SR88配置AFT ipv6大包不通

如图：

SR88作为AFT设备，下行RT1配置ipv6 2019::1网段地址，上行RT2侧为XX.33.1.Y网段ipv4地址。目前客户实现需求是在SR88上做静态AFT映射，将下行V6地址转换为一个XX.64.128.1的网段v4地址，并在SR88上配置对应的loop地址，由v4侧访问此XX.64.128.1地址来映射到v6侧，实现V4 V6互访。

所有路由已全部打通，会发现存在V4侧ping 访问V6侧大于1452报文不通的问题。

首先，简单看下AFT设备上的相关配置。

aft prefix-nat64 2012:: 96

aft prefix-ivi 2019::

aft v6tov4 source 2019::1 XX.64.128.1

aft v4tov6 destination acl number 3100 prefix-ivi 2019::

#

acl advanced 3100

 rule 1 permit ip destination XX.64.128.0 0.0.0.255

 rule 1000 deny ip

这个配置在实验室本地复现是可以实现正常映射关系的，也就AFT部分配置是没有问题的。接口MTU均为默认1500，未变更过。

在V4侧ping大于1452报文（大小大约为1500）问题复现的同时，打开设备上的debug ip packet信息整理如下：

d*Aug 21 13:24:22:377 2022 SR88-AFT IPFW/7/IPFW_PACKET: -MDC=1-Slot=3;

Receiving, interface = Route-Aggregation1----------------------------------------------------------------------上行聚合口1收到RT2访问目的地址为128.1的报文，大小为1500

version = 4, headlen = 20, tos = 0

pktlen = 1500, pktid = 13089, offset = 0, ttl = 62, protocol = 1

checksum = 7183, s = XX.33.1.Y, d = XX.64.128.1

channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.

prompt: Receiving IP packet from interface Route-Aggregation1.

Payload: ICMP

  type = 8, code = 0, checksum = 0x3496.

*Aug 21 13:24:22:378 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

LocalSending, version = 6, traffic class = 0,

flow label = 0, payload length = 1240, protocol = 44, hop limit = 61,--------------------------------------------------分片后，转换为V6的目的地址2019::1

Src = 2012::4321:18f, Dst = 2019::1,

prompt: Output an IPv6 Packet.

*Aug 21 13:24:22:378 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

LocalSending, version = 6, traffic class = 0,

flow label = 0, payload length = 256, protocol = 44, hop limit = 61,

Src = 2012::4321:18f, Dst = 2019::1,------另一个分片转换为V6源目地址。

prompt: Output an IPv6 Packet.

*Aug 21 13:24:22:378 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

Sending, interface = Route-Aggregation2, version = 6, traffic class = 0,----------------------------------------------从下行聚合口2发给RT1设备

flow label = 0, payload length = 1240, protocol = 44, hop limit = 61,

Src = 2012::4321:18f, Dst = 2019::1,

prompt: Sending the packet from local interface Route-Aggregation2.

*Aug 21 13:24:22:378 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

LocalSending, version = 6, traffic class = 0,

flow label = 0, payload length = 256, protocol = 44, hop limit = 61,----------------------------------------------同上，第二个分片报文大小为256

Src = 2012::4321:18f, Dst = 2019::1,

prompt: Output an IPv6 Packet.

*Aug 21 13:24:22:378 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

Sending, interface = Route-Aggregation2, version = 6, traffic class = 0,

flow label = 0, payload length = 256, protocol = 44, hop limit = 61,

Src = 2012::4321:18f, Dst = 2019::1,

prompt: Sending the packet from local interface Route-Aggregation2.

*Aug 21 13:24:49:880 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

Receiving, interface = Route-Aggregation2, version = 6, traffic class = 0,------------------------------------收到回程v6报文

flow label = 0, payload length = 1456, protocol = 44, hop limit = 64,

Src = 2019::1, Dst = 2012::4321:18f,

prompt: Received an IPv6 packet.

*Aug 21 13:24:49:880 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

Sending, interface = NULL0, version = 6, traffic class = 0,

flow label = 0, payload length = 1456, protocol = 44, hop limit = 63,

Src = 2019::1, Dst = 2012::4321:18f,

prompt: Sending the packet from Route-Aggregation2 through NULL0.

*Aug 21 13:24:49:880 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

Receiving, interface = Route-Aggregation2, version = 6, traffic class = 0,

flow label = 0, payload length = 68, protocol = 44, hop limit = 64,----------------------------------------------------后面就一直没有转回v4

Src = 2019::1, Dst = 2012::4321:18f,

prompt: Received an IPv6 packet.

*Aug 21 13:24:49:881 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

Sending, interface = NULL0, version = 6, traffic class = 0,

flow label = 0, payload length = 68, protocol = 44, hop limit = 63,

Src = 2019::1, Dst = 2012::4321:18f,

prompt: Sending the packet from Route-Aggregation2 through NULL0.

因为下行RT1以及SR88接口mtu均为默认值，转发V4报文变为V6后，报文长度变长，SR88转发出去已分为两个分片报文。RT1再次发回来后仍为两个分片报文，而目前设备机制不支持对ipv6分片报文进行AFT转换，导致了报文无法正确转换回ipv4报文发回RT2。

因此产生了ping大包会不通的现象，该问题可以暂时通过将SR88 V6侧以及RT1对接接口mtu值调大，来暂时规避。后续平台会有相应策略优化。