IPv6 over backup interface

[drewdown]

I have IPv6 over my backup ISP (dual PA 3020s).

I am trying to route all IPv6 traffic over that interface but not having much luck passing any IPv6 through the PA. If I ping6 internal and external hosts from the PA itself it works. If I try to ping/traceroute from behind the PAN at the core or from outside the PAN it doesn't work. I have policies in both directions and I see when I send traffic from behind the PAN (from the core) the PAN is routing it out the primary interface eth1/2 which won't work.  I need it to go out eth1/3.

This is what I have tried:

• Static route for IPv6 default route pointing to backup interface + next hop of IPv6 WAN
• PBF for IPv6 source traffic forwarded to backup interface + next hop IPv6 WAN

Neither worked and I am still seeing IPv6 packets being routed out the primary interface.

Anyone have any ideas?

Trust > Untrust (wrong int):

https://imgur.com/77ht8L7

Untrust > Trust: (right int):

https://imgur.com/dOiv54J

[gwesson]

A couple things you may be able to test to see what's going on:

1. Dump the fib table. It won't help for your PBF rule, but since your VR has a static route it should show that correctly:

> show routing route

2. Test the routing to see what the firewall thinks the correct route should be:

> test routing fib-lookup virtual-router your_vr_name ip 2a00:1450:4001...

The virtual router will always take a more specific route, so make sure your eth1/1 route doesn't have a more specific IPv6 route that is overriding your static route. It may also be helpful to see what your static route and PBF policy does (if you can sanitize it for public consumption here in the forums).

[drewdown]

I got it working.  I simply moved the PBF to the top of my PBF list and did not specify a next hop interface (eth 1/3) on the static route and it started working.  Which is weird because that PBF rule was the only one referrencing any IPv6 traffic so I figured it would match it regardless of where it resided in the list.  Not sure which one of this allowed it start working but it is now.