Interfaces and Hardware Component Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Interfaces and Hardware Component Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

Unidirectional GUEv6 for IPv6 traffic

Updated: July 31, 2026

Want to summarize with AI?

Log in

This topic describes static Generic UDP Encapsulation (GUE) tunnels over an IPv6 underlay (GUEv6) on the Cisco 8000 Series Router, which enables scalable IPv4 and IPv6 overlay transport without dynamic tunnel discovery.

A static GUEv6 is a tunneling protocol feature that

  • provides stateless UDP encapsulation using IPv6 as the underlay transport,

  • enables overlay transport of IPv4 and IPv6 payloads using static configuration, and

  • facilitates migration from legacy MPLS forwarding to IP-only designs.

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

Generic UDP Encapsulation for IPv6 Traffic

Release 26.2.1

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200]); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q200])

This release introduces support for Generic UDP Encapsulation (GUE) tunnels operating over IPv6 underlays (GUEv6). With this feature, you can enable the highly efficient, scalable, and secure deployment of Generic UDP Encapsulation variant 1 (GUEv1) static tunnels to carry IPv4 and IPv6 traffic over IPv6 networks.

Benefits of GUEv6 tunnels

These are the primary benefits of static GUEv6 tunnels:

  • Reduced overlay complexity by using consistent encapsulation across the IPv6 underlay.

  • Elimination of dynamic tunnel negotiation and fallback mechanisms.

  • Improved manageability with stateless configuration and predictable behavior.

Key attributes include:

  • Supports IPv4 and IPv6 overlay payloads across an IPv6 core.

  • Uses static configuration for tunnel management.

  • Employs a single UDP port, 6080 by default, for encapsulation.

Common use cases for static GUEv6 tunnels include:

  • Interconnecting edge routers over an IPv6-only network.

  • Providing overlay connectivity where IPv4 address resources are limited.

Configuration guidelines and restrictions for GUEv6

Best practice for static GUEv6 tunnel configuration

Use static configuration for all required GUEv6 tunnels. Assign explicit local source and remote tunnel endpoint IPv6 addresses to each tunnel, and configure a single default UDP port, port 6080, for operational simplicity. Automate route distribution for tunnel endpoints using BGP, and avoid mixing overlay and underlay VRFs during deployment. Manage VRF selection with DSCP-based policies during migration phases.

  • Automate route distribution for tunnel endpoints using BGP to minimize manual errors and increase network adaptability.

  • Assign explicit local source and remote tunnel endpoint IPv6 addresses in the static GUEv6 configuration to ensure predictable overlay path selection.

Best practice for migration and operations

Plan IPv6 underlay migration in clear steps with phased VRF selection and deliberate route leaking. Use DSCP-based access-list and Policy-Based Routing (PBR) rules to incrementally divert traffic classes to the appropriate VRF and tunnel. Verify data plane forwarding and monitor tunnel counters after each migration phase.

  • Update access lists and policies incrementally, moving traffic classes stepwise to minimize disruption.

  • Verify forwarding behavior and tunnel statistics after each change to confirm data flows are consistent and no fallback to default routes occurs.

Interoperability restrictions for static GUEv6 tunnels

These restrictions apply for static GUEv6 tunnels:

  • Only static tunnel configuration is available. Dynamic GUE tunnel establishment and auto-discovery are not supported.

  • No fallback to default routes or null0 resolution. When a tunnel endpoint is unreachable, the routes using the tunnel are withdrawn.

  • Encapsulation and decapsulation typically use the default VRF and depend on underlying ASIC support.

  • Per-family or traffic class counters are not available in single UDP port mode. Only per-tunnel endpoint counters are provided.

  • MPLS payloads are not supported for static GUEv6 tunnels.

  • DSCP and TTL are handled in uniform and pipe mode respectively. Per-tunnel overrides are not supported.

How static GUE over IPv6 underlay works

Static GUE over IPv6 underlay allows routers to encapsulate and transport overlay traffic, including both IPv4 and IPv6, in UDP packets across a core network that supports only IPv6. This approach supports migration from MPLS-based to IP-only transport domains, and makes efficient use of both IPv4 and IPv6 payloads.

Summary

The key components involved in static GUE over IPv6 underlay are:

  • Edge routers: Tunnel endpoints that perform encapsulation and decapsulation of overlay traffic.

  • Core IPv6 network: Transports encapsulated packets between edge routers.

  • BGP: Optionally used to learn tunnel endpoint addresses and facilitate management.

This process creates scalable, stateless, and predictable overlay transport using manually defined tunnel endpoints and encapsulation policies. It simplifies migration from MPLS systems and provides granular control over traffic flows.

Workflow

The process involves these stages:

  1. The operator provisions static GUEv6 tunnels on each edge router by specifying the local source IPv6 address and remote IPv6 endpoint. Overlay prefixes are mapped to GUEv6 tunnels with static route configuration.
    • Identify overlay prefixes (IPv4 and IPv6) that require transport.
    • Define static routes for each prefix, specifying the remote endpoint and local source address.
    • BGP can distribute or learn remote endpoints, but tunnel setup stays static.
    Result: Static tunnel mappings are established between all edge nodes.
  2. Overlay traffic is selected for encapsulation based on VRF assignment and policies such as DSCP or access-list matching. The router forwards selected traffic into GUEv6 tunnels using static routes with encapsulation.
    • Ingress interfaces and VRF policies direct overlay traffic into the static tunnel, supporting phased migration and traffic engineering.
    • DSCP or Policy-Based Routing (PBR) rules classify and route traffic accordingly.
    Result: Traffic can be steered in a controlled manner, allowing fine-grained policy enforcement.
  3. The edge router encapsulates IPv4 or IPv6 payloads using Generic UDP Encapsulation (GUE) version 1, forming a UDP packet with the configured UDP header. Both IPv4 and IPv6 overlays use the same tunnel interface.
    • Packet source and destination addresses are set to the local and remote IPv6 addresses.
    • DSCP and TTL handling are applied per platform capability (usually uniform or pipe modes).
    • Encapsulated packets traverse the IPv6 core using standard routing policies.
    Result: Unified UDP port and stateless encapsulation ensure efficiency and consistent platform behavior.
  4. Upon receiving, the edge router decapsulates GUE packets to recover the original payload and forwards it within the destination VRF according to routing policies.
    • The ASIC performs decapsulation to ensure hardware-level scalability, while class maps determine the forwarding decisions.
    • Traffic is restored to the original IPv4 or IPv6 form, preserving headers.
    Result: The overlay packet is delivered to its destination in its original format.

Configure static GUE over IPv6 underlay

Before you begin

Ensure that your environment meets these prerequisites before you configure static GUEv6 tunnels:

  • The platform and software version support static GUEv6 tunnel configuration.

  • BGP routing is operational and can learn tunnel endpoint addresses.

  • Required VRF and interface constructs are present on the routers.

  • The local source IPv6 address and remote tunnel endpoint IPv6 address are identified.

Procedure

1.

Enter global configuration mode and then the static routing configuration mode.

Example:

Router# configure
Router(config)# router static
2.

Enter IPv4 unicast address family configuration mode to configure an IPv4 payload route over a GUEv6 tunnel.

Example:

Router(config-static)# address-family ipv4 unicast
3.

Configure the IPv4 route prefix, IPv6 remote next hop, and GUEv1 tunnel source IPv6 address by using the ipv4-prefix remote-next-hop ipv6-destination tunnel gue-v1 source-ip ipv6-source command.

Example:

Router(config-static-afi)# 200.1.1.1/32 remote-next-hop 2000:75:100:10::16 tunnel gue-v1 source-ip 64:64::64:64
4.

Exit to static routing configuration mode.

Example:

Router(config-static-afi)# exit
5.

Enter IPv6 unicast address family configuration mode to configure an IPv6 payload route over a GUEv6 tunnel.

Example:

Router(config-static)# address-family ipv6 unicast
6.

Configure the IPv6 route prefix, IPv6 remote next hop, and GUEv1 tunnel source IPv6 address by using the ipv6-prefix remote-next-hop ipv6-destination tunnel gue-v1 source-ip ipv6-source command.

Example:

Router(config-static-afi)# 2000:1::1/128 remote-next-hop 2000:75:100:10::16 tunnel gue-v1 source-ip 64:64::64:64
7.

Exit to global configuration mode.

Example:

Router(config-static-afi)# exit
Router(config-static)# exit
8.

Commit the configuration.

Example:

Router(config)# commit
9.

Use these commands to verify the static GUEv6 tunnel configuration:

Example:

Router# show tunnel gue summary
Router# show tunnel gue endpoint detail
Router# ping ipv6 2000:75:100:10::16

  • Use the show tunnel gue summary command to display tunnel summary information.

  • Use the show tunnel gue endpoint detail command to display per-endpoint tunnel details.

  • Use the ping ipv6 destination command to verify IPv6 underlay reachability to the tunnel destination.