防火墙nat64问题

1.20.2  IPv4 Internet访问IPv6网络内部服务器配置举例

1. 组网需求

某公司将网络升级到了IPv6，此时Internet仍然是IPv4网络。该公司希望内部的FTP服务器能够继续为IPv4 Internet的用户提供服务。该公司拥有的IPv4地址为10.1.1.1。

为满足上述要求，本例实现方式如下：

·     使用IPv6侧服务器配置将IPv6内部服务器的地址及端口映射为IPv4地址及端口，Device收到来自IPv4 Internet的报文后，根据该配置策略将报文IPv4目的地址转换为IPv6地址；

·     使用NAT64前缀将报文源IPv4地址转换为IPv6地址。

2. 组网图

图1-8 IPv4 Internet访问IPv6网络内部服务器配置组网图

‌

表1-4 组网图示例接口与设备实际接口对应关系

3. 配置步骤

(1)     配置接口IP地址

# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。

<Device> system-view

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] ip address 10.1.1.2 24

[Device-GigabitEthernet1/0/1] quit

[Device] interface gigabitethernet 1/0/2

[Device-GigabitEthernet1/0/2] ip address 2013::101 96

[Device-GigabitEthernet1/0/2] quit

(2)     将接口加入安全域

# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。

[Device] security-zone name trust

[Device-security-zone-Trust] import interface gigabitethernet 1/0/2

[Device-security-zone-Trust] quit

[Device] security-zone name untrust

[Device-security-zone-Untrust] import interface gigabitethernet 1/0/1

[Device-security-zone-Untrust] quit

(3)     配置安全策略

# 配置名称为aftlocalin的安全策略，使Device能对Host访问Server的报文进行AFT转换，具体配置步骤如下。

[Device] security-policy ip

[Device-security-policy-ip] rule name aftlocalin

[Device-security-policy-ip-1-aftlocalin] source-zone untrust

[Device-security-policy-ip-1-aftlocalin] destination-zone local

[Device-security-policy-ip-1-aftlocalin] destination-ip-host 10.1.1.1

[Device-security-policy-ip-1-aftlocalin] action pass

[Device-security-policy-ip-1-aftlocalin] quit

[Device-security-policy-ip] quit

# 配置名称为aftlocalout的安全策略，允许将AFT转换后的报文转发至Server，具体配置步骤如下。

[Device] security-policy ipv6

[Device-security-policy-ipv6] rule name aftlocalout

[Device-security-policy-ipv6-1-aftlocalout] source-zone local

[Device-security-policy-ipv6-1-aftlocalout] destination-zone trust

[Device-security-policy-ipv6-1-aftlocalout] source-ip-subnet 2012:: 96

[Device-security-policy-ipv6-1-aftlocalout] destination-ip-host 2013::102

[Device-security-policy-ipv6-1-aftlocalout] action pass

[Device-security-policy-ipv6-1-aftlocalout] quit

[Device-security-policy-ipv6] quit

# 配置名称为trust-untrust的安全策略，允许将后续报文转发至Server，具体配置步骤如下。

[Device] security-policy ipv6

[Device-security-policy-ipv6] rule name trust-untrust

[Device-security-policy-ipv6-2-trust-untrust] source-zone untrust

[Device-security-policy-ipv6-2-trust-untrust] destination-zone trust

[Device-security-policy-ipv6-2-trust-untrust] source-ip-subnet 2012:: 96

[Device-security-policy-ipv6-2-trust-untrust] destination-ip-host 2013::102

[Device-security-policy-ipv6-2-trust-untrust] action pass

[Device-security-policy-ipv6-2-trust-untrust] quit

[Device-security-policy-ipv6] quit

(4)     配置AFT功能

# 配置IPv6侧服务器对应的IPv4地址及端口号。IPv4网络内用户通过访问该IPv4地址及端口即可访问IPv6服务器。

[Device] aft v6server protocol tcp 10.1.1.1 21 2013::102 21

# 报文的源地址将根据配置的NAT64前缀转换为IPv6地址。

[Device] aft prefix-nat64 2012:: 96

# 在设备IPv4侧和IPv6侧接口开启AFT。

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] aft enable

[Device-GigabitEthernet1/0/1] quit

[Device] interface gigabitethernet 1/0/2

[Device-GigabitEthernet1/0/2] aft enable

[Device-GigabitEthernet1/0/2] quit