

  • EIM, EIF, and PCP mappings are created per softwire tunnel (full 128 bit IPv6 address). Stale mappings time out based on timeout values.

  • If prefix length is configured , then PCP max-mappings-per-subscriber (configurable under pcp-server) is based on the prefix only, and not the full B4 address.

  • SYSLOGS for PBA allocation and release contain the prefix portion of the address completed with all zeros. SYSLOGS for PCP allocate and release, flow creation and deletion will still contain the complete IPv6 address.

The show services nat mappings address-pooling-paired operational command output now shows the mapping for the prefix. The mapping shows the address of the active B4.

The show services softwire statistics ds-lite output includes a new field that displays the number of times the session limit was exceeded for the MPC.

For Next Gen Services on MX240, MX480, and MX960 routers, the subnet limit statistic is displayed in the Softwire session limit exceeded field.

show services softwire statistics (MX-SPC3)

Configuring DS-Lite Per Subnet Session Limitation to Prevent Denial of Service Attacks

You can configure the DS-Lite per subnet limitation on MX Series routers equipped with MS-DPCs. Starting in Junos OS Release 18.2R1, MS-MPCs and MS-MICs also support the subnet limitation feature. Starting in Junos OS Release 20.2R1, the Next Gen Services MX-SPC3 security services card supports the subnet limitation feature.

Starting in Junos OS Release 19.2R1, MX Virtual Chassis and MX Broadband Network Gateway (BNG) routers also support the subnet limitation feature.

To configure DS-Lite per subnet session limitation:

  1. Configure the size of the subnet prefix to which limiting is applied. Specify a prefix length of 56, 64, 96, or 128.
    Note

    Ensure that all mappings are cleared before changing the prefix length.

  2. If you are using a next-hop service set on an AMS interface for DS-Lite, set the AMS inside interface’s IPv6 source prefix length to the same value you use for the subnet prefix in Step 1.
  3. Configure the maximum number of subscriber sessions allowed per prefix. You can configure from 0 through 16,384 sessions.

    For Next Gen Services DS-Lite, MAP-E and V6rd softwires, configure the maximum number of subscriber sessions allowed per prefix:

    Note

    You cannot use flow-limit and session-limit-per-prefix in the same dslite configuration.

Release History Table
Release
Description
Starting in Junos OS release 20.2R1, DS-Lite is supported for CGNAT Next Gen Services on MX240, MX480 and MX960 routers.
Starting in Junos OS release 20.2R1, DS-Lite is supported for CGNAT Next Gen Services on MX240, MX480 and MX960 routers.
Starting in Junos OS Release 20.2R1, the Next Gen Services MX-SPC3 security services card supports the subnet limitation feature.
Starting in Junos OS release 19.2R1, DS-Lite is supported on MX Virtual Chassis and MX Broadband Network Gateway (BNG) routers.
Starting in Junos OS release 19.2R1, DS-Lite is supported on MX Virtual Chassis and MX Broadband Network Gateway (BNG) routers.
Starting in Junos OS release 19.2R1, DS-Lite is supported on MX Virtual Chassis and MX Broadband Network Gateway (BNG) routers.
Starting in Junos OS Release 19.2R1, MX Virtual Chassis and MX Broadband Network Gateway (BNG) routers also support the subnet limitation feature.
Starting in Junos OS Release 18.2R1, MS-MPCs and MS-MICs also support the subnet limitation feature.
Starting in Junos OS release 18.1R1, the mtu-v6 option is supported on MX Series routers with MS-MPCs or MS-MICs.
Starting in Junos OS release 17.4R1, DS-Lite is supported on MX Series routers with MS-MPCs and MS-MICs.
Starting in Junos OS release 17.4R1, DS-Lite is supported on MX Series routers with MS-MPCs and MS-MICs.
Starting in Junos OS release 17.4R1, DS-Lite is supported on MX Series routers with MS-MPCs and MS-MICs.