How do I create a GRE 4to6 tunnel?

03/26/2020 5 People found this article helpful 39,433 Views

Download

Print

Share

• LinkedIn
• Twitter
• Facebook
• Email
• Copy URL The link has been copied to clipboard

Description

This article covers how to create a GRE 4to6 tunnel using a SonicWall firewall.

Resolution

To create a GRE 4to6 tunnel please perform the following:

1. Login to the firewall as an administrator.
2. Navigate to MANAGE | Network | Interfaces. Ensure that IPv4 is selected next to "View IP Version".
3. Select the drop down “Add Interface” and choose “4to6 Tunnel Interface”.
   
4. A pop-up box will open. Under “Tunnel Type:” select GRE 4to6 Tunnel.
5. Click the General tab:
   
   
   1. Zone – Interface zone. It should be WAN zone, and can not be edited.
   2. Name – Interface name. It can’t be null and the max length is 25.
   3. IP Address – Interface IPv4 address.
   4. Subnet Mask – Subnet mask.
   5. Bound to – The interface which tunnel is bound to. It should be a physical WAN interface. If Bound Interface is link down, the GRE 4to6 Tunnel will be down as well. Bound Interface can not change its zone to others.
   6. Local IPv6 address – As an interface may have various IPv6 addresses, there are two modes for the local IPv6 address choice.
      
      1. Using bound Interface’s IPv6 Address as Local Address. When bound interface is on DHCPv6 or Autonomous Mode, it would get a dynamic IP (DHCPv6 IP or Autonomous IP) as tunnel local IPv6 address, and DHCP IP has a higher priority. Otherwise, if bound interface is on STATIC or other Mode, it would use primary static v6 IP as tunnel local IPv6 address. If bound interface IP is released/deleted, it can be ::.
      2. Specify the Local IPv6 Address.
   7. Remote IPv6 address – the endpoints must be specified.
6. Next, click the Advanced tab:
   
   
   1. MTU – the MTU effective for IPv4 packet size before encapsulation. GRE tunnel will automatically calculate its MTU based on the bound interface’s IPv6 MTU. When bound IPv6 interface MTU changes, the existed tunnel’s MTU will be automatically updated. This is the default configuration.
      Gre_4to6_tun_mtu = bound_if_mtu – IPv6_header_length – GRE_header_length
   2. Like a WAN interface, there are three configuration items for fragmentation setting over a GRE 4to6 Tunnel interface:
      1. Fragment non-VPN outbound packets larger than this Interface's MTU (default enabled)
      2. Ignore Don't Fragment (DF) Bit
      3. Suppress ICMP Fragmentation Needed message generation

Configuring Route Entry

When a GRE tunnel is configured, it can be selected as the egress interface of an IPv4 route entry. If we want to route IPv4 traffic over the GRE tunnel interface, we can manually add an IPv4 route entry (for example, entry 11 in the below figure).
GRE tunnels are also like a general interface. When adding a new GRE tunnel interface, it will auto-add a route policy (for example, entry 10 the in below figure).

Auto Address Objects

When adding a GRE tunnel interface, it will create two Address Objects with name “NAME IP” and “NAME Subnet”, and “NAME IP” will be added to “All Interface IP” group, and “Zone Interface IP” group. “NAME Subnet” will be added to “Zone Subnets”.
When the interface is deleted, the address objects will be deleted.

Related Articles

• How to force an update of the Security Services Signatures from the Firewall GUI
• How to upload security services signatures manually on Closed Environments?
• How to Create Gen 7 Settings File by Using the Online Migration Tool

Categories

• Firewalls > NSa Series > VPN