DS-Lite Softwires
Configuring a DS-Lite Softwire Concentrator
DS-Lite is supported on Multiservices 100, 400, and 500 PICs on M Series routers, and on MX Series routers equipped with Multiservices DPCs. Starting in Junos OS release 17.4R1, DS-Lite is supported on MX Series routers with MS-MPCs and MS-MICs.Starting in Junos OS release 19.2R1, DS-Lite is supported on MX Virtual Chassis and MX Broadband Network Gateway (BNG) routers.
To configure a DS-Lite softwire concentrator:
- Assign a name to the DS-Lite softwire concentrator.[edit services softwire softwire-concentrator]user@host# edit ds-lite ds-lite-softwire-concentrator
- Specify the address of the softwire tunnel.[edit services softwire softwire-concentrator ds-lite ds-lite-softwire-concentrator]user@host# set softwire-address address
- Specify the MTU for the softwire tunnel.[edit services softwire softwire-concentrator ds-lite ds-lite-softwire-concentrator]user@host# set mtu-v6 bytes
Note The mtu-v6 option is supported on MX Series routers equipped with MS-DPCs. Starting in Junos OS release 18.1R1, the mtu-v6 option is supported on MX Series routers with MS-MPCs or MS-MICs.
This option sets the maximum transmission unit when encapsulating IPv4 packets into IPv6. If the final length is greater than the MTU, the IPv6 packet will be fragmented. This option is mandatory since it depends on other network parameters under administrator control.
- To copy DSCP information from the IPv6 header into the
decapsulated IPv4 header, include the copy-dscp statement.
This statement is not supported on MS-MPCs and MS-MICs.[edit services softwire softwire-concentrator ds-lite ds-lite-softwire-concentrator]user@host# set copy-dscp
- Specify the maximum number of flows for the softwire.[edit services softwire softwire-concentrator ds-lite ds-lite-softwire-concentrator]user@host# set flow-limit 1000
Configuring IPv6 Multicast Interfaces
Configure multicast filters on Ethernet interfaces when IPv6 NAT is used for neighbor discovery. This enables the router to process softwire-initiated flows in both directions.
To configure IPv6 multicast interfaces:
- Access the softwire hierarchy.user@host# edit services softwire
- Include the ipv6-multicast-interfaces statement
for an individual interface.[edit services softwire]user@host# set ipv6-multicast-interfaces interface-name
Or configure all softwire interfaces as IPv6 multicast.
[edit services softwire]user@host# set ipv6-multicast-interfaces all
Example: Basic DS-Lite Configuration
DS-Lite employs IPv4-over-IPv6 tunnels to cross an IPv6 access network to reach a carrier-grade IPv4-IPv4 NAT. This facilitates the phased introduction of IPv6 on the Internet by providing backward compatibility with IPv4. See Understanding IPv6 Dual-Stack Lite.
Requirements
The following hardware components can perform DS-Lite:
M Series Multiservice Edge routers with Multiservices PICs.
T Series Core routers with Multiservices PICs.
MX Series 5G Universal Routing Platforms with Multiservices DPCs. Starting in Junos OS release 17.4R1, DS-Lite is supported on MX Series routers with MS-MPCs and MS-MICs.Starting in Junos OS release 19.2R1, DS-Lite is supported on MX Virtual Chassis and MX Broadband Network Gateway (BNG) routers.
Note This example is based on a MS-DPC style IP services. As a result a sp-x/x/x interface is used to direct traffic into the service engine. When using a MS-MPC or MS-MIC the services interface takes the form of ms-x/x/x. Be sure to adapt this example as needed for the specifics of your hardware.
Configuration Overview and Topology
This example describes how configure an MX Series router with an MS-DPC as an AFTR to facilitate the flow shown in Figure 1.
In this example, the DS-Lite softwire concentrator, or AFTR, is an MX Series router with two Gigabit interfaces and a Services DPC. The interface facing the B4 element is ge-3/1/5 and the interface facing the Internet is ge-3/1/0.
Configuration
Chassis Configuration
Step-by-Step Procedure
To configure the service PIC (FPC 0 Slot 0) with the Layer 3 service package:
- Enter the edit chassis hierarchy level.user@host# edit chassis
- Configure the Layer 3 service package.[edit chassis]user@host# set fpc 0 pic 0 adaptive-services service-package layer-3
Interfaces Configuration
Step-by-Step Procedure
To configure interfaces facing the B4 (softwire initiator) and facing the Internet:
- Go the [edit interfaces] edit hierachy level
for ge-3/1/0, which faces the Internet.host# edit interfaces ge-3/1/0
- Define the interface.[edit interfaces ge-3/1/0]user@host# set description AFTR-Internetuser@host# set unit 0 family inet address 128.0.0.2/24
- Go to the [edit interfaces] hierachy level
for ge-3/1/5, which faces the B4.user@host# up 1[edit]user@host# edit interfaces ge-3/1/5
- Define the interface.[edit interfaces ge-3/1/5]user@host# set description AFTR-B4user@host# set unit 0 family inetuser@host# edit unit 0 family inet6[edit unit 0 family inet6]user@host# set service input service-set ssetuser@host# set service output service-set ssetuser@host# set address 2001:0:0:2::1/48
- Go to the [edit interfaces] hierarchy level
for sp-0/0/0, used to host the DS-Lite AFTR.
Note The services interface is used to enable a number of routing services such as stateful firewall filters, IPSec, and Network Address Translation (NAT). Within a Services Router, packets are routed to this internal interface for encapsulation or processing, depending on the service that is configured. The services interface is an internal interface and is not associated with a physical medium. You must configure the service interface in order to use it for a service set.
[edit]user@host# edit interfaces sp-0/0/0 - Configure the services interface.[edit interfaces sp-0/0/0]user@host# set description AFTR-B4user@host# set unit 0 family inetuser@host# set unit 0 family inet6
Results
user@host# show interfaces ge-3/1/0description AFTR-Internet;
unit 0 {
family inet {
address 128.0.0.2/24;
}
}user@host# show interfaces ge-3/1/5description AFTR-B4;
unit 0 {
family inet;
family inet6 {
service {
input {
service-set sset;
}
output {
service-set sset;
}
}
address 2001:0:0:2::1/48;
}
}
user@host# show interfaces sp-o/o/ounit 0 {
family inet;
family inet6;
}Network Address and Port Translation Configuration
Step-by-Step Procedure
To configure NAPT:
- Go to the [edit services nat] hierarchy level.user@host# edit services nat[edit services nat]
- Define a NAT pool p1.user@host# set pool p1 address 129.0.0.1/32 port automatic
- Define a NAT rule, beginning with the match direction.[edit services nat]user@host# set rule r1 match-direction input
- Define a term for the rule, beginning with a
from clause.[edit services nat]user@host# set rule r1 term t1 from source-address 10.0.0.0/16
- Define the desired translation in a then clause.
In this case, use dynamic source translation.[edit services nat]user@host# set rule r1 term t1 then translated source-pool p1 translation-type napt-44
- (Optional) Configure logging of translation information
for the rule.[edit services nat]user@host# set rule r1 term t1 then syslog
Results
user@host# show services natpool p1 {
address 129.0.0.1/32;
port {
automatic;
}
}
rule r1 {
match-direction input;
term t1 {
from {
source-address {
10.0.0.0/16;
}
}
then {
translated {
source-pool p1;
translation-type {
napt-44;
}
}
syslog;
}
}Softwire Configuration
Step-by-Step Procedure
To configure the DS-Lite softwire concentrator, static route, and associated rules:
- Go to the [edit services softwire] hierarchy
level.user@host# edit services softwire
- Define the DS-Lite softwire concentrator. This includes
the softwire IPv6 address. This address is used to support an IPv4
over IPv6 tunnel with the B4 router. A corresponding IP over IP tunnel
is defined on the B4 router. Typically a static route is used at both
ends to direct traffic destined for the remote end of the tunnel over
the IPv6 link connecting the B4 and AFTR routers.[edit services softwire]user@host# set softwire-concentrator ds-lite ds-1 softwire-address 1001::1 mtu-v6 1460
- Define the softwire rule.[edit services softwire]user@host# set rule r1 match-direction input term t1 then ds-lite ds1.
- Define the static route to the B4 end of the IP over IP
tunnel. In this example the B4 router uses the IPv6 address 5002::1/128
address to source traffic sent over the IP tunnel to the AFTR node.
This address is assigned to a loopback interface so it can be used
as the tunnel source address.[edit routing-options]user@host# set rib inet6.0 static route 5002::1/128 next-hop 2001:0:0:1::1
Results
user@host# show services softwiresoftwire-concentrator {
ds-lite ds1 {
softwire-address 1001::1;
mtu-v6 1460;
}
}
rule r1 {
match-direction input;
term t1 {
then {
ds-lite ds1;
}
}
}user@host# show routing-options rib inet6.0static {
route 5002::1/128 next-hop 2001:0:0:1::1;
}Service Set Configuration
Step-by-Step Procedure
Configure a service set that includes softwire and NAT rules and specifies either interface-service or next-hop service. This example uses a next-hop service.
- Go to the [edit services service-set] hierarchy
level, naming the service set.user@host# edit services service-set sset
- Define the NAT rule to be used for IPv4-to-IPv4 translation.[edit services service-set sset]user@host# set nat-rules r1
- Define the softwire rule to define the softwire tunnel.[edit services service-set sset]user@host# set softwire-rules r1
- Define the interface service,[edit services service-set sset]user@host# set interface-service service-interface sp-0/0/0.0
Tip In order to avoid or minimize IPv6 fragmentation, you can configure a TCP maximum segment size (MSS) for your service set.
- (Optional) Define a TCP MSS.[edit services service-set sset]user@host# set tcp-mss 1024
Results
user@host# show services service-setsyslog {
host local {
services any;
}
}
softwire-rules r1;
nat-rules r1;
interface-service {
service-interface sp-0/0/0;
}
}Example: Configuring DS-Lite and 6rd in the Same Service Set
Requirements
The following hardware components can perform DS-Lite:
M Series Multiservice Edge routers with Multiservices PICs.
T Series Core routers with Multiservices PICs.
MX Series 5G Universal Routing Platforms with Multiservices DPCs. Starting in Junos OS release 17.4R1, DS-Lite is supported on MX Series routers with MS-MPCs and MS-MICs.Starting in Junos OS release 19.2R1, DS-Lite is supported on MX Virtual Chassis and MX Broadband Network Gateway (BNG) routers.Starting in Junos OS release 20.2R1, DS-Lite is supported for CGNAT Next Gen Services on MX240, MX480 and MX960 routers.
Overview
This example describes a softwire solution that includes DS-Lite and 6rd in the same service set.
Configuration
Chassis Configuration
Step-by-Step Procedure
To configure the chassis:
- Configure the ingress interface.user@host# edit interfaces ge-1/2/0[edit interfaces ge-1/2/0]user@host# set unit 0 family inet service input service-set v6rd-dslite-service-setuser@host# set unit 0 family inet service output service-set v6rd-dslite-service-setuser@host# set unit 0 family inet address address 10.10.10.1/24user@host# set unit 0 family inet6 service input service-set v6rd-dslite-service-setuser@host# set unit 0 family inet6 service output service-set v6rd-dslite-service-setuser@host# set unit 0 family inet6 address address address 2001::1/16
Here the service set is applied on the inet (IPv4) and inet6 (IPv6) families of subunit 0. Both DS-Lite IPv6 traffic and 6rd IPv4 traffic hits the service filter and is sent to the services PIC.
- Configure the egress interface (IPv6 Internet). The IPv4
server that the DS-Lite clients are trying to reach is at 200.200.200.2/24,
and the IPv6 server is at 3ABC::2/16.user@host# edit interfaces ge-1/2/2[edit interfaces ge-1/2/2]user@host# set unit 0 family inet address 200.200.200.1/24user@host# set unit 0 family inet6 address 3ABC::1/16
- Configure the services PIC.user@host# edit interfaces sp-3/0/0[edit interfaces sp-3/0/0]user@host# set unit 0 family inetuser@host# set unit 0 family inet6
Results
[edit interfaces]user@host# showge-1/2/0 {
unit 0 {
family inet {
service {
input {
service-set v6rd-dslite-service-set;
}
output {
service-set v6rd-dslite-service-set;
}
}
address 10.10.10.1/24;
}
family inet6 {
service {
input {
service-set v6rd-dslite-service-set;
}
output {
service-set v6rd-dslite-service-set;
}
}
address 2001::1/16;
}
}
}
ge-1/2/2 {
unit 0 {
family inet {
address 200.200.200.1/24;
}
family inet6 {
address 3ABC::1/16;
}
}
}
sp-3/0/0 {
unit 0 {
family inet;
family inet6;
}
}
Softwire Concentrator, Softwire Rule, Stateful Firewall Rule Configuration
Step-by-Step Procedure
To configure the softwire concentrator, softwire rule, and stateful firewall rule:
- Configure the DS-Lite and 6rd softwire concentrators.user@host# edit services softwire softwire-concentrator ds-lite ds1[edit services softwire softwire-concentrator ds-lite ds1]user@host# set softwire-address 1001::1user@host# mtu-v6 9192usert@host# up 1usert@host# edit v6rd v6rd-dom1[edit services softwire softwire-concentrator v6rd v6rd-dom1]user@host# set softwire-address 30.30.30.1user@host# set ipv4-prefix 10.10.10.0/24user@host# set v6rd-prefix 3040::0/16user@host# set mtu-v4 9192
- Configure the softwire rules.user@host# edit services softwire rule v6rd-r1][edit services softwire rule v6rd-r1]user@host# set match-direction inputuser@host# set term t1 then v6rd v6rd-dom1user@host# up 1user@host# edit services softwire][edit services softwire]user@host# edit rule dslite-r1[edit services softwire rule dslite-r1]user@host# set term dslite-t1 then ds-lite ds1
The following routes are added by the services PIC daemon on the Routing Engine:
user@host# run show route 30.30.30.1inet.0: 43 destinations, 46 routes (42 active, 0 holddown, 1 hidden) + = Active Route, - = Last Active, * = Both 30.30.30.1/32 *[Static/786432] 00:24:11 Service to v6rd-dslite-service-set [edit] user@host# run show route 3040::0/16 inet6.0: 23 destinations, 33 routes (23 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 3040::/16 *[Static/786432] 00:24:39 Service to v6rd-dslite-service-setuser@host# run show route 1001::1inet6.0: 33 destinations, 43 routes (33 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 1001::1/128 *[Static/1] 1w2d 22:05:41 Service to v6rd-dslite-service-set - Configure a stateful firewall rule.user@host# edit services stateful-firewall rule r1[edit services stateful-firewall rule r1]user@host# set match-direction input-outputuser@host# set term t1 then accept[edit services stateful-firewall]rule r1 {match-direction input-output;term t1 {then {accept;}}}
Results
[edit services softwire]user@host# showsoftwire-concentrator {
ds-lite ds1 {
softwire-address 1001::1;
mtu-v6 9192;
}
v6rd v6rd-dom1 {
softwire-address 30.30.30.1;
ipv4-prefix 10.10.10.0/24;
v6rd-prefix 3040::0/16;
mtu-v4 9192;
}
}
rule v6rd-r1 {
match-direction input;
term t1 {
then {
v6rd v6rd-dom1;
}
}
}
rule dslite-r1 {
match-direction input;
term dslite-t1 {
then {
ds-lite ds1;
}
}
}
[edit services stateful-firewall]user@host# showrule r1 {
match-direction input-output;
term t1 {
then {
accept;
}
}
}
NAT Configuration for DS-Lite
Step-by-Step Procedure
To configure NAT for DS-Lite:
- Configure a NAT pool for DS-Lite.user@host# edit services nat pool dslite-pool[edit services nat pool dslite-pool]user@host# set address-range low 33.33.33.1 high 33.33.33.32user@host# set port automatic
- Configure a NAT rule.user@host# up 1[edit services nat rule dslite-nat-r1]user@host# set match-direction inputuser@host# set term dslite-nat-t1 from source-address 20.20.0.0/16 then translated translation-type napt-44
Results
[edit services nat]user@host# showpool dslite-pool {
address-range low 33.33.33.1 high 33.33.33.32;
port {
automatic;
}
}
rule dslite-nat-r1 {
match-direction input;
term dslite-nat-t1 {
from {
source-address {
20.20.0.0/16;
}
}
then {
translated {
source-pool dslite-pool;
translation-type {
source dynamic;
}
}
}
}
}
Because of this NAT rule, the following NAT routes are installed for the reverse DS-Lite traffic:
user@host# run show route 33.33.33.0/24 inet.0: 48 destinations, 52 routes (47 active, 0 holddown, 1 hidden)
+ = Active Route, - = Last Active, * = Both
33.33.33.1/32 *[Static/1] 1w2d 23:08:38
Service to v6rd-dslite-service-set
33.33.33.2/31 *[Static/1] 1w2d 23:08:38
Service to v6rd-dslite-service-set
33.33.33.4/30 *[Static/1] 1w2d 23:08:38
Service to v6rd-dslite-service-set
33.33.33.8/29 *[Static/1] 1w2d 23:08:38
Service to v6rd-dslite-service-set
33.33.33.16/28 *[Static/1] 1w2d 23:08:38
Service to v6rd-dslite-service-set
33.33.33.32/32 *[Static/1] 1w2d 23:08:38
Service to v6rd-dslite-service-set
The NAT rule triggers address translation for the traffic coming from 20.20.0.0/16 to public address range 33.33.33.1 to 33.33.33.32.
Service Set Configuration
Step-by-Step Procedure
This service set has a stateful firewall rule and 6rd rule for 6rd service. The service set also includes a softwire rule for DS-Lite and a NAT rule to perform address translation for all DS-Lite traffic. The NAT rule performs NAPT translation in the forward direction on the source address and port of the DS-Lite traffic.
To configure the service set:
- Define the service set.user@host# edit services service-set v6rd-dslite-service-set
- Configure the service set rules.[edit services service-set v6rd-dslite-service-set]user@host# set softwire-rules dslite-r1user@host# set stateful-firewall-rules r1user@host# set nat-rules dslite-nat-r1
- Configure the service set interface-service.[edit services service-set v6rd-dslite-service-set]user@host# set interface-service service-interface sp-3/0/0
Results
[edit services service-set]user@host# showv6rd-dslite-service-set {
softwire-rules v6rd-r1;
softwire-rules dslite-r1;
stateful-firewall-rules r1;
nat-rules dslite-nat-r1;
interface-service {
service-interface sp-3/0/0;
}
DS-Lite Subnet Limitation
DS-Lite Per Subnet Limitation Overview
Junos OS enables you to limit the number of softwire flows from a subscriber’s basic bridging broadband (B4) device at a given point in time, preventing subscribers from excessive use of addresses within the subnet. This limitation reduces the risk of denial-of-service (DoS) attacks. This limitation is supported on MX Series routers equipped with MS-DPCs. Starting in Junos OS Release 18.2R1, MS-MPCs and MS-MICs also support the subnet limitation feature.Starting in Junos OS Release 19.2R1, MX Virtual Chassis and MX Broadband Network Gateway (BNG) routers also support the subnet limitation feature.Starting in Junos OS release 20.2R1, DS-Lite is supported for CGNAT Next Gen Services on MX240, MX480 and MX960 routers.
A household using IPv6 with DS-Lite is a subnet, not just an individual IP address. The subnet limitation feature associates a subscriber and mapping with an IPv6 prefix instead of an IPv6 address. A subscriber can use any IPv6 addresses in that prefix as a DS-Lite B4 address and potentially exhaust carrier-grade NAT resources. The subnet limitation feature enables greater control of resource utilization by identifying a subscriber with a prefix instead of a specific address.
The subnet limit provides the following features:
Flows utilize the complete B4 address.
Prefix length can be configured per service set under softwire-options for the individual service-set.
Port blocks are allocated per prefix of the subscriber B4 device, and not on each B4 address (if the prefix length is less than 128). If the prefix length is 128, then each IPv6 address is treated as a B4. Port blocks are allocated per 128-bit IPv6 address.
Session limit, defined under the DS-Lite softwire concentrator configuration, limits the number of IPv4 sessions for the prefix.
EIM, EIF, and PCP mappings are created per softwire tunnel (full 128 bit IPv6 address). Stale mappings time out based on timeout values.
If prefix length is configured , then PCP max-mappings-per-subscriber (configurable under pcp-server) is based on the prefix only, and not the full B4 address.
SYSLOGS for PBA allocation and release contain the prefix portion of the address completed with all zeros. SYSLOGS for PCP allocate and release, flow creation and deletion will still contain the complete IPv6 address.
The show services nat mappings address-pooling-paired operational command output now shows the mapping for the prefix. The mapping shows the address of the active B4.
The show services softwire statistics ds-lite output includes a new field that displays the number of times the session limit was exceeded for the MPC.
For Next Gen Services on MX240, MX480, and MX960 routers, the subnet limit statistic is displayed in the Softwire session limit exceeded field.
show services softwire statistics (MX-SPC3)
user@host> show services softwire statistics
vms-2/0/0
Total Session Interest events :3
Total Session Destroy events :2
Total Session Public Request events :0
Total Session Accepts :1
Total Session Discards :0
Total Session Ignores :0
Total Session extension alloc failures :0
Total Session extension set failures :0
Softwire statistics
Total Softwire sessions created :1
Total Softwire sessions deleted :2
Total Softwire sessions created for reverse packets :1
Total Softwire session create failed for reverse pkts :0
Total Softwire rule match success :1
Total Softwire rule match failed :0
Softwire session limit exceeded :0
Softwire packet statistics
Total Packets processed :1
Total packets encapsulated :1
Total packets decapsulated :1
Encapsulation errors :0
Decapsulation errors :0
Encapsulated pkts re-inject failures :0
Decapsulated pkts re-inject failures :0
DS-Lite ICMPv4 Echo replies sent :0
DS-Lite ICMPv4 TTL exceeded messages sent :0
ICMPv6 ECHO request messages received destined to AFTR :0
ICMPv6 ECHO reply messages sent from AFTR :0
ICMPv6 ECHO requests to AFTR process failures :0
V6 untunnelled packets destined to AFTR dropped :1
Softwire policy add errors :0
Softwire policy delete errors :0
Softwire policy memory alloc failures :0
Softwire Untunnelled packets ignored :0
Softwire Misc errors
DS-Lite ICMPv4 TTL exceed message process errors :0
Configuring DS-Lite Per Subnet Session Limitation to Prevent Denial of Service Attacks
You can configure the DS-Lite per subnet limitation on MX Series routers equipped with MS-DPCs. Starting in Junos OS Release 18.2R1, MS-MPCs and MS-MICs also support the subnet limitation feature. Starting in Junos OS Release 20.2R1, the Next Gen Services MX-SPC3 security services card supports the subnet limitation feature.
Starting in Junos OS Release 19.2R1, MX Virtual Chassis and MX Broadband Network Gateway (BNG) routers also support the subnet limitation feature.
To configure DS-Lite per subnet session limitation:
- Configure the size of the subnet
prefix to which limiting is applied. Specify a prefix length of 56,
64, 96, or 128.[edit}user@host# set services service-set service-set-name softwire-options dslite-ipv6-prefix-length dslite-ipv6-prefix-length
Note Ensure that all mappings are cleared before changing the prefix length.
- If you are using a next-hop service set on an AMS interface
for DS-Lite, set the AMS inside interface’s IPv6 source prefix
length to the same value you use for the subnet prefix in Step 1.[edit interfaces interface-name unit interface-unit-number load-balancing-options hash-keys]user@host# set ipv6-source-prefix-length ipv6-source-prefix-length
- Configure the maximum number of subscriber sessions allowed
per prefix. You can configure from 0 through 16,384 sessions.[edit}user@host# set services softwire softwire-concentrator dslite dslite-concentrator-name session-limit-per-prefix 12
For Next Gen Services DS-Lite, MAP-E and V6rd softwires, configure the maximum number of subscriber sessions allowed per prefix:
[edit}user@host# set services softwires softwire-types ds-lite | map-e | v6rd session-limit-per-prefix limitNote You cannot use flow-limit and session-limit-per-prefix in the same dslite configuration.