A further followup, for anyone still confused (me perhaps?)
A word of warning - setting ipv6 forwarding mode to packet-based will expose your ipv6 hosts to incoming traffic if you do not specifically configure packet filters for them (*packet filters* - not zone based firewall policies). This will be unacceptable to a lot of people.
Borrowing suggestions from nbarsotti's earlier post, I set ipv6 back to flow-based, and added the workaround packet filters for protocol 41. However, since my internet-facing interface gets a dynamic IP (pppoe), I chose to allow protocol 41 to/from the HE tunnel endpoint, rather than my interface IP address.
Some snippets from my config:
interfaces {
pp0 {
unit 0 {
family inet {
mtu 1492;
filter {
input fix-6in4;
}
negotiate-address;
}
}
}
}
security {
forwarding-options {
family {
inet6 {
mode flow-based;
}
}
}
}
firewall {
family inet {
filter fix-6in4 {
term t1 {
from {
source-address {
216.66.80.30/32;
}
protocol 41;
}
then packet-mode;
}
term t2 {
from {
destination-address {
216.66.80.30/32;
}
protocol 41;
}
then packet-mode;
}
term t99 {
then accept;
}
}
}
}
Using the above config (on 10.3r3), my HE tunnel worked fine, and ipv6 traffic crossing from untrust to trust zone was blocked as it should be. I verified that the flow-based firewall was working by creating a policy that allowed pings from outside to my ipv6 hosts in the trust zone. Disabling the policy again blocked traffic, so that definitely seemed to be working correctly. Yay!
Incidentally, I also then tried an upgrade to 10.4r2, but had major problems connecting to websites. Simple text-only pages loaded ok, but anything that had multiple graphics on it resulted in hung connections. No idea what's going on there, and I've run out of time (and patience) for now, so rolled back to 10.3r3.
10.4r1 might have worked (I didn't try it), but I think the 10.4 series in general is a bit shaky still. I'm happy just to have my HE tunnel working *properly*, without exploiting the side-effects of some bug in an earlier Junos release.
The protocol 41 packet filter workaround is described in detail here http://www.juniper.net/techpubs/software/junos-security/junos-security10.2/junos-security-admin-guid...
