上網功能

1.20.4  IPv4網絡訪問IPv6 Internet中的服務器配置舉例

1. 組網需求

Internet已經升級到了IPv6，但是某公司內部網絡仍然是IPv4網絡。而該公司內部網絡的10.1.1.0/24網段的用戶仍需要訪問IPv6 Internet中的服務器，其他用戶不能訪問。

為滿足上述要求，本例中使用如下方式實現：

·     使用IPv4到IPv6源地址動態地址轉換策略，將IPv4報文的源地址轉換為IPv6地址。

·     通過IPv6到IPv4的源地址靜態轉換策略為IPv6 Internet上服務器的IPv6地址指定一個對應的IPv4地址，Device收到發往該IPv4地址的報文時將其轉換為對應的IPv6地址。

2. 組網圖

圖1-10 IPv4網絡訪問IPv6 Internet中的服務器配置組網圖

‌

3. 配置步驟

(1)     ‍配置接口IP地址

# 根據組網圖中規劃的信息，配置各接口的IP地址，具體配置步驟如下。

<Device> system-view

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] ip address 10.1.1.3 24

[Device-GigabitEthernet1/0/1] quit

請參考以上步驟配置其他接口的IP地址，具體配置步驟略。

(2)     將接口加入安全域

# 請根據組網圖中規劃的信息，將接口加入對應的安全域，具體配置步驟如下。

[Device] security-zone name trust

[Device-security-zone-Trust] import interface gigabitethernet 1/0/1

[Device-security-zone-Trust] quit

[Device] security-zone name untrust

[Device-security-zone-Untrust] import interface gigabitethernet 1/0/2

[Device-security-zone-Untrust] quit

(3)     配置靜態路由

本舉例僅以靜態路由方式配置路由信息。實際組網中，請根據具體情況選擇相應的路由配置方式。

# 請根據組網圖中規劃的信息，配置靜態路由，本舉例假設到達Server所在網絡的下一跳IPv6地址為2014::100，實際使用中請以具體組網情況為準，具體配置步驟如下。

[Device] ipv6 route-static 2013:0:ff14:0101:100:: 64 2014::100

(4)     配置安全策略

# 配置名稱為aftlocalin的安全策略，使Device能對Host訪問Server的報文進行AFT轉換，具體配置步驟如下。

[Device] security-policy ip

[Device-security-policy-ip] rule name aftlocalin

[Device-security-policy-ip-1-aftlocalin] source-zone trust

[Device-security-policy-ip-1-aftlocalin] destination-zone local

[Device-security-policy-ip-1-aftlocalin] source-ip-subnet 10.1.1.0 24

[Device-security-policy-ip-1-aftlocalin] destination-ip-host 20.1.1.1

[Device-security-policy-ip-1-aftlocalin] action pass

[Device-security-policy-ip-1-aftlocalin] quit

[Device-security-policy-ip] quit

# 配置名稱為aftlocalout的安全策略，允許將AFT轉換後的報文轉發至Server，具體配置步驟如下。

[Device] security-policy ipv6

[Device-security-policy-ipv6] rule name aftlocalout

[Device-security-policy-ipv6-1-aftlocalout] source-zone local

[Device-security-policy-ipv6-1-aftlocalout] destination-zone untrust

[Device-security-policy-ipv6-1-aftlocalout] source-ip-subnet 2012:: 96

[Device-security-policy-ipv6-1-aftlocalout] destination-ip-host 2013:0:ff14:0101:100::1

[Device-security-policy-ipv6-1-aftlocalout] action pass

[Device-security-policy-ipv6-1-aftlocalout] quit

[Device-security-policy-ipv6] quit

# 配置名稱為trust-untrust的安全策略，允許將後續報文轉發至Server，具體配置步驟如下。

[Device] security-policy ipv6

[Device-security-policy-ipv6] rule name trust-untrust

[Device-security-policy-ipv6-2-trust-untrust] source-zone trust

[Device-security-policy-ipv6-2-trust-untrust] destination-zone untrust

[Device-security-policy-ipv6-2-trust-untrust] source-ip-subnet 2012:: 96

[Device-security-policy-ipv6-2-trust-untrust] destination-ip-host 2013:0:ff14:0101:100::1

[Device-security-policy-ipv6-2-trust-untrust] action pass

[Device-security-policy-ipv6-2-trust-untrust] quit

[Device-security-policy-ipv6] quit

(5)     配置AFT功能

# 配置ACL 2000，僅允許IPv4網絡中10.1.1.0/24網段的用戶可以訪問IPv6 Internet。

[Device] acl basic 2000

[Device-acl-ipv4-basic-2000] rule permit source 10.1.1.0 0.0.0.255

[Device-acl-ipv4-basic-2000] rule deny

[Device-acl-ipv4-basic-2000] quit

# 配置NAT64前綴，此前綴將在IPv4到IPv6源地址動態轉換策略中被調用，將報文的源地址轉換為IPv6地址。

[Device] aft prefix-nat64 2012:: 96

# 配置IPv4到IPv6源地址動態轉換策略，將匹配ACL 2000報文的源地址根據NAT64前綴轉換為IPv6地址。

[Device] aft v4tov6 source acl number 2000 prefix-nat64 2012:: 96

# 配置IPv6到IPv4的源地址靜態轉換策略，用於將報文的目的地址轉換為IPv6地址。

[Device] aft v6tov4 source 2013:0:ff14:0101:100::1 20.1.1.1

# 在設備IPv4側和IPv6側接口開啟AFT。

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] aft enable

[Device-GigabitEthernet1/0/1] quit

[Device] interface gigabitethernet 1/0/2

[Device-GigabitEthernet1/0/2] aft enable

[Device-GigabitEthernet1/0/2] quit

4. 驗證配置

# 以上配置完成後，檢查IPv4 host與IPv6 server的連通性。以IPv4 host A ping IPv6 server為例：

D:\>ping 20.1.1.1

Pinging 20.1.1.1 with 32 bytes of data:

Reply from 20.1.1.1: bytes=32 time=14ms TTL=63

Reply from 20.1.1.1: bytes=32 time=1ms TTL=63

Reply from 20.1.1.1: bytes=32 time=1ms TTL=63

Reply from 20.1.1.1: bytes=32 time=1ms TTL=63

# 通過查看AFT會話，可以看到創建了一個IPv4會話和IPv6會話，分別對應轉換前和轉換後的報文。

[Device] display aft session ipv4 verbose

Total number of sessions on all slots: 1

Slot 1:

Initiator:

  Source      IP/port: 10.1.1.1/1025

  Destination IP/port: 20.1.1.1/2048

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: ICMP(1)

  Inbound interface: GigabitEthernet1/0/1

  Source security zone: Trust

Responder:

  Source      IP/port: 20.1.1.1/1025

  Destination IP/port: 10.1.1.1/0

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: ICMP(1)

  Inbound interface: GigabitEthernet1/0/2

  Source security zone: Local

State: ICMP_REPLY

Application: ICMP

Rule ID: -/-/-

Rule name:

Start time: 2023-04-21 08:52:59  TTL: 27s

Initiator->Responder:            4 packets        240 bytes

Responder->Initiator:            4 packets        240 bytes

Total sessions found: 1

[Device] display aft session ipv6 verbose

Total number of sessions on all slots: 1

Slot 1:

Initiator:

  Source      IP/port: 2012::0A01:0101/0

  Destination IP/port: 2013:0:FF14:0101:0100::/32768

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: IPV6-ICMP(58)

  Inbound interface: GigabitEthernet1/0/1

  Source security zone: Local

Responder:

  Source      IP/port: 2013:0:FF14:0101:0100::/0

  Destination IP/port: 2012::0A01:0101/33024

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: IPV6-ICMP(58)

  Inbound interface: GigabitEthernet1/0/2

  Source security zone: Untrust

State: ICMPV6_REPLY

Application: ICMP

Rule ID: 0

Rule name: aftlocalout

Start time: 2023-04-21 08:52:59  TTL: 23s

Initiator->Responder:            4 packets        320 bytes

Responder->Initiator:            4 packets        320 bytes

Total sessions found: 1