6RD隧道实验配置-CSDN博客

FW1配置

interface Tunnel1

ipv6 enable

ipv6 address 2409:D00:1::1/48 配置隧道的6to4地址

tunnel-protocol ipv6-ipv4 6rd

source 13.0.0.1              隧道源IP地址

ipv6-prefix 2409::/16         ipv6前缀

ipv4-prefix length 0          ipv4前缀长度（与IPv6前缀生成IPv6委托前缀）

display interface Tunnel 1 可以看到生成的委托前缀

FW2配置

interface Tunnel1

ipv6 enable

ipv6 address 2409:1700:2::1/48

tunnel-protocol ipv6-ipv4 6rd

source 23.0.0.2

ipv6-prefix 2409::/16

ipv4-prefix length 0

配置路由

FW1配置

ip route-static 0.0.0.0 0.0.0.0 13.0.0.3 IPv4的路由，用来建立隧道和封装在外网传输

ipv6 route-static :: 0 Tunnel1 IPv6的路由，用于IPv6网络内主机互访

FW2配置

ip route-static 0.0.0.0 0.0.0.0 23.0.0.3

ipv6 route-static :: 0 Tunnel1

配置安全策略

FW1与FW2共同配置

建立隧道的策略

security-policy

rule name tunnel

source-zone local

source-zone untrust

destination-zone local

destination-zone untrust

source-address 13.0.0.1 mask 255.255.255.255

source-address 23.0.0.2 mask 255.255.255.255

destination-address 13.0.0.1 mask 255.255.255.255

destination-address 23.0.0.2 mask 255.255.255.255

action permit

IPv6网络互访的策略

rule name ipv6_data

source-zone trust

destination-zone dmz

source-zone dmz

destination-zone trust

action permit

配置6RD—IPv6隧道

FW2的隧道配置不变，只是FW1上配置的IPv6路由与隧道改变了

FW1配置

隧道配置

interface Tunnel1

ipv6 enable

ipv6 address 2409:D00:1::1/48

tunnel-protocol ipv6-ipv4 6rd

source 13.0.0.1

ipv6-prefix 2409::/16

ipv4-prefix length 0

border-relay address 23.0.0.2 直接指定6RD-BR的IP地址