组网如下:
FW的g1/0/1属于vpn1,对接ipv6网络,FW的g1/0/2属于vpn2,对接ipv6网络
需求是:MSR通过访问2012:172.168.100.1,通过FW的AFT转换到V4侧,源地址转换为172.168.100.3,目的地址转换为172.168.100.1
MSR1的配置如下:
接口起IP地址
interface GigabitEthernet0/0
port link-mode route
combo enable copper
ip address 172.168.100.1 255.255.255.0
FW的配置如下:
ip vpn-instance vpn1
ip vpn-instance vpn2
配置IPV6到IPV4的目的地址转换
aft prefix-nat64 2012:: 96
配置IPV6到IPV4源地址转换地址池
aft address-group 1
address 172.168.100.3 172.168.100.3
配置IPV6到IPV4源地址转换
aft v6tov4 source prefix-nat64 2012:: 96 vpn-instance vpn2 address-group 1 vpn-instance vpn1
接口配置VPN实例,起IP地址,配置AFT
interface GigabitEthernet1/0/1
port link-mode route
combo enable copper
ip binding vpn-instance vpn1
ip address 172.168.100.2 255.255.255.0
aft enable
interface GigabitEthernet1/0/2
port link-mode route
combo enable copper
ip binding vpn-instance vpn2
aft enable
ipv6 address 240C::1400:2/96
MSR2的配置
interface GigabitEthernet0/0
port link-mode route
combo enable copper
ipv6 address 240C::1400:1/96
路由
ipv6 route-static 2012:: 96 240C::1400:2
配置完成之后,MSR2可以通过2012::172.178.100.1访问MSR1的172.168.100.1
FW的AFT会话如下
[FW]display aft session ipv4 verbose
Slot 1:
Total sessions found: 0
[FW]display aft session ipv4 verbose
Slot 1:
Initiator:
Source IP/port: 172.168.100.3/2
Destination IP/port: 172.168.100.1/2048
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: vpn2/-/-
Protocol: ICMP(1)
Inbound interface: GigabitEthernet1/0/2
Source security zone: Local
Responder:
Source IP/port: 172.168.100.1/2
Destination IP/port: 172.168.100.3/0
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: vpn1/-/-
Protocol: ICMP(1)
Inbound interface: GigabitEthernet1/0/1
Source security zone: Trust
State: ICMP_REPLY
Application: ICMP
Rule ID: 1
Rule name: 1
Start time: 2024-01-19 12:49:23 TTL: 28s
Initiator->Responder: 5 packets 420 bytes
Responder->Initiator: 5 packets 420 bytes [FW]
[FW]
[FW]display aft session ipv6 v
[FW]display aft session ipv6 verbose
Slot 1:
Initiator:
Source IP/port: 240C::1400:1/10975
Destination IP/port: 2012::ACA8:6401/32768
VPN instance/VLAN ID/Inline ID: vpn2/-/-
Protocol: IPV6-ICMP(58)
Inbound interface: GigabitEthernet1/0/2
Source security zone: Untrust
Responder:
Source IP/port: 2012::ACA8:6401/10975
Destination IP/port: 240C::1400:1/33024
VPN instance/VLAN ID/Inline ID: vpn1/-/-
Protocol: IPV6-ICMP(58)
Inbound interface: GigabitEthernet1/0/1
Source security zone: Local
State: ICMPV6_REPLY
Application: ICMP
Rule ID: -/-/-
Rule name:
Start time: 2024-01-19 12:45:16 TTL: 14s
Initiator->Responder: 5 packets 520 bytes
Responder->Initiator: 5 packets 520 bytes
Total sessions found: 1
配置关键点:
配置IPV6到IPV4的目的地址转换
aft prefix-nat64 2012:: 96
配置IPV6到IPV4源地址转换地址池
aft address-group 1
address 172.168.100.3 172.168.100.3
配置IPV6到IPV4源地址转换
aft v6tov4 source prefix-nat64 2012:: 96 vpn-instance vpn2 address-group 1 vpn-instance vpn1
该案例暂时没有网友评论
✖
案例意见反馈
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作