CLI方式：IPv4网络和IPv6网络互访典型配置

使用版本

本举例是在F1090的R8660P33版本上进行配置和验证的。

组网需求

如下图所示，某公司内部同时部署了IPv4网络和IPv6网络，并且希望IPv4网络和IPv6网络能够互相访问。

为满足上述需求，本例中使用如下方式实现：

图-1 IPv4网络和IPv6网络互访配置组网图

‌

配置步骤

  1. 配置接口IP地址

# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。

<Device> system-view

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] ip address 20.1.1.1 24

[Device-GigabitEthernet1/0/1] quit

请参考以上步骤配置其他接口的IP地址，具体配置步骤略。

  1. 将接口加入安全域

# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。

[Device] security-zone name trust

[Device-security-zone-Trust] import interface gigabitethernet 1/0/1

[Device-security-zone-Trust] import interface gigabitethernet 1/0/2

[Device-security-zone-Trust] quit

  1. 配置静态路由

本举例仅以静态路由方式配置路由信息。实际组网中，请根据具体情况选择相应的路由配置方式。

# 请根据组网图中规划的信息，配置静态路由，本举例假设到达IPv6  Host所在网络的下一跳IPv6地址为2014::100，到达IPv4 Host所在网络的下一跳IP地址为20.1.1.2，实际使用中请以具体组网情况为准，具体配置步骤如下。

[Device] ipv6 route-static 2013:: 32 2014::100

[Device] ip route-static 10.1.1.0 24 20.1.1.2

  1. 配置安全策略

  1. 配置安全策略放行IPv4 Host访问IPv6 Host的流量。

# 配置名称为aftlocalin4的安全策略，使Device能对IPv4 Host访问IPv6 Host的报文进行AFT转换，具体配置步骤如下。

[Device] security-policy ip

[Device-security-policy-ip] rule name aftlocalin4

[Device-security-policy-ip-1-aftlocalin4] source-zone trust

[Device-security-policy-ip-1-aftlocalin4] destination-zone local

[Device-security-policy-ip-1-aftlocalin4] source-ip-subnet 10.1.1.0 24

[Device-security-policy-ip-1-aftlocalin4] destination-ip-subnet 20.1.1.0 24

[Device-security-policy-ip-1-aftlocalin4] action pass

[Device-security-policy-ip-1-aftlocalin4] quit

[Device-security-policy-ip] quit

# 配置名称为aftlocalout6的安全策略，允许将AFT转换后的报文转发至IPv6 Host，具体配置步骤如下。

[Device] security-policy ipv6

[Device-security-policy-ipv6] rule name aftlocalout6

[Device-security-policy-ipv6-1-aftlocalout6] source-zone local

[Device-security-policy-ipv6-1-aftlocalout6] destination-zone trust

[Device-security-policy-ipv6-1-aftlocalout6] source-ip-subnet 2012:: 96

[Device-security-policy-ipv6-1-aftlocalout6] destination-ip-subnet 2013:: 32

[Device-security-policy-ipv6-1-aftlocalout6] action pass

[Device-security-policy-ipv6-1-local-ipv6] quit

  1. 配置安全策略放行IPv6 Host访问IPv4 Host的流量。

# 配置名称为aftlocalin6的安全策略，使Device能对IPv6 Host访问IPv4 Host的报文进行AFT转换，具体配置步骤如下。

[Device-security-policy-ipv6] rule name aftlocalin6

[Device-security-policy-ipv6-2-aftlocalin6] source-zone trust

[Device-security-policy-ipv6-2-aftlocalin6] destination-zone local

[Device-security-policy-ipv6-2-aftlocalin6] source-ip-subnet 2013:: 32

[Device-security-policy-ipv6-2-aftlocalin6] destination-ip-subnet 2012:: 96

[Device-security-policy-ipv6-2-aftlocalin6] action pass

[Device-security-policy-ipv6-2-aftlocalin6] quit

[Device-security-policy-ipv6] quit

# 配置名称为aftlocalout4的安全策略，允许将AFT转换后的报文转发至IPv4 Host，具体配置步骤如下。

[Device] security-policy ip

[Device-security-policy-ip] rule 2 name aftlocalout4

[Device-security-policy-ip-2-aftlocalout4] source-zone local

[Device-security-policy-ip-2-aftlocalout4] destination-zone trust

[Device-security-policy-ip-2-aftlocalout4] source-ip-subnet 20.1.1.0 24

[Device-security-policy-ip-2-aftlocalout4] destination-ip-subnet 10.1.1.0 24

[Device-security-policy-ip-2-aftlocalout4] action pass

[Device-security-policy-ip-2-aftlocalout4] quit

[Device-security-policy-ip] quit

  1. 配置AFT功能

# 配置ACL 2000用来过滤需要访问IPv6网络的用户，同时匹配该ACL 2000的报文的目的地址将会根据配置的IVI前缀转换为IPv6地址。此处所有IPv4网络用户均需要访问IPv6网络。

[Device] acl basic 2000

[Device-acl-ipv4-basic-2000] rule permit

[Device-acl-ipv4-basic-2000] quit

# 配置NAT64前缀，用于进行IPv4到IPv6的源地址转换和IPv6到IPv4的目的地址转换。

[Device] aft prefix-nat64 2012:: 96

# 配置IVI前缀，用于进行IPv6到IPv4源地址转换，且在IPv4到IPv6动态目的地址转换策略中引用该前缀。

[Device] aft prefix-ivi 2013::

# 配置IPv4到IPv6动态目的地址转换策略，IPv4到IPv6报文的目的IPv4地址转换为IPv6地址。

[Device] aft v4tov6 destination acl number 2000 prefix-ivi 2013::

# 在设备IPv4侧和IPv6侧接口开启AFT。

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] aft enable

[Device-GigabitEthernet1/0/1] quit

[Device] interface gigabitethernet 1/0/2

[Device-GigabitEthernet1/0/2] aft enable

[Device-GigabitEthernet1/0/2] quit

验证配置

# 以上配置完成后，IPv4 host与IPv6 host可以互通。以IPv6 host A ping IPv4 host A为例：

D:\>ping 2012::a01:0101

Pinging 2012::a01:0101 with 32 bytes of data:

Reply from 2012::a01:0101: time=3ms

Reply from 2012::a01:0101: time=3ms

Reply from 2012::a01:0101: time=3ms

Reply from 2012::a01:0101: time=3ms

# 通过查看AFT会话，可以看到创建了一个IPv6会话和IPv4会话，分别对应转换前和转换后的报文。显示内容如下：

[Device] display aft session ipv6 verbose

Initiator:

  Source      IP/port: 2013:0:FF14:0101:0100::/0

  Destination IP/port: 2012::0a01:0101/32768

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: IPV6-ICMP(58)

  Inbound interface: GigabitEthernet1/0/2

  Source security zone: Trust

Responder:

  Source      IP/port: 2012::0a01:0101/0

  Destination IP/port: 2013:0:FF14:0101:0100::/33024

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: IPV6-ICMP(58)

  Inbound interface: GigabitEthernet1/0/1

  Source security zone: Local

State: ICMPV6_REPLY

Application: ICMP

Rule ID: -/-/-

Rule name:

Start time: 2014-03-13 08:52:59  TTL: 23s

Initiator->Responder:            4 packets        320 bytes

Responder->Initiator:            4 packets        320 bytes

 

Total sessions found: 1

 

[Device] display aft session ipv4 verbose

Initiator:

  Source      IP/port: 20.1.1.1/1025

  Destination IP/port: 10.1.1.1/2048

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: ICMP(1)

  Inbound interface: GigabitEthernet1/0/2

  Source security zone: Local

Responder:

  Source      IP/port: 10.1.1.1/1025

  Destination IP/port: 20.1.1.1/0

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: ICMP(1)

  Inbound interface: GigabitEthernet1/0/1

  Source security zone: Trust

State: ICMP_REPLY

Application: ICMP

Rule ID: 2

Rule name: aftlocalout4

Start time: 2014-03-13 08:52:59  TTL: 27s

Initiator->Responder:            4 packets        240 bytes

Responder->Initiator:            4 packets        240 bytes

 

Total sessions found: 1

配置文件

#

interface GigabitEthernet1/0/1

 ip address 20.1.1.1 255.255.255.0

 aft enable

#

interface GigabitEthernet1/0/2

 aft enable

 ipv6 address 2014::1/96

#

security-zone name Trust

 import interface GigabitEthernet1/0/1

 import interface GigabitEthernet1/0/2

#

 ip route-static 10.1.1.0 24 20.1.1.2

 ipv6 route-static 2013:: 32 2014::100

#

acl basic 2000

 rule 0 permit

#

 aft prefix-nat64 2012:: 96

 aft prefix-ivi 2013::

 aft v4tov6 destination acl number 2000 prefix-ivi 2013::

#

security-policy ip

 rule 0 name aftlocalin4

  action pass

  source-zone trust

  destination-zone local

  source-ip-subnet 10.1.1.0 255.255.255.0

  destination-ip-subnet 20.1.1.0 255.255.255.0

 rule 2 name aftlocalout4

  action pass

  source-zone local

  destination-zone trust

  source-ip-subnet 20.1.1.0 255.255.255.0

  destination-ip-subnet 10.1.1.0 255.255.255.0

#

security-policy ipv6

 rule 0 name aftlocalout6

  action pass

  source-zone local

  destination-zone trust

  source-ip-subnet 2012::/96

  destination-ip-subnet 2013::/32

 rule 1 name aftlocalin6

  action pass

  source-zone trust

  destination-zone local

  source-ip-subnet 2013::/32

  destination-ip-subnet 2012::/96

#