IPv6应用
域名系统
IPv4中A记录用来将主机名称映射到一个V4地址,AAAA资源记录将主机名映射到一个IPv6地址。
![image-20200803205415650](/2020/08/03/ipv6-guo-du-ji-zhu-yu-ying-yong/image-20200803205415650.png)
- R1和R2为双栈路由器(下面会详细解释),R1的配置如下(R2配置略)
ipv6 unicast-routing
ip name-server 192.168.12.2
ip name-server 2012::2
ip domain lookup
interface Ethernet0/0
ip address 192.168.12.1 255.255.255.0
ipv6 address 2012::1/64
ipv6 enable
- 在R1上
ping baidu.com
![image-20200803205933599](/2020/08/03/ipv6-guo-du-ji-zhu-yu-ying-yong/image-20200803205933599.png)
R1首先会通过IPv4网络去查找AAA记录,随后又会通过IPv6网络去AAAA记录,发现都没有回应,那么又用IPv4网络去查找A记录,没回应,又用IPv6网络查找了一次A记录。
所以在同时有IPv4和IPv6的情况下,会优先查找AAAA记录。
在R2上添加如下配置后,R1就可以正常
ping baidu.com
ip dns server
ipv6 host baidu.com 2012::2
R1#ping baidu.com
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2012::2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
ACL
ipv6 access-list x # 进入acl配置模式
ipv6 traffic-filter # 在接口下应用
IPv6过渡技术
现状
- 目前国内IPv4依旧是主流,并且在未来很长一段时间内依旧无法被替代
- IPv6目前已经作为国家的一个推广目标,已经在手机移动网络中普及开来,虽然对于大家来说好像没啥感觉
- 为了能加快普及IPv6,就必须先让IPv6和IPv4可以共生,这个就是研究过渡技术的必要性
双栈
![image-20200803211010713](/2020/08/03/ipv6-guo-du-ji-zhu-yu-ying-yong/image-20200803211010713.png)
网络中的主机、路由器或服务器等设备如果支持双栈(IPv4及IPv6协议栈),那么可以同时使用V4和V6的协议栈。在双栈设备上,上层应用会优先选择IPv6协议栈,而不是IPv4。比如,一个同时支持v4和v6的应用请求地址,会先请求AAAA记录,如果没有,则在请求A记录。
上面已经给大家演示过双栈了,这边配置就省略了
![image-20200803205415650](/2020/08/03/ipv6-guo-du-ji-zhu-yu-ying-yong/image-20200803205415650.png)
隧道
- 隧道并不能实现IPv6和IPv4”融洽”的在一起,仅仅只是为了解决孤岛的问题,使用隧道现阶段最主要解决的还是IPv6孤岛怎么跨越IPv4网络连接在一起
![image-20200803211702863](/2020/08/03/ipv6-guo-du-ji-zhu-yu-ying-yong/image-20200803211702863.png)
![image-20200803211712775](/2020/08/03/ipv6-guo-du-ji-zhu-yu-ying-yong/image-20200803211712775.png)
手工IPv6 over IP隧道
![image-20200803211945201](/2020/08/03/ipv6-guo-du-ji-zhu-yu-ying-yong/image-20200803211945201.png)
- R2上的关键配置如下
ipv6 unicast-routing
interface Tunnel0
no ip address
ipv6 enable
tunnel source Ethernet0/1
tunnel mode ipv6ip
tunnel destination 192.168.34.4
ipv6 route ::/0 Tunnel0
- 检查最终结果
R1#ping 2045::5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2045::5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/10/46 ms
- 抓包查看
![image-20200803212548707](/2020/08/03/ipv6-guo-du-ji-zhu-yu-ying-yong/image-20200803212548707.png)
隧道代理
![image-20200803212710821](/2020/08/03/ipv6-guo-du-ji-zhu-yu-ying-yong/image-20200803212710821.png)
- 通过一台代理服务器获取隧道的配置文件,然后和目的地建立隧道
- 现在公网上有很多的免费IPv6隧道代理服务器
隧道服务器
![image-20200803213026177](/2020/08/03/ipv6-guo-du-ji-zhu-yu-ying-yong/image-20200803213026177.png)
- 直接通过一台双栈的服务器可以访问IPv6网络
- 目前很多主机服务商都提供免费的IPv6地址
6to4自动隧道
![image-20200803213318933](/2020/08/03/ipv6-guo-du-ji-zhu-yu-ying-yong/image-20200803213318933.png)
- 通过计算将IPv4地址和IPv6地址互相转换来实现两端的IPv6孤岛通信
![image-20200328203952578](/2020/08/03/ipv6-guo-du-ji-zhu-yu-ying-yong/image-20200328203952578.png)
让两个IPv6地址之间自动建立隧道
修改上面的手工隧道
R2(config)#int tu 0
R2(config-if)#no tu des 192.168.34.4
R2(config-if)#tu mo ipv6ip 6to4
R2(config-if)#int e0/0
R2(config-if)#ipv add 2002:c0a8:1702::2/64
# 这个地址中的c0a8:1701是计算R2的IPv4地址得到的
R2(config-if)#no ipv nd ra su
R2(config-if)#no ipv route ::/0 tu 0
R2(config)#ipv route 2002::/16 tu 0
R1(config)#no ipv route ::/0 2012::2
R1(config)#int e0/0
R1(config-if)#no ipv6 address
R1(config-if)#ipv6 add autoconfig default
R1#sh ipv int br
Ethernet0/0 [up/up]
FE80::A8BB:CCFF:FE00:1000
2002:C0A8:1702:0:A8BB:CCFF:FE00:1000
R4(config)#int tu 0
R4(config-if)#tu mo ipv6ip 6to4
R4(config-if)#no ipv route ::/0 tu 0
R4(config)#ipv route 2002::/16 tu 0
R4(config)#int e0/1
R4(config-if)#no ipv6 address
R4(config-if)#ipv add 2002:c0a8:2204::4/64
R4(config-if)#no ipv nd ra su
R5(config)#no ipv route ::/0 2045::4
R5(config)#int e0/0
R5(config-if)#no ipv add
R5(config-if)#ipv add autoconfig default
R5#show ipv int br
Ethernet0/0 [up/up]
FE80::A8BB:CCFF:FE00:5000
2002:C0A8:2204:0:A8BB:CCFF:FE00:5000
测试连通性
R1#ping 2002:C0A8:2204:0:A8BB:CCFF:FE00:5000
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2002:C0A8:2204:0:A8BB:CCFF:FE00:5000, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/18 ms
抓包查看
![image-20200328211605118](/2020/08/03/ipv6-guo-du-ji-zhu-yu-ying-yong/image-20200328211605118.png)
要注意的是6to4的隧道技术,不支持动态路由协议
GRE隧道
![image-20200328203952578](/2020/08/03/ipv6-guo-du-ji-zhu-yu-ying-yong/image-20200328203952578-1596461776464.png)
R1
ipv6 unicast-routing
interface Loopback0
ip address 1.1.1.1 255.255.255.255
interface Ethernet0/0
ipv6 address 2012::1/64
ospfv3 1 ipv6 area 0
===============================
R2
ipv6 unicast-routing
interface Loopback0
ip address 2.2.2.2 255.255.255.255
interface Tunnel0
ipv6 enable
ospfv3 1 ipv6 area 0
tunnel source Ethernet0/1
tunnel destination 192.168.34.4
interface Ethernet0/0
ipv6 address 2012::2/64
ospfv3 1 ipv6 area 0
interface Ethernet0/1
ip address 192.168.23.2 255.255.255.0
ip route 0.0.0.0 0.0.0.0 192.168.23.3
======================================
R3
interface Ethernet0/0
ip address 192.168.23.3 255.255.255.0
interface Ethernet0/1
ip address 192.168.34.3 255.255.255.0
===================================
R4
ipv6 unicast-routing
interface Loopback0
ip address 4.4.4.4 255.255.255.255
interface Tunnel0
ipv6 enable
ospfv3 1 ipv6 area 0
tunnel source Ethernet0/0
tunnel destination 192.168.23.2
interface Ethernet0/0
ip address 192.168.34.4 255.255.255.0
interface Ethernet0/1
ipv6 address 2045::4/64
ospfv3 1 ipv6 area 0
ip route 0.0.0.0 0.0.0.0 192.168.34.3
=======================================
R5
ipv6 unicast-routing
interface Loopback0
ip address 5.5.5.5 255.255.255.255
interface Ethernet0/0
ipv6 address 2045::5/64
ospfv3 1 ipv6 area 0
测试连通性
R1#ping 2045::5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2045::5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
ISATAP
- 原理类似于6to4自动隧道
- 很多高校都推出了免费的ISATAP服务器
- isatap.tsinghua.edu.cn 清华大学
- isatap.xauat.edu.cn 西安建筑科技大学
- isatap.sjtu.edu.cn 上海交通大学
NAT-PT
![image-20200328212006759](/2020/08/03/ipv6-guo-du-ji-zhu-yu-ying-yong/image-20200328212006759.png)
先配置单向的NAT,让R3访问192.168.23.1
的时候是R1来响应
R1
ipv6 unicast-routing
interface Ethernet0/0
ipv6 address 2012::1/64
ipv6 route ::/0 2012::2
===============================
R2
ipv6 unicast-routing
interface Ethernet0/0
ipv6 address 2012::2/64
ipv6 enable
ipv6 nat
interface Ethernet0/1
ip address 192.168.23.2 255.255.255.0
ipv6 enable
ipv6 nat
ipv6 nat v6v4 source 2012::1 192.168.23.1
ipv6 nat prefix 2002:1::/96
===============================
R3
interface Ethernet0/0
ip address 192.168.23.3 255.255.255.0
估计是模拟器bug无法ping通