组网如下:
FW的g1/0/1属于vpn1,对接ipv6网络,FW的g1/0/2属于vpn2,对接ipv6网络
需求是实现MSR1通过20.1.1.1访问MSR2的IPV6地址240C:0:FF14:101:100::
为IPV6网络分配一个IVI前缀(240c::)和ipv4网段(20.1.1.0/24),IPv6网络中所有IPv6主机的地址均配置为由IVI前缀和IPv4网段中地址组合而成的IPv6地址
为IPv4网络分配一个NAT64前缀(2012::),IPv4网络主动访问IPv6网络时,IPv4源地址使用NAT64前缀转换为IPv6地址;IPv6网络主动访问IPv4网络时,目的地址使用NAT64前缀和IPv4地址组合成的IPv6地址。
MSR1的配置如下:
接口起IP地址
interface GigabitEthernet0/0
port link-mode route
combo enable copper
ip address 172.168.100.1 255.255.255.0
FW的配置如下:
ip vpn-instance vpn1
ip vpn-instance vpn2
配置IPV6到IPV4的目的地址转换
aft prefix-nat64 2012:: 96
acl basic 2000
rule 0 permit vpn-instance vpn1
配置IVI前缀,在IPv4到IPv6动态目的地址转换策略中引用该前缀
aft prefix-ivi 240C::
aft v4tov6 destination acl number 2000 prefix-ivi 240C:: vpn-instance vpn2
接口配置VPN实例,起IP地址,配置AFT
interface GigabitEthernet1/0/1
port link-mode route
combo enable copper
ip binding vpn-instance vpn1
ip address 172.168.100.2 255.255.255.0
aft enable
interface GigabitEthernet1/0/2
port link-mode route
combo enable copper
ip binding vpn-instance vpn2
aft enable
ipv6 address 240C:0:FF14:101:200::/64
MSR2配置
interface GigabitEthernet0/0
port link-mode route
combo enable copper
ipv6 address 240C:0:FF14:101:100::/64
ipv6 route-static 240C:0:FF14:101::ACA8:6401 128 240C:0:FF14:101:200::
需要说明的是,PC的地址是由IVI前缀+IPV4地址+全0的suffix固定,其中IVI配好之后,IVI与suffix固定,只需要将IPV4的32位2进制转换为
8位16进制,然后放到其中即可。例如将20.1.1.1通过IVI前缀转换为IPV6地址,20对应14;1对应01 ;204c:0:ff与最后的::不变,将14 01 01 01放入对应的位置即可
204c:0:ff14:0101:100::
interface GigabitEthernet8/0
port link-mode route
aft enable
ipv6 address 240C:0:FF14:101:200::/64
配置完成之后,MSR1可以通过20.1.1.1访问MSR2的240C:0:FF14:101:100::
<RT1>ping 20.1.1.1
Ping 20.1.1.1 (20.1.1.1): 56 data bytes, press CTRL+C to break
56 bytes from 20.1.1.1: icmp_seq=0 ttl=63 time=0.734 ms
56 bytes from 20.1.1.1: icmp_seq=1 ttl=63 time=0.646 ms
56 bytes from 20.1.1.1: icmp_seq=2 ttl=63 time=0.571 ms
56 bytes from 20.1.1.1: icmp_seq=3 ttl=63 time=0.504 ms
56 bytes from 20.1.1.1: icmp_seq=4 ttl=63 time=0.711 ms
FW的AFT会话如下
[FW]display aft session ipv4 verbose
Slot 1:
Initiator:
Source IP/port: 172.168.100.1/10964
Destination IP/port: 20.1.1.1/2048
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: vpn1/-/-
Protocol: ICMP(1)
Inbound interface: GigabitEthernet1/0/1
Source security zone: Trust
Responder:
Source IP/port: 20.1.1.1/10964
Destination IP/port: 172.168.100.1/0
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: vpn2/-/-
Protocol: ICMP(1)
Inbound interface: GigabitEthernet1/0/2
Source security zone: Local
State: ICMP_REPLY
Application: ICMP
Rule ID: -/-/-
Rule name:
Start time: 2024-01-19 13:47:48 TTL: 22s
Initiator->Responder: 5 packets 420 bytes
Responder->Initiator: 5 packets 420 bytes
Total sessions found: 1
[FW]display aft session ipv6 v
[FW]display aft session ipv6 verbose
Slot 1:
Initiator:
Source IP/port: 2012::ACA8:6401/10964
Destination IP/port: 240C:0:FF14:101:100::/32768
VPN instance/VLAN ID/Inline ID: vpn1/-/-
Protocol: IPV6-ICMP(58)
Inbound interface: GigabitEthernet1/0/1
Source security zone: Local
Responder:
Source IP/port: 240C:0:FF14:101:100::/10964
Destination IP/port: 2012::ACA8:6401/33024
VPN instance/VLAN ID/Inline ID: vpn2/-/-
Protocol: IPV6-ICMP(58)
Inbound interface: GigabitEthernet1/0/2
Source security zone: Untrust
State: ICMPV6_REPLY
Application: ICMP
Rule ID: 2
Rule name: 2
Start time: 2024-01-19 13:47:48 TTL: 17s
Initiator->Responder: 5 packets 520 bytes
Responder->Initiator: 5 packets 520 bytes
Total sessions found: 1
[FW]
配置关键点:
配置IPV6到IPV4的目的地址转换
aft prefix-nat64 2012:: 96
acl basic 2000
rule 0 permit vpn-instance vpn1
配置IVI前缀,在IPv4到IPv6动态目的地址转换策略中引用该前缀
aft prefix-ivi 240C::
aft v4tov6 destination acl number 2000 prefix-ivi 240C:: vpn-instance vpn2
该案例暂时没有网友评论
✖
案例意见反馈
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作