(Optional) Configuring Centralized NAT64 Translation

NE20E-S V800R011C10 Configuration Guide - IPv6 Transition 02

Rate and give feedback:

Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).

This section describes how to configure centralized NAT64 translation.

Usage Scenario

After configuring basic NAT64 functions, you can apply a NAT64 traffic distribution policy in the inbound direction of user traffic to distribute the user traffic to a service board. You can also apply a NAT64 translation policy to translate private IPv6 addresses into public IPv4 addresses, allowing IPv6 users to access an IPv4 network.

Pre-configuration Tasks

Before you configure centralized NAT64 translation, configure basic NAT64 functions.

Configuring a NAT64 Traffic Distribution Policy
Verifying the Centralized NAT64 Translation Configuration

Configuring a NAT64 Traffic Distribution Policy

You can configure a NAT64 traffic distribution policy to distribute user traffic to NAT64 service boards for translation.

Context

A service board does not provide any interfaces. Therefore, an interface board must distribute user traffic to a service board for NAT64 treatment. You can configure a traffic distribution policy to distribute the packets matching the traffic distribution policy to the NAT64 service board.

Procedure

Configure a traffic classification rule.
1. Run system-view
  The system view is displayed.
2. Run either of the following commands:
  - For a basic ACL numbered from 2000 to 2999, run:
    
    acl ipv6 { name basic-acl6-name { basic | [ basic ] number basic-acl6-number } | [ number ] basic-acl6-number } [ match-order { config | auto } ]
  - For an advanced ACL numbered from 3000 to 3999, run:
    
    acl ipv6 { name advance-acl6-name [ advance | [ advance ] number advance-acl6-number ] | [ number ] advance-acl6-number } [ match-order { config | auto } ]
3. Run either of the following commands to create an ACL rule:
  - For a basic ACL numbered from 2000 to 2999, run:
    
    rule [ rule-id ] [ name rule-name ] { deny | permit } [ fragment | source { source-ipv6-address { prefix-length | source-wildcard } | source-ipv6-address/prefix-length | any } | time-range time-name | [ vpn-instance vpn-instance-name | vpn-instance-any ] ] ^*
  - For an advanced ACL numbered from 3000 to 3999, run:
    1. If TCP is used, run:
      
      rule [ rule-id ] [ name rule-name ] { permit | deny } { protocol | tcp } [ [ dscp dscp | [ precedence precedence | tos tos ] ^* ] | destination { destination-ipv6-address prefix-length | destination-ipv6-address/prefix-length | any } | destination-port operator port | fragment | source { source-ipv6-address prefix-length | source-ipv6-address/prefix-length | any } source-pool source-pool-name } | source-port operator port | tcp-flag { tcp-flag [ mask mask-value ] | established | { ack | fin | psh | rst | syn | urg } ^* } | time-range time-name | [ vpn-instance vpn-instance-name | vpn-instance-any ] ] ^*
    2. If UDP is used, run:
      
      rule [ rule-id ] [ name rule-name ] { permit | deny } { protocol | udp } [ [ dscp dscp | [ precedence precedence | tos tos ] ^* ] | destination { destination-ipv6-address prefix-length | destination-ipv6-address/prefix-length | any } | destination-port operator port | fragment | source { source-ipv6-address prefix-length | source-ipv6-address/prefix-length | any } source-pool source-pool-name } | source-port operator port | time-range time-name | [ vpn-instance vpn-instance-name | vpn-instance-any ] ] ^*
    3. If ICMP is used, run:
      
      rule [ rule-id ] [ name rule-name ] { permit | deny } { protocol | icmpv6 } [ [ dscp dscp | [ precedence precedence | tos tos ] ^* ] | destination { destination-ipv6-address prefix-length | destination-ipv6-address/prefix-length | any } | fragment | icmp6-type { icmp6-type-name | icmp6-type [ to icmp6-type-end ] [ icmp6-code ] } | source { source-ipv6-address prefix-length | source-ipv6-address/prefix-length | any } source-pool source-pool-name } | time-range time-name | [ vpn-instance vpn-instance-name | vpn-instance-any ] ] ^*
    4. If a protocol, different from the preceding ones, is used, run:
      
      rule [ rule-id ] [ name rule-name ] { permit | deny } { protocol | gre | ipv6 | ipv6-ah | ipv6-esp | ospf } [ [ dscp dscp | [ precedence precedence | tos tos ] ^* ] | destination { destination-ipv6-address prefix-length | destination-ipv6-address/prefix-length | any } | fragment | source { source-ipv6-address prefix-length | source-ipv6-address/prefix-length | any } source-pool source-pool-name } | time-range time-name | [ vpn-instance vpn-instance-name | vpn-instance-any ] ] ^*
  A source IP address is usually configured in an ACL rule.
  
  To add multiple rules in an ACL, repeat Step c.
4. Run commit
  The configuration is committed.
5. Run quit
  Return to the system view.
Configure a traffic classifier.
1. Run system-view
  The system view is displayed.
2. Run traffic classifier classifier-name [ operator { and | or } ]
  A traffic classifier is configured, and the traffic classifier view is displayed.
3. Run if-match ipv6 acl acl-number
  A matching rule for multi-field (MA) traffic classification based on an ACL is configured.
  
  To configure multiple matching rules based on ACLs, repeat Step c. Traffic matching the ACL rule must has the destination addresses with the prefix defined in the NAT64 instance.
4. Run commit
  The configuration is committed.
5. Run quit
  Return to the system view.
Configure a traffic behavior.
1. Run system-view
  The system view is displayed.
2. Run traffic behavior behavior-name
  A traffic behavior is configured, and the traffic behavior view is displayed.
3. Run nat64 bind instance instance-name
  The traffic behavior is bound to a NAT64 instance.
4. Run commit
  The configuration is committed.
5. Run quit
  Return to the system view.
Configure a traffic policy.
1. Run system-view
  The system view is displayed.
2. Run traffic policy policy-name
  A traffic policy is configured, and the traffic policy view is displayed.
3. Run classifier classifier-name behavior behavior-name
  A traffic behavior is specified for a specified traffic classifier in the traffic policy.
4. Run commit
  The configuration is committed.
5. Run quit
  Return to the system view.
Apply the traffic policy to an interface.
# In centralized NAT64 scenarios, apply the traffic policy to Layer 3 interfaces for Layer 3 traffic sent by the network side.
1. Run system-view
  The system view is displayed.
2. Run interface interface-type interface-number
  The interface view is displayed.
3. Run traffic-policy policy-name inbound [ link-layer | all-layer | mpls-layer ]
  A traffic policy is applied to an interface.
4. Run commit
  The configuration is committed.
# In centralized NAT64 scenarios, apply the traffic policy to Layer 2 VLANIF member interfaces for VLAN traffic sent by the network side.
1. Run system-view
  The system view is displayed.
2. Run interface interface-type interface-number
  The interface view is displayed.
3. Run portswitch
  The Layer 3 interface is switched to a Layer 2 interface.
4. Run traffic-policy policy-name inbound [ vlan { all | vlan-id1 [ to vlan-id2 ] } ] [ link-layer | all-layer | mpls-layer ]
  A traffic policy is applied to the Layer 2 interface.
5. Run commit
  The configuration is committed.

Verifying the Centralized NAT64 Translation Configuration

After centralized Network Address Translation IPv6-to-IPv4 (NAT64) for user traffic is configured, run display commands to verify centralized NAT64 configurations.

Prerequisites

A NAT64 translation has been configured.

Procedure

Run the display nat64 instance [ instance-name ] command to check the configuration of a NAT64 instance.
Run the display nat user-information command to check information about online users.

Configuring a NAT64 Traffic Distribution Policy
Verifying the Centralized NAT64 Translation Configuration

Download

Updated: 2020-02-07

Document ID: EDOC1100125510

Downloads: 18

Average rating:

This Document Applies to these Products

Usage Scenario

Pre-configuration Tasks

Configuring a NAT64 Traffic Distribution Policy

Context

Procedure

Verifying the Centralized NAT64 Translation Configuration

Prerequisites

Procedure

Related Version

Related Documents