There are three methods to forward IPv6 traffic into static tunnels on the private side:
The destination address is a configured destination IP (dest-ip) under the tunnel context.
The dest-ip can be either an IPv6 address or an IPv4 address.
In the case of IPv6, it must be either an IPv6 global unicast address or an IPv6 link-local address.
In the case of IPv4, it can be used to forward IPv4 traffic into the tunnel.
In case of unicast address, dest-ip must be within the prefix configured on the private interface.
Up to 16 destination IPs can be configured per ipsec-tunnel.
A v6 route with a configured destination IP as the next-hop, this route can be learned from either a static or dynamic from a routing protocol such as BGP.
An IPv6 static route with an ipsec-tunnel used as the next-hop.
A security policy supports either an IPv4 entry or an IPv6 entry or both for dual-stack.