While it would be nice to have failover and be able to use one subnet in two tunnels, failover can be accomplished with two subnets and two tunnels. I currently have three subnets, two here and one somewhere else. Each of the machines on my internal network has an almost identical address on each of the subnets, with the exception of the initial prefix: ie. each server has 3 addresses, 2001:xxxx:xxxx:aaaa:aaaa..., 2001:yyyy:yyyy:aaaaa...., 2001:zzzz:zzzz:aaaa.... That makes it easy to remember. For the end users who I'm attempting to provide IPv6 connectivity to, I simply give them an address on one of the subnets. If that subnet is down I simply change my radvd config file to give them an address on a working subnet. My only problem is with source address selection in Linux. I understand the newer kernels handle this better, but I have trouble telling my servers which source address to use on CentOS 5.2. My servers like to pick a source address on a non-working subnet and send it through the working tunnel, which of course gets rejected by the tunnel. I route all the traffic between my subnets internally, so as not to unnecessarily send traffic through the tunnel.

There is a Wishlist item for BGP support for this reason. If you are using CARP though, you don't need to advertise any new defaults, you just have to configure the 'default' to be on your CARP device, failover will then handle that part. You will indeed have to either start/stop aiccu on the relevant machine, or maybe easier, add/remove a firewall rule which disallows traffic to the PoP. Do take care of one thing though: when the tunnel-IP flips too often the tunnel gets disabled!