首页 科技问答 郭尧,SR88配置AFT ipv6大包不通

郭尧,SR88配置AFT ipv6大包不通

科技问答 410
1676537604,

组网及说明


如图:

SR88作为AFT设备,下行RT1配置ipv6 2019::1网段地址,上行RT2侧为XX.33.1.Y网段ipv4地址。目前客户实现需求是在SR88上做静态AFT映射,将下行V6地址转换为一个XX.64.128.1的网段v4地址,并在SR88上配置对应的loop地址,由v4侧访问此XX.64.128.1地址来映射到v6侧,实现V4 V6互访。

问题描述

所有路由已全部打通,会发现存在V4ping 访问V6侧大于1452报文不通的问题。

首先,简单看下AFT设备上的相关配置。

aft prefix-nat64 2012:: 96

aft prefix-ivi 2019::

aft v6tov4 source 2019::1 XX.64.128.1

aft v4tov6 destination acl number 3100 prefix-ivi 2019::

 

#

acl advanced 3100

 rule 1 permit ip destination XX.64.128.0 0.0.0.255

 rule 1000 deny ip

这个配置在实验室本地复现是可以实现正常映射关系的,也就AFT部分配置是没有问题的。接口MTU均为默认1500,未变更过。

过程分析

V4ping大于1452报文(大小大约为1500)问题复现的同时,打开设备上的debug ip packet信息整理如下:

d*Aug 21 13:24:22:377 2022 SR88-AFT IPFW/7/IPFW_PACKET: -MDC=1-Slot=3;

Receiving, interface = Route-Aggregation1----------------------------------------------------------------------上行聚合口1收到RT2访问目的地址为128.1的报文,大小为1500

version = 4, headlen = 20, tos = 0

pktlen = 1500, pktid = 13089, offset = 0, ttl = 62, protocol = 1

checksum = 7183, s = XX.33.1.Y, d = XX.64.128.1

channelID = 0, vpn-InstanceIn = 0, vpn-InstanceOut = 0.

prompt: Receiving IP packet from interface Route-Aggregation1.

Payload: ICMP

  type = 8, code = 0, checksum = 0x3496.

 

 

*Aug 21 13:24:22:378 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

LocalSending, version = 6, traffic class = 0,

flow label = 0, payload length = 1240, protocol = 44, hop limit = 61,--------------------------------------------------分片后,转换为V6的目的地址2019::1

Src = 2012::4321:18f, Dst = 2019::1,

prompt: Output an IPv6 Packet.

 

*Aug 21 13:24:22:378 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

LocalSending, version = 6, traffic class = 0,

flow label = 0, payload length = 256, protocol = 44, hop limit = 61,

Src = 2012::4321:18f, Dst = 2019::1,------另一个分片转换为V6源目地址。

prompt: Output an IPv6 Packet.

 

*Aug 21 13:24:22:378 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

Sending, interface = Route-Aggregation2, version = 6, traffic class = 0,----------------------------------------------从下行聚合口2发给RT1设备

flow label = 0, payload length = 1240, protocol = 44, hop limit = 61,

Src = 2012::4321:18f, Dst = 2019::1,

prompt: Sending the packet from local interface Route-Aggregation2.

 

*Aug 21 13:24:22:378 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

LocalSending, version = 6, traffic class = 0,

flow label = 0, payload length = 256, protocol = 44, hop limit = 61,----------------------------------------------同上,第二个分片报文大小为256

Src = 2012::4321:18f, Dst = 2019::1,

prompt: Output an IPv6 Packet.

 

*Aug 21 13:24:22:378 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

Sending, interface = Route-Aggregation2, version = 6, traffic class = 0,

flow label = 0, payload length = 256, protocol = 44, hop limit = 61,

Src = 2012::4321:18f, Dst = 2019::1,

prompt: Sending the packet from local interface Route-Aggregation2.

 

*Aug 21 13:24:49:880 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

Receiving, interface = Route-Aggregation2, version = 6, traffic class = 0,------------------------------------收到回程v6报文

flow label = 0, payload length = 1456, protocol = 44, hop limit = 64,

Src = 2019::1, Dst = 2012::4321:18f,

prompt: Received an IPv6 packet.

 

*Aug 21 13:24:49:880 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

Sending, interface = NULL0, version = 6, traffic class = 0,

flow label = 0, payload length = 1456, protocol = 44, hop limit = 63,

Src = 2019::1, Dst = 2012::4321:18f,

prompt: Sending the packet from Route-Aggregation2 through NULL0.

 

*Aug 21 13:24:49:880 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

Receiving, interface = Route-Aggregation2, version = 6, traffic class = 0,

flow label = 0, payload length = 68, protocol = 44, hop limit = 64,----------------------------------------------------后面就一直没有转回v4

Src = 2019::1, Dst = 2012::4321:18f,

prompt: Received an IPv6 packet.

 

*Aug 21 13:24:49:881 2022 SR88-AFT IP6FW/7/IP6FW_PACKET: -MDC=1-Slot=3;

Sending, interface = NULL0, version = 6, traffic class = 0,

flow label = 0, payload length = 68, protocol = 44, hop limit = 63,

Src = 2019::1, Dst = 2012::4321:18f,

prompt: Sending the packet from Route-Aggregation2 through NULL0.

 

解决方法

因为下行RT1以及SR88接口mtu均为默认值,转发V4报文变为V6后,报文长度变长,SR88转发出去已分为两个分片报文。RT1再次发回来后仍为两个分片报文,而目前设备机制不支持对ipv6分片报文进行AFT转换,导致了报文无法正确转换回ipv4报文发回RT2

因此产生了ping大包会不通的现象,该问题可以暂时通过将SR88 V6侧以及RT1对接接口mtu值调大,来暂时规避。后续平台会有相应策略优化。

CRM论坛(CRMbbs.com)——一个让用户更懂CRM的垂直性行业内容平台,CRM论坛致力于互联网、客户管理、销售管理、SCRM私域流量内容输出5年。 如果您有好的内容,欢迎向我们投稿,共建CRM多元化生态体系,创建CRM客户管理一体化生态解决方案。本文来源:知了社区基于知识共享署名-相同方式共享3.0中国大陆许可协议,SR88配置AFT ipv6大包不通