防火墙在CGN解决方案中的应用

当CGN设备为Eudemon8000E-X系列时，如果配置端口预分配功能，必须将基于HASH选择CPU的模式设置为源地址HASH模式。

整个解决方案的配置流程如表1-5所示。

• 验证IPv4业务
  1. 配置完成后，在私网IPv4 PC1上可以访问公网FTP Server。

     C:\Documents and Settings\Administrator>ftp 1.1.3.1 
     Connected to 1.1.3.1. 
     220 FTP service ready. 
     User (1.1.3.1:(none)): admin 
     331 Password required for admin. 
     Password: 
     230 User logged in. 
     ftp>

  2. 在CPE设备上通过执行display firewall session table verbose命令，查看地址转换情况。

     [CPE] display firewall session table verbose 
      Current Total Sessions : 2
       ftp  VPN:public --> public  ID: ab016391fa4c03558d54c16fac122  
       Zone: untrust --> trust  TTL: 00:00:10 Left: 00:00:03 
       Interface: GigabitEthernet1/0/2  NextHop: 10.1.1.2  MAC: 0018-8239-1e5c
       <--packets:20 bytes:1168   -->packets:26 bytes:1150 
       192.168.0.2:1031[10.1.1.1:2054]+->1.1.3.1:21  PolicyName:policy_sec_1
       ftp-data  VPN:public --> public  ID: ab016391fa4c03558d54c16acd159
       Zone: untrust--> trust  TTL: 00:00:10  Left: 00:00:07
       Interface: GigabitEthernet1/0/0  NextHop: 192.168.0.2  MAC: 0018-826f-b3f4  
       <--packets:3 bytes:124   -->packets:5 bytes:370
       1.1.3.1:20-->10.1.1.1:15363[192.168.0.2:1034]  PolicyName:policy_nat_1 

     通过显示信息192.168.0.2:1031[10.1.1.1:2054]+->1.1.3.1:21和1.1.3.1:20-->10.1.1.1:15363[192.168.0.2:1034]可以看出，IPv4私网地址192.168.0.2已经转换成运营商IPv4私网地址10.1.1.1。两条会话信息表示FTP协议的控制通道和数据通道都已经开启。

  3. 在CGN设备上通过执行display firewall session table verbose命令，查看地址转换情况。

     [CGN] display firewall session table verbose 
      Current total sessions: 2 
      ftp VPN: public --> public  ID: a38f36333beb0f5654453374
      Zone: trust --> untrust Slot: 6 CPU: 2 TTL: 00:10:00 Left: 00:09:56
      Interface: GigabitEthernet1/0/0 Nexthop: 1.1.1.2
      <--packets: 15 bytes: 676 -->packets: 17 bytes: 764
      10.1.1.1:2054[1.1.2.4:10550] +-> 1.1.3.1:21  PolicyName:policy_nat_1
     
      ftp-data VPN: public --> public  ID: a48f3636f5030144b54453ad0
      Zone: untrust --> trust Slot: 6 CPU: 0 TTL: 00:00:10 Left: 00:00:07
      Interface: GigabitEthernet1/0/2 Nexthop: 10.1.2.2
      <--packets: 3 bytes: 124 -->packets: 5 bytes: 370
      1.1.3.1:20 --> 1.1.2.4:61578[10.1.1.1:15362]  PolicyName:policy_nat_1

     通过显示信息10.1.1.1:2054[1.1.2.4:10550] +-> 1.1.3.1:21和1.1.3.1:20 --> 1.1.2.4:61578[10.1.1.1:15362]可以看出，运营商IPv4私网地址10.1.1.1已经转换成公网IPv4地址1.1.2.4（地址池地址）。两条会话信息表示FTP协议的控制通道和数据通道都已经开启。

  4. 在CGN的任意视图下执行display cpe-user information cpe-ipv4 10.1.1.1，查看CPE（地址为：10.1.1.1）用户的详细信息。

     [CGN] display cpe-user information cpe-ipv4 10.1.1.1 slot 6 cpu 2 
      This operation will take a few minutes. Press 'Ctrl+C' to break ... 
      UserTbl item(s) on slot 6 cpu 2 
      -------------------------------------------------------------------- 
      Scene: NAT444  DstZone: untrust CPEIP: 10.1.1.1
      TTL: 40   LeftTime: 34 Increase Count: 0  VPN: public
      PoolID: addressgroup1  SectionID: 1  PublicIP: 1.1.2.4  StartPort: 2048
      PortNumber: 256  PortTotal: 256  Used Port Number: 1 

     通过显示信息可以看出，从地址为10.1.1.1的CPE发送的业务流源地址都转换成1.1.2.4，使用的端口范围是从2048～2303共256个端口。

• 验证IPv6业务
  1. 6RD隧道配置成功后，从CPE设备ping CGN的6RD隧道接口地址。

     <CPE> ping ipv6 22:0:102:100::1 
       PING 22:0:102:100::1 : 56  data bytes, press CTRL_C to break
         Reply from 22:0:102:100::1 
         bytes=56 Sequence=1 hop limit=64  time = 90 ms 
         Reply from 22:0:102:100::1 
         bytes=56 Sequence=2 hop limit=64  time = 100 ms
         Reply from 22:0:102:100::1
         bytes=56 Sequence=3 hop limit=64  time = 40 ms
         Reply from 22:0:102:100::1
         bytes=56 Sequence=4 hop limit=64  time = 60 ms
         Reply from 22:0:102:100::1
         bytes=56 Sequence=5 hop limit=64  time = 40 ms
       
       --- 22:0:102:100::1 ping statistics --- 
         5 packet(s) transmitted   
         5 packet(s) received      
         0.00% packet loss         
         round-trip min/avg/max = 40/66/100 ms

     可以ping通，说明6RD隧道配置没有问题。此时在CGN任意视图下执行display ipv6 interface tunnel，可以查看到Tunnel1的IPv6状态和配置信息。

     [CGN] display ipv6 interface tunnel 1 
     Tunnel1 current state : UP 
     IPv6 protocol current state : UP 
     IPv6 is enabled, link-local address is FE80::101:101 
       Global unicast address(es): 
         22:0:102:100::1, subnet is 22:0:102:100::/64 
       Joined group address(es): 
         FF02::1:FF00:1 
         FF02::1:FF01:101 
         FF02::2 
       MTU is 1500 bytes 
       ND reachable time is 30000 milliseconds 
       ND retransmit interval is 1000 milliseconds 
       ND stale time is 1200 seconds 

  2. 从CPE设备ping CGN连接IPv6网络的接口地址，即GigabitEthernet 1/0/1的接口地址。

     <CPE> ping ipv6 3000::1 
       PING 3000::1 : 56  data bytes, press CTRL_C to break
         Reply from 3000::1
         bytes=56 Sequence=1 hop limit=64  time = 90 ms  
         Reply from 3000::1
         bytes=56 Sequence=2 hop limit=64  time = 100 ms 
         Reply from 3000::1
         bytes=56 Sequence=3 hop limit=64  time = 40 ms 
         Reply from 3000::1
         bytes=56 Sequence=4 hop limit=64  time = 60 ms 
         Reply from 3000::1
         bytes=56 Sequence=5 hop limit=64  time = 40 ms
                                                  
       --- 3000::1 ping statistics --- 
         5 packet(s) transmitted
         5 packet(s) received
       0.00% packet loss 
         round-trip min/avg/max = 40/66/100 ms

     可以ping通，说明CPE设备与CGN上配置的IPv6路由没有问题。

  3. 在PC2上ping PC3的地址。

     C:\> ping6 3000::2 
     from 22:0:101:100::1 with 32 bytes of data: 
     Reply from 3000::2: time<1ms 
     Reply from 3000::2: time<1ms 
     Reply from 3000::2: time<1ms 
     Reply from 3000::2: time<1ms 
     Ping statistics for 3000::2: 
         Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), 
     Approximate round trip times in milli-seconds: 
         Minimum = 0ms, Maximum = 0ms, Average = 0ms

     可以ping通，说明整个网络中的设备配置都没问题。

• CPE配置脚本

  #
  sysname CPE
  #
   ipv6
  #
  acl number 2000  
   rule 5 permit source 192.168.1.0 0.0.0.255
  #
  interface GigabitEthernet1/0/0  
   ip address 192.168.0.1 255.255.255.0
  #
  interface GigabitEthernet1/0/1   
   ipv6 enable    
   ipv6 address 22:0:101:101::1/64 
  #
  interface GigabitEthernet1/0/2  
   ip address 10.1.1.1 255.255.255.0 
  #
  interface Tunnel1
   ipv6 enable
   ipv6 address 22:0:101:100::1/56 
   tunnel-protocol ipv6-ipv4 6rd 
   source 10.1.1.1 
   ipv6-prefix 22::/32  
   ipv4-prefix length 8  
   border-relay address 10.1.2.1 
  #
  firewall zone local 
   set priority 100 
  #
  firewall zone trust  
   set priority 85   
   add interface GigabitEthernet1/0/0 
   add interface GigabitEthernet1/0/1 
  #
  firewall zone untrust 
   set priority 5 
   add interface GigabitEthernet1/0/2
   add interface Tunnel1  
  #
  firewall zone dmz    
   set priority 50    
  #
  firewall interzone trust untrust
   detect ftp 
  #
   ipv6 route-static 22:: 32 Tunnel 1        
   ipv6 route-static 3000:: 64 22:0:102:100::1
  #
  security-policy    
   rule name policy1  
    source-zone trust    
    destination-zone untrust 
    source-address 192.168.0.0 24 
    source-address 22:0:101:101:: 64
    action permit   
   rule name policy2      
    source-zone local       
    destination-zone untrust 
    source-address 22:0:101:100:: 56
    action permit
  # 
  nat-policy  
    rule name policy_nat_1    
      source-zone trust    
      destination-zone untrust    
      source-address 192.168.1.0 24  
      action source-nat easy-ip  
  #
  return     

• CGN配置脚本

  #
  sysname CGN 
  #
   ipv6
  #
  firewall hash-mode source-only   
  #
  interface GigabitEthernet1/0/0  
   undo shutdown    
   ip address 1.1.1.1 255.255.255.0    
  #
  interface GigabitEthernet1/0/1  
   undo shutdown   
   ipv6 enable
   ipv6 address 3000::1/64   
  #
  interface GigabitEthernet1/0/2   
   undo shutdown    
   ip address 10.1.2.1 255.255.255.0 
  #
  interface Tunnel1   
   ipv6 enable
   ipv6 address 22:0:102:100::1/56  
   tunnel-protocol ipv6-ipv4 6rd  
   source 10.1.2.1
   ipv6-prefix 22::/32   
   ipv4-prefix length 8   
  #
  firewall zone local  
   set priority 100   
  #
  firewall zone trust   
   set priority 85
   add interface GigabitEthernet1/0/2  
   add interface Tunnel1   
  #
  firewall zone untrust  
   set priority 5 
   add interface GigabitEthernet1/0/0  
   add interface GigabitEthernet1/0/1  
  #
  firewall zone dmz
  set priority 50   
  # 
   nat address-group addressgroup1  
   mode pat    
   port-block-size 256  
   route enable
   section 1 1.1.2.1 1.1.2.5   
  #
  security-policy 
   rule name policy1
    source-zone trust  
    destination-zone untrust 
    source-address 1.1.1.0 24 
    source-address 3000:: 64 
    action permit 
   rule name policy2
    source-zone trust  
    destination-zone local
    source-address 22:0:102:100:: 56
    action permit
  #
  nat-policy  
    rule name policy_nat_1 
      source-zone trust  
      destination-zone untrust 
      source-address 10.1.1.0 24 
      action source-nat address-group addressgroup1 
  #
  firewall interzone trust untrust  
   detect ftp 
  #
   ipv6 route-static 22:: 32 Tunnel 1  
  #
  return  

当CGN设备为Eudemon8000E-X系列时，如果需要配置三元组DS-Lite NAT功能，必须将基于HASH选择CPU的模式设置为源地址HASH模式

整个解决方案的配置流程如表1-10所示。

• 验证IPv4业务
  1. 配置完成后，在私网IPv4 PC1上可以访问IPv4公网Server的FTP服务。

     C:\Documents and Settings\Administrator>ftp 1.1.3.1 
     Connected to 1.1.3.1. 
     220 FTP service ready. 
     User (1.1.3.1:(none)): admin 
     331 Password required for admin. 
     Password: 
     230 User logged in. 
     ftp>

  2. 在CPE设备上通过执行display firewall session table verbose命令，查看地址转换情况。

     [CPE] display firewall session table verbose 
      Current Total Sessions : 2 
       ftp  VPN:public --> public  ID: ab016391fa4c03558d54c16fac122  
       Zone: trust--> untrust  TTL: 00:10:00  Left: 00:09:59 
       Interface: GigabitEthernet1/0/2  NextHop: 10.1.1.2  MAC: 0018-8239-1e5c
       <--packets:20 bytes:1168   -->packets:26 bytes:1150 
       192.168.0.2:1031[10.1.1.1:2054]+->1.1.3.1:21  PolicyName:policy_sec_1
     
       ftp-data  VPN:public --> public  ID: ab016391fa4c03558d54c16acd159
       Zone: untrust--> trust  TTL: 00:00:10  Left: 00:00:07
       Interface: GigabitEthernet1/0/0  NextHop: 192.168.0.2  MAC: 0018-826f-b3f4  
       <--packets:3 bytes:124   -->packets:5 bytes:370
       1.1.3.1:20-->10.1.1.1:15363[192.168.0.2:1034]  PolicyName:policy_nat_1

     通过显示信息192.168.0.2:1031[10.1.1.1:2054]+->1.1.3.1:21和1.1.3.1:20-->10.1.1.1:15363[192.168.0.2:1034]可以看出，IPv4私网地址192.168.0.2已经转换成运营商IPv4私网地址10.1.1.1。两条会话信息表示FTP协议的控制通道和数据通道都已经开启。

  3. 在CGN设备上通过执行display firewall session table verbose命令，查看地址转换情况。

     [CGN] display firewall session table verbose 
      Current total sessions: 2 
      ftp VPN: public --> public  ID: a38f36333beb0f5654453374 
      Zone: trust --> untrust Slot: 6 CPU: 2 TTL: 00:10:00 Left: 00:09:56
      Interface: GigabitEthernet1/0/0 Nexthop: 1.1.1.2 
      <--packets: 0 bytes: 0 -->packets: 17 bytes: 764 
      10.1.1.1:2054[1.1.2.4:10550] +-> 1.1.3.1:21   PolicyName:policy_nat_1  
           
      ftp-data VPN: public --> public  ID: a48f3636f5030144b54453ad0  
      Zone: untrust --> trust Slot: 6 CPU: 2 TTL: 00:00:10 Left: 00:00:07
      Interface: GigabitEthernet1/0/2 Nexthop: 10.1.2.2  
      <--packets: 3 bytes: 124 -->packets: 5 bytes: 370  
      1.1.3.1:20 --> 1.1.2.4:61578[10.1.1.1:15362]  PolicyName:policy_nat_1 

     通过显示信息10.1.1.1:2054[1.1.2.4:10550] +-> 1.1.3.1:21和1.1.3.1:20 --> 1.1.2.4:61578[10.1.1.1:15362]可以看出，运营商IPv4私网地址10.1.1.1已经转换成公网IPv4地址1.1.2.4（地址池地址）。两条会话信息表示FTP协议的控制通道和数据通道都已经开启。

  4. 在CGN的任意视图下执行display cpe-user information cpe-ipv4 10.1.1.1，查看CPE（地址为：10.1.1.1）用户的详细信息。

     [CGN] display cpe-user information cpe-ipv4 10.1.1.1 slot 6 cpu 2 
      This operation will take a few minutes. Press 'Ctrl+C' to break ... 
      UserTbl item(s) on slot 6 cpu 2 
      -------------------------------------------------------------------- 
      Scene: NAT444  DstZone: untrust CPEIP: 10.1.1.1  
      TTL: 40   LeftTime: 34 Increase Count: 0  VPN: public  
      PoolID: addressgroup1  SectionID: 1  PublicIP: 1.1.2.4  StartPort: 2048
     PortNumber: 256  PortTotal: 256  Used Port Number: 1  

     通过显示信息可以看出，从地址为10.1.1.1的CPE发送的业务流源地址都转换成1.1.2.4，使用的端口范围是从2048～2303共256个端口。

• 验证IPv6业务
  1. 从CPE设备ping CGN连接城域网IPv6网络的接口地址，即GigabitEthernet 1/0/3的接口地址。

     <CPE> ping ipv6 4000::1 
       PING 4000::1 : 56  data bytes, press CTRL_C to break  
         Reply from 4000::1
         bytes=56 Sequence=1 hop limit=64  time = 90 ms   
         Reply from 4000::1
         bytes=56 Sequence=2 hop limit=64  time = 100 ms  
         Reply from 4000::1
         bytes=56 Sequence=3 hop limit=64  time = 40 ms  
         Reply from 4000::1
         bytes=56 Sequence=4 hop limit=64  time = 60 ms 
         Reply from 4000::1
         bytes=56 Sequence=5 hop limit=64  time = 40 ms
             
       --- 4000::1 ping statistics ---   
         5 packet(s) transmitted  
         5 packet(s) received
        0.00% packet loss 
         round-trip min/avg/max = 40/66/100 ms

     可以ping通，说明CPE设备与CGN上都有到达对方的IPv6路由。此时在CPE设备和CGN通过执行display ospfv3 routing命令，可以查看到各自的OSPFv3路由表。

     [CPE] display ospfv3 routing 
     OSPFv3 Process (1)            
        Destination                                                Metric
          Next-hop  
          2000::/64                                                1
          directly connected, GigabitEthernet1/0/1   
          3000::/64                                                1
          directly connected, GigabitEthernet1/0/3    
       IA 4000::/64                                                2
           via FE80::218:82FF:FE39:1E5C, GigabitEthernet1/0/3    
       IA 5000::/64                                                3
           via FE80::218:82FF:FE39:1E5C, GigabitEthernet1/0/3 

     通过OSPFv3路由表，可以看到CPE设备已经学习到CGN连接城域网IPv6网络的接口网段和连接IPv6 Internet的接口网段的路由。

     [CGN] display ospfv3 routing 
     OSPFv3 Process (1)            
        Destination                                                 Metric
          Next-hop
       IA 2000::/64                                                 3  
            via FE80::222:A1FF:FE30:22, GigabitEthernet1/0/3
       IA 3000::/64                                                 2  
            via FE80::222:A1FF:FE30:22, GigabitEthernet1/0/3
          4000::/64                                                 1 
           directly connected, GigabitEthernet1/0/3
          5000::/64                                                 1
           directly connected, GigabitEthernet1/0/1

     通过OSPFv3路由表，可以看到CGN已经学习到CPE设备连接城域网IPv6网络的接口网段和连接IPv6用户的接口网段的路由。

  2. 在PC2上ping PC3的地址。

     C:\> ping6 5000::2 
     from 2000::2 with 32 bytes of data: 
     Reply from 5000::2: time<1ms 
     Reply from 5000::2: time<1ms 
     Reply from 5000::2: time<1ms 
     Reply from 5000::2: time<1ms 
     Ping statistics for 5000::2: 
         Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), 
     Approximate round trip times in milli-seconds: 
         Minimum = 0ms, Maximum = 0ms, Average = 0ms

     可以ping通，说明整个网络中IPv6路由配置没有问题。

• IPv6用户访问IPv4公网资源
  1. 在PC2上ping www.example.com。

     Pinging 6000::0101:301 with 32 bytes of data: 
      
     Reply from 6000::0101:301: time=23ms 
     Reply from 6000::0101:301: time=6ms 
     Reply from 6000::0101:301: time=12ms 
     Reply from 6000::0101:301: time=33ms 
      
     Ping statistics for 6000::0101:301: 
         Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), 
     Approximate round trip times in milli-seconds: 
         Minimum = 6ms, Maximum = 33ms, Average = 18ms

     PC可以Ping通Server的IPv4地址。

  2. 在CGN的任意视图下执行display firewall ipv6 session table，查看NAT64的会话表信息。

     <CGN> display firewall ipv6 session table 
      Slot: 6 CPU: 1               
     NAT64: icmp6 VPN: public --> public  2000::2.44152[1.1.2.14:10296] --> 6000::0101:301.2048[1.1.3.1:2048]

     由NAT64会话表得知IPv6与IPv4地址的转换关系。

• CPE配置脚本

  #
   sysname CPE
  #     
   ipv6 
  #     
  interface GigabitEthernet1/0/0
   ip address 192.168.0.1 255.255.255.0 
  #     
  interface GigabitEthernet1/0/1
   ipv6 enable
   ipv6 address 2000::1/64      
   ospfv3 1 area 0.0.0.1        
  #     
  interface GigabitEthernet1/0/2
   ip address 10.1.1.1 255.255.255.0   
  #     
  interface GigabitEthernet1/0/3
   ipv6 enable
   ipv6 address 3000::1/64      
   ospfv3 1 area 0.0.0.0        
  #     
  firewall zone local           
   set priority 100             
  #     
  firewall zone trust           
   set priority 85              
   add interface GigabitEthernet1/0/0 
   add interface GigabitEthernet1/0/1
  #     
  firewall zone untrust         
   set priority 5               
   add interface GigabitEthernet1/0/2
   add interface GigabitEthernet1/0/3
  #     
  firewall zone dmz             
   set priority 50              
  #     
  firewall interzone trust untrust   
   detect ftp 
  #     
  ospfv3 1    
   router-id 1.1.1.1      
   area 0.0.0.0
  area 0.0.0.1        
  #     
   ip route-static 10.1.2.0 255.255.255.0 10.1.1.2 
  #     
  security-policy     
    rule name policy_sec_1      
      source-zone trust         
      destination-zone untrust  
      source-address 192.168.0.0 24
      source-address 2000::2 64
      action permit     
  #      
  nat-policy  
    rule name policy_nat_1      
      source-zone trust         
      destination-zone untrust  
      source-address 192.168.0.0 24
   action source-nat easy-ip        
  #     
  return     

• CGN配置脚本

  #
   sysname CGN       
  #     
   ipv6    
  #     
  firewall hash-mode source-only
  #     
   nat64 prefix 6000:: 96       
  #     
  interface GigabitEthernet1/0/0
   undo shutdown     
   ip address 1.1.1.1 255.255.255.0
  #     
  interface GigabitEthernet1/0/1
   undo shutdown        
   ipv6 enable
   ipv6 address 5000::1/64      
   ospfv3 1 area 0.0.0.2     
  #     
  interface GigabitEthernet1/0/2
   undo shutdown      
   ip address 10.1.2.1 255.255.255.0 
  #     
  interface GigabitEthernet1/0/3
   undo shutdown      
   ipv6 enable
   ipv6 address 4000::1/64   
   ospfv3 1 area 0.0.0.0    
  #     
  firewall zone local   
   set priority 100    
  #     
  firewall zone trust   
   set priority 85     
   add interface GigabitEthernet1/0/2
   add interface GigabitEthernet1/0/3
  #     
  firewall zone untrust   
   set priority 5    
   add interface GigabitEthernet1/0/0
   add interface GigabitEthernet1/0/1
  #     
  firewall zone dmz     
   set priority 50 
  #     
  security-policy    
   rule name policy1    
    source-zone trust     
    destination-zone untrust 
    destination-address 1.1.1.0 24 
    destination-address 5000:: 64   
    action permit       
  #      
  nat address-group addressgroup1
  mode pat    
   port-block-size 256       
   route enable
   section 1 1.1.2.1 1.1.2.5
  nat address-group addressgroup2
  nat-type nat64
  mode pat      
   route enable
   section 1 1.1.2.11 1.1.2.15
  #     
  nat-policy  
    rule name policy_nat_1   
      source-zone trust      
      destination-zone untrust  
      source-address 10.1.1.0 24
      action source-nat address-group addressgroup1  
    rule name policy_nat64      
      source-zone trust         
      destination-zone untrust  
      source-address 2000:: 64
      action source-nat address-group addressgroup2 
  #     
  firewall interzone trust untrust   
   detect ftp 
  #     
  ospfv3 1    
   router-id 2.2.2.2            
   import-route static          
  #     
   ipv6 route-static 6000:: 96 NULL0 
  #     
  return     

当CGN设备为Eudemon8000E-X系列时，如果配置端口预分配功能，必须将HASH选板模式设置为源地址HASH模式。

整个解决方案的配置流程如表1-15所示。

• 验证IPv4业务
  1. 配置完成后，在私网IPv4 PC1上可以访问IPv4公网Server的FTP服务。

     C:\Documents and Settings\Administrator>ftp 1.1.3.1 
     Connected to 1.1.3.1. 
     220 FTP service ready. 
     User (1.1.3.1:(none)): admin 
     331 Password required for admin. 
     Password: 
     230 User logged in. 
     ftp>

  2. 在CPE设备上通过执行display firewall session table verbose命令，查看详细的会话信息。

     [CPE] display firewall session table verbose 
      Current Total Sessions : 2    
       ftp  VPN:public --> public  ID: ab016391fa4c03558d54c16fac122 
       Zone: trust--> untrust  TTL: 00:10:00  Left: 00:09:59
       Interface: Tunnel1  NextHop: 1.1.3.1  MAC: 0000-0000-0000 
       <--packets:8 bytes:498   -->packets:12 bytes:541  
       192.168.0.2:1035+->1.1.3.1:21  PolicyName: ---  
      
       ftp-data  VPN:public --> public  ID: ab016391fa4c03558d54c16acd159 
       Zone: untrust--> trust  TTL: 00:00:10  Left: 00:00:00 
       Interface: GigabitEthernet1/0/0  NextHop: 192.168.0.2  MAC: 0018-826f-b3f4  
       <--packets:3 bytes:124   -->packets:5 bytes:370  
       1.1.3.1:20-->192.168.0.2:1036  PolicyName: ---  

     通过显示信息可以看出，数据的出接口Tunnel1接口，说明隧道配置成功。

• 验证IPv6业务
  1. 从CPE设备ping CGN连接城域网IPv6网络的接口地址，即GigabitEthernet 1/0/2的接口地址。

     <CPE> ping ipv6 4000::1 
       PING 4000::1 : 56  data bytes, press CTRL_C to break 
         Reply from 4000::1   
         bytes=56 Sequence=1 hop limit=64  time = 90 ms     
         Reply from 4000::1                    
         bytes=56 Sequence=2 hop limit=64  time = 100 ms   
         Reply from 4000::1
         bytes=56 Sequence=3 hop limit=64  time = 40 ms      
         Reply from 4000::1
         bytes=56 Sequence=4 hop limit=64  time = 60 ms   
         Reply from 4000::1
         bytes=56 Sequence=5 hop limit=64  time = 40 ms
                                                  
       --- 4000::1 ping statistics ---  
         5 packet(s) transmitted       
         5 packet(s) received
       0.00% packet loss             
         round-trip min/avg/max = 40/66/100 ms

     可以ping通，说明CPE设备与CGN上都有到达对方的IPv6路由。此时在CPE设备和CGN通过执行display ospfv3 routing命令，可以查看到各自的OSPFv3路由表。

     [CPE] display ospfv3 routing 
     OSPFv3 Process (1)                        
        Destination                                           Metric  
          Next-hop 
          2000::/64                                           1    
          directly connected, GigabitEthernet1/0/1    
          3000::/64                                           1    
          directly connected, GigabitEthernet1/0/2      
       IA 4000::/64                                           2   
           via FE80::218:82FF:FE39:1E5C, GigabitEthernet1/0/2     
       IA 5000::/64                                           3 
           via FE80::218:82FF:FE39:1E5C, GigabitEthernet1/0/2

     通过OSPFv3路由表，可以看到CPE设备已经学习到CGN连接城域网IPv6网络的接口网段和连接IPv6 Internet的接口网段的路由。

     [CGN] display ospfv3 routing 
     OSPFv3 Process (1)       
        Destination                                                 Metric 
          Next-hop       
       IA 2000::/64                                                 3
            via FE80::222:A1FF:FE30:22, GigabitEthernet1/0/2        
       IA 3000::/64                                                 2
            via FE80::222:A1FF:FE30:22, GigabitEthernet1/0/2     
          4000::/64                                                 1
           directly connected, GigabitEthernet1/0/2        
          5000::/64                                                 1
          directly connected, GigabitEthernet1/0/1  

     通过OSPFv3路由表，可以看到CGN已经学习到CPE设备连接城域网IPv6网络的接口网段和连接IPv6用户的接口网段的路由。

  2. 在PC2上ping PC3的地址。

     C:\> ping6 5000::2 
     from 2000::2 with 32 bytes of data: 
     Reply from 5000::2: time<1ms 
     Reply from 5000::2: time<1ms 
     Reply from 5000::2: time<1ms 
     Reply from 5000::2: time<1ms 
     Ping statistics for 5000::2: 
         Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), 
     Approximate round trip times in milli-seconds: 
         Minimum = 0ms, Maximum = 0ms, Average = 0ms

     可以ping通，说明整个网络中IPv6路由配置没有问题。

• IPv6用户访问IPv4公网资源
  1. 在PC2上ping www.example.com。

     Pinging 6000::ca01:301 with 32 bytes of data: 
      
     Reply from 6000::ca01:301: time=23ms 
     Reply from 6000::ca01:301: time=6ms 
     Reply from 6000::ca01:301: time=12ms 
     Reply from 6000::ca01:301: time=33ms 
      
     Ping statistics for 6000::ca01:301: 
         Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), 
     Approximate round trip times in milli-seconds: 
         Minimum = 6ms, Maximum = 33ms, Average = 18ms

     PC可以Ping通Server的IPv4地址。

  2. 在CGN的任意视图下执行display firewall ipv6 session table，查看NAT64的会话表信息。

     <CGN> display firewall ipv6 session table 
      Slot: 6 CPU: 1         
     NAT64: icmp6 VPN: public --> public  2000::2.44152[1.1.2.14:10296] --> 6000::CA01:301.2048[1.1.3.1:2048]

     由NAT64会话表得知IPv6与IPv4地址的转换关系。

• CPE配置脚本

  # 
   sysname CPE  
  #      
   ipv6  
  #      
  interface GigabitEthernet1/0/0
   ip address 192.168.0.1 255.255.255.0  
  #      
  interface GigabitEthernet1/0/1
   ipv6 enable  
   ipv6 address 2000::1/64   
   ospfv3 1 area 0.0.0.1    
  #      
  interface GigabitEthernet1/0/2
   ipv6 enable  
   ipv6 address 3000::1/64    
   ospfv3 1 area 0.0.0.0   
  #      
  interface Tunnel1        
   ip address 10.1.1.1 255.255.255.0   
   tunnel-protocol ipv4-ipv6    
   source 3000::1
  destination  4000::1     
  #      
  firewall zone local     
   set priority 100    
  #      
  firewall zone trust       
   set priority 85      
   add interface GigabitEthernet1/0/0  
   add interface GigabitEthernet1/0/1  
  #      
  firewall zone untrust     
   set priority 5
  add interface GigabitEthernet1/0/2  
   add interface Tunnel1   
  #      
  security-policy
  rule name policy1      
    source-zone trust       
    destination-zone untrust   
    source-address 192.168.0.0 24 
    source-address 2000:: 64 
    action permit
  rule name policy2    
    source-zone local    
    destination-zone untrust    
    source-address 10.1.1.0 24 
    action permit    
  #      
  firewall zone dmz    
   set priority 50    
  #      
  ospfv3 1
  router-id 1.1.1.1     
   area 0.0.0.0 
   area 0.0.0.1 
  #      
   ip route-static 0.0.0.0 0.0.0.0 Tunnel1 
  #      
  return

• CGN配置脚本

  # 
   sysname CGN        
  #      
   ipv6  
  #      
  firewall hash-mode source-only
  #      
   nat address-group 1  
    section 1 1.1.2.1 1.1.2.5
  #      
   nat address-group 1  
    section 1 1.1.2.11 1.1.2.15  
  #      
   nat64 prefix 6000:: 96  
  #      
  interface GigabitEthernet1/0/0
   undo shutdown
   ip address 1.1.1.1 255.255.255.0  
  #      
  interface GigabitEthernet1/0/1
   undo shutdown
   ipv6 enable  
   ipv6 address 5000::1/64      
   ospfv3 1 area 0.0.0.2    
  #      
  interface GigabitEthernet1/0/2
   undo shutdown
   ipv6 enable  
   ipv6 address 4000::1/64   
   ospfv3 1 area 0.0.0.0   
  #      
  interface Tunnel1     
   ip address 10.1.1.2 255.255.255.0   
   tunnel-protocol ipv4-ipv6 ds-lite  
   source 4000::1     
  #      
  firewall zone local     
   set priority 100     
  #      
  firewall zone trust     
   set priority 85     
   add interface GigabitEthernet1/0/2  
   add interface Tunnel1   
  #      
  firewall zone untrust   
   set priority 5
  add interface GigabitEthernet1/0/0  
   add interface GigabitEthernet1/0/1    
  #      
  firewall zone dmz    
   set priority 50     
  #      
  security-policy
  rule name policy1      
    source-zone trust       
    destination-zone untrust  
    destination-address 1.1.1.0 24 
    destination-address 5000::  64  
    action permit
  rule name policy2     
    source-zone trust     
    destination-zone local      
    destination-address 10.1.1.0 24
    action permit     
  #       
  nat address-group addressgroup1
  route enable  
   section 1 1.1.2.1 1.1.2.5
  nat address-group addressgroup2
  mode pat    
   route enable  
   section 1 1.1.2.11 1.1.2.15
  # 
  nat-policy    
    rule name policy_nat_1      
      nat-type ds-lite 
      source-zone trust    
      destination-zone untrust  
      source-address 3000::1 64
      action source-nat address-group addressgroup1
    rule name policy_nat64   
      nat-type nat64 
      source-zone trust    
      destination-zone untrust  
      source-address 2000:: 64
      action source-nat address-group addressgroup2 
  #      
  firewall interzone trust untrust
   detect ftp   
   #      
  ospfv3 1
  router-id 2.2.2.2      
   import-route static    
  #      
   ipv6 route-static 6000:: 96 NULL0    
  #      
  return