Routing

Hello Experts

I have GRE tunnel on my router to remote end point. This GRE tunnel is basically IPV6 traffic over IPV4 GRE tunnel. I have routing engine protect RE filter (both IPV4/IPV6) as well on this router. 

My question is that should I need to allow GRE protocol in RE protect firewall filter or not??

What I tested if I allow or not GRE protocol in firewall filter it is working fine. Appreciated for any input on this

Thanks 

Hello

Is there any one to take this?

Hello,

Here is my answer:

No, in order to have PFE-based GRE tunnels working You do NOT have to allow or deny GRE in Routing Engine firewall filter applied to lo0.0 or any other lo0 unit

_UNLESS_

You are running GMPLS/LMP which requires RE-based GRE tunnel for control channel. This tunnel is called "gre" and whereas You can configure it, it is not supported except for GMPLS/LMP control channel matters.

http://www.juniper.net/techpubs/en_US/junos10.4/topics/task/configuration/gmpls-lmp-peers-solutions.html

HTH

Thanks

Alex

Thanks. Also If I want to allow BGP V6 in RE filter then should I have to allow ICMP6  as well??

Yes.

Neighbor Discovery (which is ARP equivalent for IPv6) runs over ICMPv6.

HTH

Thanks

Alex

Hello Alex

Thanks. That really hepled. Should Neighbor Discovery (icmp-type 135, 136) is enough or Should I need to allow the inverse neighbor discovery (141-142) and Router Discovery (icmp-type 133, 134).

Appreciated your input

Hello

Thanks for the reply. Should I allow source-prefix-list link-local-address (fe80::/64) for icmp6 (135-136)? OR have to allow source ANY.

Thanks