ComwareV7 FW带VPN实例的AFT典型配置（V4访问V6）

组网如下：

FW的g1/0/1属于vpn1，对接ipv6网络，FW的g1/0/2属于vpn2,对接ipv6网络

需求是实现MSR1通过20.1.1.1访问MSR2的IPV6地址240C:0:FF14:101:100::

为IPV6网络分配一个IVI前缀（240c::）和ipv4网段(20.1.1.0/24),IPv6网络中所有IPv6主机的地址均配置为由IVI前缀和IPv4网段中地址组合而成的IPv6地址

为IPv4网络分配一个NAT64前缀（2012：：），IPv4网络主动访问IPv6网络时，IPv4源地址使用NAT64前缀转换为IPv6地址；IPv6网络主动访问IPv4网络时，目的地址使用NAT64前缀和IPv4地址组合成的IPv6地址。

MSR1的配置如下：

接口起IP地址

interface GigabitEthernet0/0

 port link-mode route

 combo enable copper

 ip address 172.168.100.1 255.255.255.0

FW的配置如下：

ip vpn-instance vpn1

ip vpn-instance vpn2

配置IPV6到IPV4的目的地址转换

aft prefix-nat64 2012:: 96

acl basic 2000

 rule 0 permit vpn-instance vpn1

配置IVI前缀，在IPv4到IPv6动态目的地址转换策略中引用该前缀

aft prefix-ivi 240C::

aft v4tov6 destination acl number 2000 prefix-ivi 240C:: vpn-instance vpn2

接口配置VPN实例，起IP地址，配置AFT

interface GigabitEthernet1/0/1

 port link-mode route

 combo enable copper

 ip binding vpn-instance vpn1

 ip address 172.168.100.2 255.255.255.0

 aft enable

interface GigabitEthernet1/0/2

 port link-mode route

 combo enable copper

 ip binding vpn-instance vpn2

 aft enable

 ipv6 address 240C:0:FF14:101:200::/64

MSR2配置

interface GigabitEthernet0/0

 port link-mode route

 combo enable copper

 ipv6 address 240C:0:FF14:101:100::/64

ipv6 route-static 240C:0:FF14:101::ACA8:6401 128 240C:0:FF14:101:200::

需要说明的是，PC的地址是由IVI前缀+IPV4地址+全0的suffix固定，其中IVI配好之后，IVI与suffix固定，只需要将IPV4的32位2进制转换为

8位16进制，然后放到其中即可。例如将20.1.1.1通过IVI前缀转换为IPV6地址，20对应14；1对应01 ；204c:0:ff与最后的::不变，将14 01 01 01放入对应的位置即可

204c:0:ff14:0101:100::

interface GigabitEthernet8/0

 port link-mode route

 aft enable

 ipv6 address 240C:0:FF14:101:200::/64

配置完成之后，MSR1可以通过20.1.1.1访问MSR2的240C:0:FF14:101:100::

<RT1>ping 20.1.1.1

Ping 20.1.1.1 (20.1.1.1): 56 data bytes, press CTRL+C to break

56 bytes from 20.1.1.1: icmp_seq=0 ttl=63 time=0.734 ms

56 bytes from 20.1.1.1: icmp_seq=1 ttl=63 time=0.646 ms

56 bytes from 20.1.1.1: icmp_seq=2 ttl=63 time=0.571 ms

56 bytes from 20.1.1.1: icmp_seq=3 ttl=63 time=0.504 ms

56 bytes from 20.1.1.1: icmp_seq=4 ttl=63 time=0.711 ms

FW的AFT会话如下

[FW]display  aft  session  ipv4 verbose

Slot 1:

Initiator:

  Source      IP/port: 172.168.100.1/10964

  Destination IP/port: 20.1.1.1/2048

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: vpn1/-/-

  Protocol: ICMP(1)

  Inbound interface: GigabitEthernet1/0/1

  Source security zone: Trust

Responder:

  Source      IP/port: 20.1.1.1/10964

  Destination IP/port: 172.168.100.1/0

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: vpn2/-/-

  Protocol: ICMP(1)

  Inbound interface: GigabitEthernet1/0/2

  Source security zone: Local

State: ICMP_REPLY

Application: ICMP

Rule ID: -/-/-

Rule name:

Start time: 2024-01-19 13:47:48  TTL: 22s

Initiator->Responder:            5 packets        420 bytes

Responder->Initiator:            5 packets        420 bytes

Total sessions found: 1

[FW]display  aft  session  ipv6 v

[FW]display  aft  session  ipv6 verbose

Slot 1:

Initiator:

  Source      IP/port: 2012::ACA8:6401/10964

  Destination IP/port: 240C:0:FF14:101:100::/32768

  VPN instance/VLAN ID/Inline ID: vpn1/-/-

  Protocol: IPV6-ICMP(58)

  Inbound interface: GigabitEthernet1/0/1

  Source security zone: Local

Responder:

  Source      IP/port: 240C:0:FF14:101:100::/10964

  Destination IP/port: 2012::ACA8:6401/33024

  VPN instance/VLAN ID/Inline ID: vpn2/-/-

  Protocol: IPV6-ICMP(58)

  Inbound interface: GigabitEthernet1/0/2

  Source security zone: Untrust

State: ICMPV6_REPLY

Application: ICMP

Rule ID: 2

Rule name: 2

Start time: 2024-01-19 13:47:48  TTL: 17s

Initiator->Responder:            5 packets        520 bytes

Responder->Initiator:            5 packets        520 bytes

Total sessions found: 1

[FW]

配置关键点：

配置IPV6到IPV4的目的地址转换

aft prefix-nat64 2012:: 96

acl basic 2000

 rule 0 permit vpn-instance vpn1

配置IVI前缀，在IPv4到IPv6动态目的地址转换策略中引用该前缀

aft prefix-ivi 240C::

aft v4tov6 destination acl number 2000 prefix-ivi 240C:: vpn-instance vpn2