CLI example: Providing FTP service from an IPv4 network to the IPv6 Internet
Network configuration
As shown in Figure-1, a company deploys an IPv4 network, and it has an IPv6 address 2012::1. The Internet migrates to IPv6.
To allow the IPv4 FTP server to provide FTP services to IPv6 hosts, configure the following AFT policies on the device:
Configure an IPv4-to-IPv6 source address static mapping for the IPv4 FTP server. The device uses the mapping to translate the destination IPv6 address of IPv6-initiated addresses to the IPv4 address.
Configure an IPv6-to-IPv4 source address dynamic translation policy. The device translates source IPv6 addresses of IPv6-initiated packets to source IPv4 addresses 30.1.1.1 and 30.1.1.2.
Software versions used
This configuration example was created and verified on R9900P2705 of the F5000-AI-55-G device.
Procedures
Assign IP addresses to interfaces:
# Assign an IPv6 address to interface GigabitEthernet 1/0/1.
<Device> system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1]
ip v6 address 2014::1 96 [Device-GigabitEthernet1/0/1] quit
# Assign IPv6 addresses to other interfaces in the same way. (Details not shown.)
Add interfaces to security zones.
[ Device] security-zone name trust[ Device-security-zone-Trust] import interface gigabitethernet 1/0/2[ Device-security-zone-Trust] quit[ Device] security-zone name untrust[ Device-security-zone-Untrust] import interface gigabitethernet 1/0/1[ Device-security-zone-Untrust] quitConfigure security policies:
# In the IPv6 security policy, configure a rule named
aftlocalin to allow the device to perform AFT on the IPv6 host traffic destined for the IPv4 server.[Device] security-policy ipv6
[Device-security-policy-ipv6] rule name aftlocalin
[Device-security-policy-ipv6-1-aftlocalin] source-zone untrust
[Device-security-policy-ipv6-1-aftlocalin] destination-zone local
[Device-security-policy-ipv6-1-aftlocalin] destination-ip-host 2012::1
[Device-security-policy-ipv6-1-aftlocalin] action pass
[Device-security-policy-ipv6-1-aftlocalin] quit
[Device-security-policy-ipv6] quit
# In the IPv4 security policy, configure a rule named
aftlocal out to allow the device to forward the AFT-translated packets to the IPv4 server.[Device] security-policy ip
[Device-security-policy-ip] rule name aftlocalout
[Device-security-policy-ip-1-aftlocalout] source-zone local
[Device-security-policy-ip-1-aftlocalout] destination-zone trust
[Device-security-policy-ip-1-aftlocalout] source-ip-host 30.1.1.1
[Device-security-policy-ip-1-aftlocalout] source-ip-host 30.1.1.2
[Device-security-policy-ip-1-aftlocalout] destination-ip-host 20.1.1.1
[Device-security-policy-ip-1-aftlocalout] action pass
[Device-security-policy-ip-1-aftlocalout] quit
[Device-security-policy-ip]
quit # Configure a security policy rule named
trust-untrust to allow the subsequent packets to be forwarded to the server.[Device]
security-policy ip [Device-security-policy-ip]
rule name trust-untrust [Device-security-policy-ip-2-trust-untrust]
source-zone untrust [Device-security-policy-ip-2-trust-untrust]
destination-zone trust [Device-security-policy-ip-2-trust-untrust]
source-ip-host 30.1.1.1 [Device-security-policy-ip-2-trust-untrust]
source-ip-host 30.1.1.2 [Device-security-policy-ip-2-trust-untrust]
destination-ip-host 20.1.1.1 [Device-security-policy-ip-2-trust-untrust]
action pass [Device-security-policy-ip-2-trust-untrust]
quit [Device-security-policy-ip]
quit Configure AFT settings:
# Map source IPv4 address
20.1.1.1 to source IPv6 address2012::1 .[Device] aft v4tov6 source 20.1.1.1 2012::1
# Configure address group 0, and add the address range from 30.1.1.1 to 30.1.1.2 to the group.
[Device] aft address-group 0
[Device-aft-address-group-0] address 30.1.1.1 30.1.1.2
[Device-aft-address-group-0] quit
# Configure IPv6 ACL 2000 to permit all IPv6 packets to pass through.
[Device] acl ipv6 basic 2000
[Device-acl-ipv6-basic-2000] rule permit
[Device-acl-ipv6-basic-2000] quit
# Configure the device to translate source addresses of IPv6 packets permitted by IPv6 ACL 2000 to IPv4 addresses in address group 0.
[Device] aft v6tov4 source acl ipv6 number 2000 address-group 0
# Enable AFT on the interfaces connected to the IPv6 Internet and IPv4 network, respectively.
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] aft enable
[Device-GigabitEthernet1/0/1] quit
[Device] interface gigabitethernet 1/0/2
[Device-GigabitEthernet1/0/2] aft enable
[Device-GigabitEthernet1/0/2] quit
Verifying the configuration
# Verify the connectivity between the IPv6 hosts and the IPv4 FTP server. For example, ping the IPv4 FTP server from IPv6 host A.
D:\>ping 2012::1
Pinging 2012::1 with 32 bytes of data:
Reply from 2012::1: time=3ms
Reply from 2012::1: time=3ms
Reply from 2012::1: time=3ms
Reply from 2012::1: time=3ms
# Display detailed information about IPv6 AFT sessions on the device.
[Device] display aft session ipv6 verbose
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: IPV6-ICMP(58)
Inbound interface: GigabitEthernet1/0/1
Source security zone: Untrust
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: IPV6-ICMP(58)
Inbound interface: GigabitEthernet1/0/2
Source security zone: Local
State: ICMPV6_REPLY
Application: ICMP
Rule ID: -/-/-
Rule name:
Start time: 2014-03-13 09:07:30 TTL: 3582s
Initiator->Responder: 3 packets 184 bytes
Responder->Initiator: 2 packets 148 bytes
Total sessions found: 1
# Display detailed information about IPv4 AFT sessions on the device.
[Device] display aft session ipv4 verbose
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: ICMP(1)
Inbound interface: GigabitEthernet1/0/1
Source security zone: Local
DS-Lite tunnel peer: -
VPN instance/VLAN ID/Inline ID: -/-/-
Protocol: ICMP(1)
Inbound interface: GigabitEthernet1/0/2
Source security zone: Trust
State: ICMP_REPLY
Application: ICMP
Rule ID: 0
Rule name: aftlocalout
Start time: 2014-03-13 09:07:30 TTL: 3577s
Initiator->Responder: 3 packets 124 bytes
Responder->Initiator: 2 packets 108 bytes
Total sessions found: 1
Configuration files
#
interface GigabitEthernet1/0/1
aft enable
ipv6 address 2014::1/96
#
interface GigabitEthernet1/0/2
ip address 20.1.1.2 255.255.255.0
aft enable
#
security-zone name Trust
import interface GigabitEthernet1/0/2
#
security-zone name Untrust
import interface GigabitEthernet1/0/1
#
acl ipv6 basic 2000
rule 0 permit
#
aft address-group 0
address 30.1.1.1 30.1.1.2
#
aft v6tov4 source acl ipv6 number 2000 address-group 0
aft v4tov6 source 20.1.1.1 2012::1
#
security-policy ip
rule 0 name aftlocalout
action pass
source-zone local
destination-zone trust
source-ip-host 30.1.1.1
source-ip-host 30.1.1.2
destination-ip-host 20.1.1.1
rule 1 name trust-untrust
action pass
source-zone untrust
destination-zone trust
source-ip-host 30.1.1.1
source-ip-host 30.1.1.2
destination-ip-host 20.1.1.1
#
security-policy ipv6
rule 0 name aftlocalin
action pass
source-zone untrust
destination-zone local
destination-ip-host 2012::1
#