hardMultiple ChoiceObjective-mapped
6to4 Automatic Tunnel: Addressing and Loop Prevention
A network engineer configures a 6to4 tunnel between two sites. The tunnel works for traffic from Site A to Site B, but return traffic from Site B to Site A fails. Both sites have IPv4 connectivity. What is the most likely explanation?
Quick Answer
The answer is that Site B’s IPv4 address is private and not reachable from Site A, as 6to4 requires public IPv4 addresses on both ends. This is because a 6to4 automatic tunnel derives its IPv6 prefix from the embedded IPv4 address using the 2002::/16 format, so if Site B uses a private address like 10.x.x.x or 192.168.x.x, Site A cannot route return traffic over the public Internet—private addresses are non-routable globally. On the Cisco CCNP ENARSI 300-410 exam, this scenario tests your understanding of 6to4 tunnel addressing and loop prevention, often appearing as a trick where one-way traffic works but return traffic fails. A common trap is assuming any IPv4 connectivity suffices, but the key is that both endpoints must have globally routable addresses for bidirectional communication. Memory tip: think “2002 requires two public IPs”—if one side is private, the tunnel is one-way only.
⚠ Common exam trap
Cisco often tests the misconception that 6to4 tunnels can work with private IPv4 addresses if NAT is involved, but 6to4 does not support NAT traversal because the IPv4 address is embedded in the IPv6 prefix, making it incompatible with address translation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Site B's IPv4 address is private and not reachable from Site A; 6to4 requires public IPv4 addresses on both ends.
6to4 tunnels require both endpoints to have globally routable public IPv4 addresses because the tunnel encapsulation uses the IPv4 address to derive the IPv6 prefix (2002::/16). If Site B has a private IPv4 address (e.g., 10.x.x.x or 192.168.x.x), Site A cannot route return traffic to it, as private addresses are not reachable over the public Internet. This explains why traffic from Site A to Site B works (Site A's public address is reachable), but return traffic fails.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Site B's IPv4 address is private and not reachable from Site A; 6to4 requires public IPv4 addresses on both ends.
Why this is correct
6to4 requires globally routable IPv4 addresses on both tunnel endpoints. If Site B uses a private address behind NAT, the return traffic cannot be encapsulated correctly.
- ✗
The tunnel mode on Site B is configured as GRE IPv6 instead of 6to4.
Why it's wrong here
6to4 tunnels use tunnel mode ipv6ip 6to4; GRE mode would not interpret the 2002:: prefix correctly.
- ✗
The IPv6 MTU on the tunnel is set too high, causing fragmentation of return packets.
Why it's wrong here
MTU issues would cause packet drops but not a complete failure of return traffic; also, fragmentation is handled by IPv4.
- ✗
Site A has a firewall blocking incoming IPv4 protocol 41 packets.
Why it's wrong here
This would affect both directions; the question states Site A to Site B works, so incoming packets to Site A are not blocked.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on 300-410
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. In a 6to4 tunnel, how is the tunnel destination address determined?
medium- A.It is manually configured.
- ✓ B.It is derived from the IPv6 destination address using the 2002::/16 prefix.
- C.It is obtained via DNS.
- D.It is the same as the tunnel source.
Why B: In a 6to4 tunnel, the tunnel destination address is automatically derived from the IPv6 destination address by extracting the IPv4 address embedded in the 2002::/16 prefix. Specifically, the first 16 bits of the IPv6 destination are 2002, and the next 32 bits represent the IPv4 address of the remote 6to4 router. This allows the tunnel to be dynamically established without manual configuration of each destination.
Variation 2. In a 6to4 tunnel, what is the default IPv6 prefix assigned to the tunnel interface?
medium- A.2002::/16
- ✓ B.2002:IPv4-address::/48
- C.2001::/32
- D.3ffe::/16
Why B: In a 6to4 tunnel, the default IPv6 prefix assigned to the tunnel interface is 2002:IPv4-address::/48, where the IPv4 address of the tunnel source is embedded in the prefix. This is defined in RFC 3056, which specifies that the 6to4 prefix is 2002::/16, and the next 32 bits are the tunnel source's IPv4 address, resulting in a /48 prefix for the 6to4 site.
Variation 3. Which TWO statements correctly describe the behavior of automatic 6to4 tunneling? (Choose TWO.)
hard- ✓ A.The 6to4 prefix is 2002::/16, where the next 32 bits are the IPv4 address of the tunnel source in hexadecimal.
- ✓ B.A 6to4 relay router must have an IPv6 route to 2002::/16 pointing to the tunnel interface.
- C.6to4 tunnels can use private IPv4 addresses as the tunnel source.
- D.The 6to4 prefix is 2001::/16, and the IPv4 address is embedded in the interface ID.
- E.The tunnel interface must be configured with tunnel mode ipv6ip.
Why A: RFC 3056 defines the 6to4 prefix as 2002::/16, and the next 32 bits are the IPv4 address of the tunnel source converted to hexadecimal. This embeds the IPv4 address directly into the IPv6 prefix, allowing automatic tunnel creation without explicit peer configuration.
Variation 4. Which loop prevention mechanism is inherent to 6to4 tunneling?
medium- A.Split horizon
- B.Reverse path forwarding (RPF) check
- ✓ C.Embedded IPv4 address validation
- D.TTL decrement
Why C: 6to4 tunneling uses an embedded IPv4 address in the IPv6 prefix (2002::/16) to automatically derive the tunnel destination. This inherent validation prevents routing loops by ensuring that a 6to4 router only accepts packets whose source IPv4 address matches the embedded address in the IPv6 source prefix, rejecting mismatched or spoofed traffic that could cause loops.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.