SRX

My org has an SRX1400 running 12.1x48-D30. My ISP has started offering IPv6 and has given us a static address for the gateway, a subnet for our internal devices, and the other info needed to connect.

I can give our WAN and LAN interfaces the proper IPv6 address. However I cannot get a static IPv6 route set up.

I can give the gateway the correct command, # set routing-options rib inet6.0 static route ::/0 next-hop 2610:20:900c:4003::4, and commit it no problem. The configuration, # show routing-options, shows the new info. But the route never shows up when I run show route.

I can ping the next hop from both the gateway and my servers. I cannot ping any IPv6 destination, such as ipv6.google.com, from the gateway or my servers, though the IP address does resolve. So why doesn't the route show up?

At this time the only things I haven't done are reboot the gateway, which technically shouldn't be necessary, or upgrade it to 12.3, needs to be done but also shouldn't be necessary.

Any ideas?

Confirm that ipv6 flow mode is enable on the device

show security flow status 

The routes will be in the inet6 table.  Do you see them if you specify this.

show route table inet6.0

For transit traffic you will need security policies in place. you can verify sessions using show security flow

https://www.juniper.net/documentation/en_US/junos/topics/task/verification/ipv6-flow-session-displaying.html

It looks like IPv6 flow mode is enabled:

admin@fw> show security flow status 
  Flow forwarding mode:
    Inet forwarding mode: flow based
    Inet6 forwarding mode: flow based
    MPLS forwarding mode: drop
    ISO forwarding mode: drop
  Flow trace status
    Flow tracing status: off
  Flow session distribution
    Distribution mode: RR-based
  Flow ipsec performance acceleration: off
  Flow packet ordering
    Ordering mode: Hardware

When looking at the route table I see the routes that have been discovered but still do not see the static route:

admin@fw> show route table inet6.0 

inet6.0: 9 destinations, 12 routes (9 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

2001:48a8:5ffd:ffff::/64
                   *[Direct/0] 17w0d 16:41:49
                    > via ge-0/0/11.0
2001:48a8:5ffd:ffff::2/128
                   *[Local/0] 78w6d 01:15:19
                      Local via ge-0/0/11.0
2610:20:900c:4003::5/128
                   *[Direct/0] 56w6d 16:02:41
                    > via ge-0/0/9.0
                    [Local/0] 78w5d 21:40:01
                      Local via ge-0/0/9.0
2610:20:900d:4010::/64
                   *[Direct/0] 78w6d 01:15:22
                    > via xe-2/0/1.5
2610:20:900d:4010::254/128
                   *[Local/0] 78w6d 01:15:42
                      Local via xe-2/0/1.5
fe80::/64          *[Direct/0] 78w6d 01:15:22
                    > via xe-2/0/1.5
                    [Direct/0] 56w6d 16:02:41
                    > via ge-0/0/9.0
                    [Direct/0] 17w0d 16:41:49
                    > via ge-0/0/11.0
fe80::cee1:7f00:55d:8445/128
                   *[Local/0] 78w6d 01:15:42
                      Local via xe-2/0/1.5
fe80::cee1:7fff:fe5d:805d/128
                   *[Local/0] 78w5d 21:40:01
                      Local via ge-0/0/9.0
fe80::cee1:7fff:fe5d:805f/128
                   *[Local/0] 78w6d 01:15:19
                      Local via ge-0/0/11.0

I do have IPv6 security policies in place for incoming and outgoing traffic. Specifically anything can go out and pings and website traffic can come in.

I think you have interface ge-0/0/9 misconfigured.  It looks like this should be a routed link where you can access the next hop for your default ipv6 route

set routing-options rib inet6.0 static route ::/0 next-hop 2610:20:900c:4003::4

But the routing table only has this as a /128.  To reach the next hop this has to be at least a /127 to see the next hop

2610:20:900c:4003::5/128
                   *[Direct/0] 56w6d 16:02:41
                    > via ge-0/0/9.0
                    [Local/0] 78w5d 21:40:01
                      Local via ge-0/0/9.0

Without the next hop reachable the route will not install.

So changing the configuration for ge-0/0/9 from /128 to /127 did it. Once that was committed the static route showed up.

This change makes a lot of sense when thinking about the subnets but not knowing IPv6 very well I definitally missed it, though I didn't set it up in the first place.

Thanks for the assist spuluka.

Glad you have it working now.