负载均衡lb1000-a AFT/NatPT ipv4转换问题

为实现ipv6外部访问内部ipv4服务，在LB100-A上先采用AFT配置，后用NATPT配置，均发现IPV6转IPV4正常，目标设备回了ipv4包，但不能正常转回V6，debug日志如下：

debugging natpt all

debugging ip pac acl 3088

(240E:410:11:4644:1768:6D40:1246:E7C9 : 10431 - 2408:8634:601:A0::A53:BF03 : 0) 

(3.0.0.1 : 10431 - 10.83.191.3 : 0) 

*Jun 14 18:17:32:752 2023 NEPDI-LB AFT/7/PACKET: 

 Pro : ICMP 

 TTL : 244

 IPv6 packet is translated to IPv4 packet. 

(240E:410:11:4644:1768:6D40:1246:E7C9 : 10431 - 2408:8634:601:A0::A53:BF03 : 0)

 (3.0.0.1 : 10431 - 10.83.191.3 : 0) 

*Jun 14 18:17:32:753 2023 NEPDI-LB DPIPFWD/7/debug_case: 

 Sending, interface = GigabitEthernet0/3, version = 4, headlen = 20, tos = 0, 

 pktlen = 84, pktid = 0, offset = 0, ttl = 244, protocol = 1, 

 checksum = 47697, s = 3.0.0.1, d = 10.83.191.3 

prompt: Sending the packet from local 

 *Jun 14 18:17:32:753 2023 NEPDI-LB DPIPFWD/7/debug_case:

 Receiving, interface = GigabitEthernet0/3, version = 4, headlen = 20, tos = 0, 

 pktlen = 84, pktid = 58807, offset = 0, ttl = 254, protocol = 1, 

 checksum = 51865, s = 10.83.191.3, d = 3.0.0.1 

prompt: Receiving IP packet 

 *Jun 14 18:17:32:754 2023 NEPDI-LB DPIPFWD/7/debug_case: 

 Sending, interface = GigabitEthernet0/2, version = 4, headlen = 20, tos = 0,

 pktlen = 84, pktid = 58807, offset = 0, ttl = 253, protocol = 1, 

 checksum = 52121, s = 10.83.191.3, d = 3.0.0.1 

prompt: Sending the packet from GigabitEthernet0/3

# version 5.20, Ess 7904P03 

# sysname NEPDI-LB

 # clock timezone CN add 08:00:00 #

 undo voice vlan mac-address 00e0-bb00-0000 

# nat address-group 1 222.168.33.170 222.168.33.171 level 1

 nat address-group 2 175.19.206.227 175.19.206.228 level 1 

 nat address-group 3 222.169.191.18 222.169.191.18 level 1

 nat address-group 4 address 222.161.22.5 222.161.22.5 

 nat address-group 5 address 222.168.33.165 222.168.33.165 

# 

 domain default enable system

 # dns resolve dns proxy enable 

 dns server 114.114.114.114

 dns server 223.5.5.5 

 dns server 202.98.5.68 

#

 ipv6 

# 

 ip ttl-expires enable

 ip unreachables enable

 #

firewall ipv6 enable 

# ip http acl 2000 ip http port 9999 # web idle-timeout 120 # 

 natpt address-group 1 3.0.0.1 3.0.0.10

 natpt address-group 2 3.0.0.11 3.0.0.20 

 natpt turn-off traffic-class 

 natpt turn-off tos 

 natpt prefix 2408:8634:0601:00a0:: interface GigabitEthernet0/3 

 natpt v6bound dynamic prefix 2408:8634:0601:00a0:: address-group 1 no-pat

 # 

session aging-time syn 15 session aging-time tcp-est 1800 session aging-time udp-open 15 application aging-time ftp 1800 application aging-time dns 10 application aging-time msn 1800 session synchronization enable # password-recovery enable # acl number 2000 description deny remote manage rule 0 permit source 10.83.226.0 0.0.0.255 rule 5 permit source 10.83.96.0 0.0.7.255 # acl number 3000 description TO_Outside rule 1 deny ip source 192.168.255.200 0 rule 2 deny ip destination 10.0.0.0 0.255.255.255 rule 3 deny ip destination 10.92.255.254 0 rule 20 deny ip destination 192.168.255.200 0 rule 25 deny ip destination 61.50.210.146 0 rule 30 deny ip destination 222.249.228.231 0 rule 35 deny ip destination 61.50.210.147 0 rule 40 deny ip destination 2.0.1.0 0.0.0.255 rule 45 deny ip source 3.0.0.0 0.0.0.31 rule 50 deny ip destination 3.0.0.0 0.0.0.31 rule 2000 permit ip source 10.83.0.0 0.0.255.255 rule 2005 permit ip source 192.168.0.0 0.0.255.255 rule 2010 permit ip source 172.16.0.0 0.0.255.255 rule 2015 permit ip source 172.26.0.0 0.0.255.255 acl number 3001 description TO_Telecom rule 0 permit ip source 192.168.253.2 0 rule 2 deny ip source 172.16.22.50 0 rule 3 deny ip destination 211.152.51.146 0 rule 4 deny ip destination 221.8.52.58 0 rule 5 permit ip destination 219.149.194.55 0 rule 6 deny ip source 172.16.18.43 0 rule 7 deny ip destination 124.127.39.8 0 rule 10 permit ip destination 219.149.194.56 0 rule 11 deny ip destination 211.99.9.104 0 rule 15 permit ip destination 222.168.33.160 0.0.0.15 rule 20 permit ip source 10.83.204.0 0.0.0.255 rule 25 permit ip source 10.83.223.17 0 rule 30 permit ip source 192.168.255.6 0 rule 35 permit ip source 192.168.101.0 0.0.0.255 rule 40 permit ip source 192.168.102.0 0.0.0.255 rule 45 permit ip source 10.83.226.0 0.0.0.255 rule 50 permit ip source 10.83.210.135 0 rule 55 permit ip source 10.83.211.91 0 rule 60 permit ip source 10.83.211.27 0 rule 65 permit ip source 10.83.210.137 0 rule 70 permit ip source 10.83.203.15 0 rule 75 permit ip source 10.83.207.20 0 rule 80 permit ip destination 117.78.31.118 0 rule 85 permit ip source 172.16.0.0 0.0.255.255 rule 90 deny ip source 10.83.201.101 0 rule 95 deny ip source 10.83.192.37 0 rule 105 permit ip destination 139.210.166.124 0 rule 110 deny ip source 192.168.255.12 0 rule 115 permit ip source 10.83.192.8 0 acl number 3002 description TO_Unicom rule 3 deny ip destination 139.210.166.124 0 rule 5 permit ip source 192.168.255.4 0 rule 10 permit ip source 192.168.255.5 0 rule 25 permit ip destination 202.98.0.68 0 rule 30 permit ip destination 202.98.5.68 0 rule 35 permit ip destination 202.98.1.11 0 rule 40 permit ip destination 222.161.22.0 0.0.0.7 rule 45 permit ip source 192.168.255.1 0 rule 50 permit ip source 192.168.255.8 0 rule 55 permit ip source 139.210.166.122 0 rule 60 permit ip source 192.168.255.7 0 rule 65 permit ip source 172.16.0.0 0.0.255.255 rule 70 permit ip source 172.16.22.50 0 rule 75 permit ip source 192.168.255.11 0 rule 85 permit ip source 10.83.201.101 0 rule 90 permit ip source 10.83.192.37 0 rule 91 permit ip destination 219.142.249.226 0 rule 95 permit ip destination 221.8.52.58 0 rule 100 permit ip source 222.161.22.2 0 rule 105 deny ip source 192.168.255.12 0 rule 110 permit ip destination 124.127.39.8 0 rule 115 deny ip destination 211.99.9.104 0 acl number 3003 description TO_Inside rule 0 permit ip destination 10.83.0.0 0.0.255.255 rule 5 permit ip destination 192.168.0.0 0.0.255.255 rule 10 permit ip destination 172.16.0.0 0.0.255.255 acl number 3004 rule 0 permit ip destination 192.168.253.2 0 acl number 3005 rule 0 permit ip source 10.83.204.0 0.0.0.255 acl number 3006 rule 0 permit ip source 60.247.78.130 0 rule 1 permit ip destination 60.247.78.130 0 acl number 3007 description Deny outside visit VPN 4430 51111 rule 0 deny tcp destination-port eq 4430 rule 1 deny tcp destination-port eq 51111 rule 5 permit ip acl number 3008 description ***.*** rule 0 permit ip destination 125.32.11.41 0 rule 65000 deny ip acl number 3010 description binding_server rule 2 deny ip destination 192.168.255.200 0 rule 3 deny ip source 192.168.255.200 0 rule 5 deny ip destination 10.0.0.0 0.255.255.255 rule 10 permit ip source 192.168.255.0 0.0.0.255 rule 15 permit ip source 10.83.192.0 0.0.7.255 acl number 3011 rule 0 permit ip destination 211.152.51.146 0 rule 5 permit ip destination 123.57.246.136 0 rule 7 permit ip destination 211.99.9.104 0 rule 10 permit ip destination 61.147.75.53 0 rule 11 permit ip destination 219.142.249.226 0 rule 15 permit ip destination 125.77.198.152 0 rule 17 permit ip destination 124.127.39.8 0 rule 20 deny ip acl number 3012 rule 0 permit ip source 192.168.255.12 0 rule 3 deny ip destination 2.0.1.0 0.0.0.255 rule 5 deny ip destination 10.83.0.0 0.0.255.255 rule 7 deny ip destination 211.99.9.104 0 rule 10 permit ip source 10.92.255.254 0 rule 15 permit ip destination 61.50.210.146 0 rule 20 permit ip destination 222.249.228.231 0 rule 25 permit ip destination 61.50.210.147 0 rule 30 permit ip destination 222.249.228.229 0 rule 35 permit ip destination 61.50.210.0 0.0.0.255 rule 40 permit ip destination 202.60.115.198 0 rule 45 permit ip destination 210.77.176.188 0 rule 50 permit ip destination 218.60.146.5 0 rule 65000 deny ip acl number 3088 rule 0 permit ip source 3.0.0.0 0.0.0.31 rule 5 permit ip destination 3.0.0.1 0.0.0.30 rule 25 deny ip acl number 3098 name aftv4v6 rule 0 permit ip source 192.168.255.200 0 rule 5 permit ip source 192.168.255.2 0 acl number 3107 description TO_Inbound_7 rule 0 permit ip destination 192.168.254.0 0.0.0.255 acl number 3108 description TO_Inbound_8 rule 0 permit ip destination 192.168.253.0 0.0.0.255 acl number 3109 description TO_Inbound_9 rule 10 permit ip destination 192.168.255.0 0.0.0.255 acl number 3110 rule 0 permit ip source 192.168.255.7 0 acl number 3120 rule 0 permit ip source 172.16.0.0 0.0.255.255 destination 10.83.192.8 0 rule 5 permit ip source 172.26.0.0 0.0.255.255 destination 10.83.192.8 0 acl number 3355 rule 0 permit ip source 172.16.22.50 0 acl number 3777 rule 5 permit ip destination 219.142.249.226 0 acl number 3888 rule 0 permit ip source 10.83.80.20 0 rule 5 permit ip source 10.83.226.27 0 rule 10 permit ip source 10.83.226.28 0 rule 15 permit ip source 10.83.226.29 0 acl number 3999 description DEBUG rule 0 permit ip source 192.168.255.200 0 rule 5 permit ip destination 192.168.255.200 0 # acl number 4001 # acl ipv6 number 3000 description ipv6safe rule 0 permit ipv6 destination 2408:8634:601:A1::/64 rule 5 permit ipv6 source 2408:8634:601:A0::/60 rule 10 permit ipv6 destination 2408:8634:601:AF::/64 rule 65534 deny ipv6 # acl accelerate number 3000 acl accelerate number 3001 acl accelerate number 3011 acl accelerate number 3777 # vlan 1 # vlan 2 # domain system access-limit disable state active idle-cut disable self-service-url disable # # pki domain default crl check disable # user-group system group-attribute allow-guest # local-user admin password cipher ... authorization-attribute level 3 service-type ssh service-type web # ssl server-policy 1 # interface NULL0 # interface LoopBack100 ip address 10.83.191.120 255.255.255.255 # interface Vlan-interface1 # interface Vlan-interface2 # interface GigabitEthernet0/0 port link-mode route 

#

 interface GigabitEthernet0/1 

 port link-mode route 

 description TO_Telecom

nat outbound 3120 address-group 5 

 nat outbound 3012 address-group 3 

 nat outbound 3008 address-group 1 

 nat outbound 3000 

 nat server protocol tcp global ... 

 ipv6 address 240E:712:10:9::2/64

 ip address ... 

 qos car inbound any cir 390000 cbs 19375000 ebs 0 green pass red discard 

 aft enable 

# interface GigabitEthernet0/2 

 port link-mode route 

 description TO_Unicom 

 nat outbound 3011 address-group 2 

 nat outbound 3000 

 nat server protocol tcp global ... 

 ipv6 address 2408:8634:600:A::3/127 

 ip address ...

 natpt enable

 # 

interface GigabitEthernet0/3 

 port link-mode route description TO_Inside 

 ipv6 address 2408:8634:1002::1/64 

 ipv6 address 2408:8634:1002:FF::1/64

 ipv6 address 240E:712:10:100::1/64

 ipv6 address 240E:712:10:1FF::1/64

 ip address 10.83.191.1 255.255.255.240 

 ospfv3 1 area 0.0.0.0

 natpt enable

 # interface GigabitEthernet0/4 port link-mode route ip address 10.92.255.1 255.255.255.0 # interface GigabitEthernet0/6 port link-mode route # interface GigabitEthernet0/7 port link-mode route # interface GigabitEthernet0/8 port link-mode route # interface GigabitEthernet0/9 port link-mode route # interface GigabitEthernet0/10 port link-mode route # interface GigabitEthernet0/11 port link-mode route # interface GigabitEthernet0/5 port link-mode bridge # interface Tunnel0 # ospf 1 router-id 10.83.191.1 default-route-advertise always area 0.0.0.0 network 10.83.191.1 0.0.0.0 # ospfv3 1 router-id 10.83.191.1 import-route static area 0.0.0.0 # vd Root id 1 # zone name Management id 0 priority 100 import interface GigabitEthernet0/3 import interface GigabitEthernet0/4 zone name Local id 1 priority 100 zone name Trust id 2 priority 85 zone name DMZ id 3 priority 50 zone name Untrust id 4 priority 5 import interface GigabitEthernet0/1 import interface GigabitEthernet0/2 switchto vd Root zone name Management id 0 ip virtual-reassembly zone name Local id 1 ip virtual-reassembly zone name Trust id 2 ip virtual-reassembly zone name DMZ id 3 ip virtual-reassembly zone name Untrust id 4 ip virtual-reassembly interzone source Untrust destination Local # ip route-static 0.0.0.0 0.0.0.0 222.168.33.161 ip route-static 10.0.7.0 255.255.255.0 10.92.255.254 ip route-static 10.0.8.0 255.255.248.0 10.92.255.254 ip route-static 10.0.15.0 255.255.255.0 10.92.255.254 ip route-static 10.0.15.87 255.255.255.255 10.92.255.254 ip route-static 10.0.15.91 255.255.255.255 10.92.255.254 ip route-static 10.0.16.0 255.255.254.0 10.92.255.254 ip route-static 10.0.18.18 255.255.255.255 10.92.255.254 ip route-static 10.0.20.0 255.255.255.0 10.92.255.254 ip route-static 10.1.0.0 255.255.0.0 10.92.255.254 ip route-static 10.4.0.0 255.255.255.128 10.92.255.254 ip route-static 10.4.1.0 255.255.255.0 10.92.255.254 ip route-static 10.5.0.0 255.255.255.128 10.92.255.254 ip route-static 10.5.1.0 255.255.255.0 10.92.255.254 ip route-static 10.10.0.0 255.255.255.0 10.92.255.254 ip route-static 10.10.1.0 255.255.255.0 10.92.255.254 ip route-static 10.30.0.0 255.255.0.0 10.92.255.254 ip route-static 10.30.40.0 255.255.255.0 10.92.255.254 ip route-static 10.30.41.0 255.255.255.0 10.92.255.254 ip route-static 10.94.255.0 255.255.255.0 10.92.255.254 ip route-static 60.247.78.130 255.255.255.255 222.161.22.1 # 

 ipv6 route-static :: 0 2408:8634:600:A::2 

 ipv6 route-static 2408:8634:601:A1:: 64 2408:8634:601:A0::9 

 ipv6 route-static 2408:8634:601:AF:: 64 2408:8634:601:A0::7 

# info-center loghost 10.83.80.16 # snmp-agent snmp-agent local-engineid 800063A20380F62ED3FC10 snmp-agent community write  snmp-agent community read  snmp-agent sys-info version all # ntp-service unicast-server 10.83.192.11 # ssh server enable ssh client authentication server 192.168.255.1 assign publickey 192.168.255.1 ssh client authentication server 10.83.191.3 assign publickey 10.83.191.3 # nat dns-map domain ... protocol tcp ip 139.210.166.124 port 443 # ip https acl 2000 ip https port 9998 ip https enable # load xml-configuration # user-interface con 0 user-interface vty 0 4 acl 3888 inbound authentication-mode scheme protocol inbound ssh # return