CLI: Example for Configuring a Private IPv6 Network User to Access a Public IPv4 Network Server (Access from a Virtual System to the Public System)

Networking Requirements

As shown in Figure 1, virtual system vsysa supports IPv4/IPv6 dual stack and connects to IPv6 and IPv4 networks. It is required that a PC on the private IPv6 network be able to access a server on the public IPv4 network through domain name www.example.com and across the public system and virtual system.

Figure 1 Networking diagram of virtual system dynamic NAT64

Usually, the NAT64 is deployed with the DNS64. The DNS64 performs domain name translation. The prefix and length configured for the DNS64 are the same as those of the NAT64 device.

Procedure

Configure IP addresses, routes, and security policies on the public system.

On the public system, set IP addresses for the interfaces and assign the interfaces to security zones. The IP address of Virtual-if0 can be any value as long as it is not in conflict with the IP address on any other interface.

[FW] interface GigabitEthernet 0/0/2
[FW-GigabitEthernet0/0/2] ip address 1.1.1.1 24
[FW-GigabitEthernet0/0/2] quit
[FW] interface Virtual-if 0
[FW-virtual-if0] ip address 172.16.0.1 24
[FW-virtual-if0] quit
[FW] firewall zone trust
[FW-zone-trust] add interface Virtual-if 0
[FW-zone-trust] quit
[FW] firewall zone untrust
[FW-zone-untrust] add interface GigabitEthernet 0/0/2
[FW-zone-untrust] quit

# Configure a static route to the IPv4 network.

[FW] ip route-static 2.2.2.0 24 1.1.1.254

# Configure a security policy.

[FW] security-policy
[FW-policy-security] rule name policy_sec_1
[FW-policy-security-rule-policy_sec_1] source-zone trust
[FW-policy-security-rule-policy_sec_1] destination-zone untrust
[FW-policy-security-rule-policy_sec_1] destination-address 2.2.2.2 24
[FW-policy-security-rule-policy_sec_1] action permit
[FW-policy-security-rule-policy_sec_1] quit
[FW-policy-security] quit

Create virtual system vsysa and assign an interface and a public address to it.
# Enable the virtual system function.
```
<FW> system-view
[FW] vsys enable
```
# Create a virtual system and assign an interface and a public address to it. The public address is used in the NAT address pool.
```
[FW] vsys name vsysa
[FW-vsys-vsysa] assign interface GigabitEthernet 0/0/1
[FW-vsys-vsysa] assign global-ip 1.1.1.6 1.1.1.10 exclusive
[FW-vsys-vsysa] quit
```

Configure IP addresses, routes, and security policies on the virtual system.

# Enable IPv6.

[FW] ipv6

# Configure a static route to the IPv6 network.

[FW] ipv6 route-static vpn-instance vsysa 2001:: 64 1::2

# Access the virtual system configuration view.

[FW] switch vsys vsysa

# Set an IP address for an interface and assign the interface to a security zone.

The IP address of Virtual-if1 can be any value as long as it is not in conflict with the IP address on any other interface.

The IDs of Virtual-if interfaces are randomly assigned from available IDs in the system. Therefore, in the actual configuration, the interface may not be Virtual-if 1.

<FW-vsysa> system-view
[FW-vsysa] interface GigabitEthernet 0/0/1
[FW-vsysa-GigabitEthernet0/0/1] ipv6 enable
[FW-vsysa-GigabitEthernet0/0/1] ipv6 address 1::1 64
[FW-vsysa-GigabitEthernet0/0/1] quit
[FW-vsysa] interface Virtual-if 1
[FW-vsysa-Virtual-if1] ip address 172.16.1.1 24
[FW-vsysa-Virtual-if1] quit
[FW-vsysa] firewall zone trust
[FW-vsysa-zone-trust] add interface GigabitEthernet 0/0/1
[FW-vsysa-zone-trust] add interface Virtual-if 1
[FW-vsysa-zone-trust] quit

# Configure a static route to the public system.

[FW-vsysa] ip route-static 2.2.2.2 32 public

# Configure a security policy.

[FW-vsysa] security-policy
[FW-vsysa-policy-security] rule name policy_sec_2
[FW-vsysa-policy-security-rule-policy_sec_2] source-zone trust
[FW-vsysa-policy-security-rule-policy_sec_2] destination-zone trust
[FW-vsysa-policy-security-rule-policy_sec_2] source-address 2001:: 64
[FW-vsysa-policy-security-rule-policy_sec_2] action permit
[FW-vsysa-policy-security-rule-policy_sec_2] quit

Configure NAT64.

# Enable the NAT64 function on the IPv6 network interface.

[FW-vsysa] interface GigabitEthernet 0/0/1
[FW-vsysa-GigabitEthernet0/0/1] nat64 enable
[FW-vsysa-GigabitEthernet0/0/1] quit

# Set the NAT64 prefix to 3001::/96.

[FW-vsysa] nat64 prefix 3001:: 96

In this example, the NAT64 prefix is 3001:: 96. If the prefix is left unconfigured, a well-known prefix is used by default.

# Configure IPv4 NAT address pool addressgroup1 and set the address range to 1.1.1.6 to 1.1.1.10. Use the addresses in the NAT address pool as the IPv4 addresses after the NAT64 processing.

[FW-vsysa] nat address-group addressgroup1
[FW-vsysa-address-group-addressgroup1] mode pat
[FW-vsysa-address-group-addressgroup1] section 1 1.1.1.6 1.1.1.10
[FW-vsysa-address-group-addressgroup1] quit

# Configure dynamic NAT64 mapping.

[FW-vsysa] nat-policy
[FW-vsysa-policy-nat] rule name policy_nat64
[FW-vsysa-policy-nat-rule-policy_nat64] nat-type nat64
[FW-vsysa-policy-nat-rule-policy_nat64] source-zone trust
[FW-vsysa-policy-nat-rule-policy_nat64] destination-zone trust
[FW-vsysa-policy-nat-rule-policy_nat64] source-address 2001:: 64
[FW-vsysa-policy-nat-rule-policy_nat64] action source-nat address-group addressgroup1
[FW-vsysa-policy-nat-rule-policy_nat64] quit
[FW-vsysa-policy-nat] quit

Configure the DNS64 device.
# Set the IPv6 prefix of the DNS64 device to the NAT64 prefix of the FW, namely, 3001::/96.

# Configure a route from the DNS64 to the PC to ensure reachability.
Configure the IPv6 address, route, and DNS of the PC. (The configuration methods of IPv6 addresses and routes vary with the operating systems of the PCs. The configuration methods are not described here.)
# Set the IPv6 address of the PC to 2001::1/64.

# Configure a route from the PC to the network segment 3001::/96 and set the next hop to the address of the IPv6 network egress router.

# Set the DNS address of the PC to the IPv6 address of the DNS64 device.
Configure the IPv4 address and route of the server. (The method of setting the IPv4 address is determined by the operating system of the server. The setting method is not described here.)
# Set the IPv4 address of the server to 2.2.2.2/24.

# Configure a route from the server to the address range 1.1.1.6 to 1.1.1.10. The next hop of the route is the address of the IPv4 network egress router.

Verification

Access www.example.com from the PC. The access succeeds.

Check NAT64 session table information.

<FW> display firewall ipv6 session table verbose vsys vsysa
 Current Total IPv6 Sessions : 1
 NAT64: icmpv6  VPN: vsysa --> vsysa  ID: a48f34fda4a30c993571015f1
 Zone: untrust --> trust TTL: 00:00:45  Left: 00:00:45
 Interface: GigabitEthernet0/0/1 NextHop: 1.1.1.254 MAC: 0000-0000-0000
 <--packets: 25 bytes: 2,600 --> packets: 25 bytes: 2,600
 2001::1.44019[1.1.1.7:2051] --> 3001::202:202.2048[2.2.2.2:2048] PolicyName: policy_sec_1

Configuration Scripts

Configuration script of the public system:

#                                                                               
 ipv6
# 
 vsys enable 
# 
vsys name vsysa 1    
 assign interface GigabitEthernet0/0/1
 assign global-ip 1.1.1.6 1.1.1.10 exclusive
#                                                                               
interface GigabitEthernet0/0/1                                                  
 ip address 1.1.1.1 255.255.255.0                                               
#                                                                               
interface  Virtual-if 0                                                  
 ip address 172.16.0.1 24
#                    
firewall zone trust  
 set priority 85     
 add interface Virtual-if 0
#                    
firewall zone untrust
 set priority 5      
 add interface GigabitEthernet0/0/2                                            
#  
 ip route-static 2.2.2.0 24 1.1.1.254
 ipv6 route-static vpn-instance vsysa 2001:: 64 1::2
#                                                                               
security-policy                                                                 
  rule name policy_sec_1                                                        
    source-zone trust                                                           
    destination-zone untrust                                                    
    destination-address 2.2.2.2 24                                                  
    action permit    
#                                                                                
return

Configuration script of vsysa:

#
switch vsys vsysa
#                                                                               
interface GigabitEthernet0/0/1                                                  
 ipv6 enable
 ipv6 address 1::1/64
 nat64 enable

#                                                                               
interface Virtual-if 1
 ip address 172.16.1.1 24
#                    
firewall zone trust  
 set priority 85     
 add interface GigabitEthernet0/0/1
 add interface Virtual-if 1
#
nat address-group addressgroup1
 mode pat                                                                        
 section 1 1.1.1.6 1.1.1.10
#  
 nat64 prefix 3001:: 96   
#  
 ip route-static 2.2.2.2 32 public
#                                                                               
security-policy                                                                 
  rule name policy_sec_1                                                        
    source-zone untrust                                                           
    destination-zone trust                                                    
    source-address 2001:: 64                                                  
    action permit                                                               
#                                                                                
nat-policy                                                                      
  rule name policy_nat64                                                        
    source-zone untrust                                                           
    destination-zone trust                                                    
    nat-type nat64
    source-address 2001:: 64                                                  
    action source-nat address-group addressgroup1
#
return