本举例是在M9000-AI-E8的R9071版本上进行配置和验证的。
如下图所示，某公司将网络升级到了IPv6，但是仍然希望内网2013::/96网段的用户可以访问IPv4 Internet，其它网段的用户不能访问IPv4 Internet。该公司访问IPv4 Internet使用的IPv4地址为10.1.1.1、10.1.1.2和10.1.1.3。
为满足上述需求，本例中实现方式如下：
使用NAT64前缀与IPv4网络中的主机地址组合成为IPv6地址，此IPv6地址将与IPv4 Internet内的主机建立相应的映射关系，IPv6网络中的主机访问该IPv6地址即可实现对IPv4 Internet的访问。报文到达Device后，设备将根据NAT64前缀将该目的IPv6地址转换为对应的IPv4地址。
使用IPv6到IPv4源地址动态转换策略将IPv6网络到IPv4网络报文的源地址转换为IPv4地址10.1.1.1、10.1.1.2或10.1.1.3。
图-1 IPv6网络访问IPv4 Internet配置组网图
配置接口IP地址
# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。
<Device> system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] ipv6 address 2013::1 96
[Device-GigabitEthernet1/0/1] quit
请参考以上步骤配置其他接口的IP地址，具体配置步骤略。
将接口加入安全域
# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。
[Device] security-zone name trust
[Device-security-zone-Trust] import interface gigabitethernet 1/0/1
[Device-security-zone-Trust] quit
[Device] security-zone name untrust
[Device-security-zone-Untrust] import interface gigabitethernet 1/0/2
[Device-security-zone-Untrust] quit
配置静态路由
本举例仅以静态路由方式配置路由信息。实际组网中，请根据具体情况选择相应的路由配置方式。
# 请根据组网图中规划的信息，配置静态路由，本举例假设到达Server所在网络的下一跳IP地址为10.1.1.100，实际使用中请以具体组网情况为准，具体配置步骤如下。
[Device] ip route-static 20.1.1.0 24 10.1.1.100
配置安全策略
# 配置名称为aftlocalin的安全策略，使Device能对Host访问Server的报文进行AFT转换，具体配置步骤如下。
[Device] security-policy ipv6
[Device-security-policy-ipv6] rule name aftlocalin
[Device-security-policy-ipv6-1-aftlocalin] source-zone trust
[Device-security-policy-ipv6-1-aftlocalin] destination-zone local
[Device-security-policy-ipv6-1-aftlocalin] source-ip-subnet 2013:: 96
[Device-security-policy-ipv6-1-aftlocalin] destination-ip-host 2012::20.1.1.1
[Device-security-policy-ipv6-1-aftlocalin] destination-ip-host 2012::20.1.1.2
[Device-security-policy-ipv6-1-aftlocalin] action pass
[Device-security-policy-ipv6-1-aftlocalin] quit
[Device-security-policy-ipv6] quit
# 配置名称为aftlocalout的安全策略，允许将AFT转换后的报文转发至Server，具体配置步骤如下。
[Device] security-policy ip
[Device-security-policy-ip] rule name aftlocalout
[Device-security-policy-ip-1-aftlocalout] source-zone local
[Device-security-policy-ip-1-aftlocalout] destination-zone untrust
[Device-security-policy-ip-1-aftlocalout] source-ip-host 10.1.1.1
[Device-security-policy-ip-1-aftlocalout] source-ip-host 10.1.1.2
[Device-security-policy-ip-1-aftlocalout] source-ip-host 10.1.1.3
[Device-security-policy-ip-1-aftlocalout] destination-ip-host 20.1.1.1
[Device-security-policy-ip-1-aftlocalout] destination-ip-host 20.1.1.2
[Device-security-policy-ip-1-aftlocalout] action pass
[Device-security-policy-ip-1-aftlocalout] quit
[Device-security-policy-ip] quit
配置AFT功能
# 配置地址组0包含三个IPv4地址10.1.1.1、10.1.1.2和10.1.1.3。
[Device] aft address-group 0
[Device-aft-address-group-0] address 10.1.1.1 10.1.1.3
[Device-aft-address-group-0] quit
# 配置IPv6 ACL 2000，该ACL用来匹配源IPv6地址属于2013::/96网段的报文。
[Device] acl ipv6 basic 2000
[Device-acl-ipv6-basic-2000] rule permit source 2013:: 96
[Device-acl-ipv6-basic-2000] rule deny
[Device-acl-ipv6-basic-2000] quit
# 配置IPv6到IPv4的源地址动态转换策略，将匹配ACL 2000的IPv6报文源地址转换为地址组0中的地址，即将2013::/96网段内主机所发送报文的源IPv6地址转换为IPv4地址10.1.1.1、10.1.1.2或10.1.1.3。
[Device] aft v6tov4 source acl ipv6 number 2000 address-group 0
# 配置NAT64前缀为2012::/96，报文的目的地址根据该NAT64前缀转换为IPv4地址。
[Device] aft prefix-nat64 2012:: 96
# 在设备IPv6侧和IPv4侧接口开启AFT功能。
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] aft enable
[Device-GigabitEthernet1/0/1] quit
[Device] interface gigabitethernet 1/0/2
[Device-GigabitEthernet1/0/2] aft enable
[Device-GigabitEthernet1/0/2] quit
# 以上配置完成后，检查IPv6 Host与IPv4 Server的连通性。以IPv6 host A ping IPv4 server A为例：
D:\>ping 2012::20.1.1.1
Pinging 2012::20.1.1.1 with 32 bytes of data:
Reply from 2012::20.1.1.1: time=3ms
Reply from 2012::20.1.1.1: time=3ms
Reply from 2012::20.1.1.1: time=3ms
Reply from 2012::20.1.1.1: time=3ms
# 通过查看AFT会话，可以看到创建了一个IPv6会话和IPv4会话，分别对应转换前和转换后的报文。
[Device] display aft session ipv6 verbose
Initiator:
Source IP/port: 2013::100/0
Destination IP/port: 2012::1401:0101/32768
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: IPV6-ICMP(58)
Inbound interface: GigabitEthernet1/0/1
Source security zone: Trust
Responder:
Source IP/port: 2012::1401:0101/0
Destination IP/port: 2013::100/33024
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: IPV6-ICMP(58)
Inbound interface: GigabitEthernet1/0/2
Source security zone: Local
State: ICMPV6_REPLY
Application: ICMP
Rule ID: -/-/-
Rule name:
Start time: 2014-03-13 08:52:59 TTL: 23s
Initiator->Responder: 4 packets 320 bytes
Responder->Initiator: 4 packets 320 bytes
Total sessions found: 1
[Device] display aft session ipv4 verbose
Initiator:
Source IP/port: 10.1.1.1/1025
Destination IP/port: 20.1.1.1/2048
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: ICMP(1)
Inbound interface: GigabitEthernet1/0/1
Source security zone: Local
Responder:
Source IP/port: 20.1.1.1/1025
Destination IP/port: 10.1.1.1/0
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: ICMP(1)
Inbound interface: GigabitEthernet1/0/2
Source security zone: Untrust
State: ICMP_REPLY
Application: ICMP
Rule ID: 0
Rule name: aftlocalout
Start time: 2014-03-13 08:52:59 TTL: 27s
Initiator->Responder: 4 packets 240 bytes
Responder->Initiator: 4 packets 240 bytes
Total sessions found: 1
#
interface GigabitEthernet1/0/1
aft enable
ipv6 address 2013::1/96
#
interface GigabitEthernet1/0/2
ip address 10.1.1.4 255.255.255.0
aft enable
#
security-zone name Trust
import interface GigabitEthernet1/0/1
#
security-zone name Untrust
import interface GigabitEthernet1/0/2
#
ip route-static 20.1.1.0 24 10.1.1.100
#
acl ipv6 basic 2000
rule 0 permit source 2013::/96
rule 5 deny
#
aft address-group 0
address 10.1.1.1 10.1.1.3
#
aft prefix-nat64 2012:: 96
aft v6tov4 source acl ipv6 number 2000 address-group 0
#
security-policy ip
rule 0 name aftlocalout
action pass
source-zone local
destination-zone untrust
source-ip-host 10.1.1.1
source-ip-host 10.1.1.2
source-ip-host 10.1.1.3
destination-ip-host 20.1.1.1
destination-ip-host 20.1.1.2
#
security-policy ipv6
rule 0 name aftlocalin
action pass
source-zone trust
destination-zone local
source-ip-subnet 2013::/96
destination-ip-host 2012::1401:101
destination-ip-host 2012::1401:102