Contents

Introduction· 1

Prerequisites· 1

Example: Configuring an ISATAP tunnel and a 6to4 tunnel 1

Network configuration· 1

Applicable hardware and software versions· 2

Restrictions and guidelines· 3

Procedures· 3

Configuring Device A· 3

Configuring Device B· 4

Configuring the ISATAP host 5

Verifying the configuration· 6

Configuration files· 6

 

Introduction

This document provides examples for configuring an ISATAP tunnel and a 6to4 tunnel.

Prerequisites

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of ISATAP tunneling and 6to4 tunneling.

Example: Configuring an ISATAP tunnel and a 6to4 tunnel

Network configuration

As shown in Figure 1, configure a 6to4 tunnel between Device A and Device B to allow communications between the headquarters and the branches over the IPv4 network.

Configure an ISATAP tunnel between Device A and the ISATAP host to allow the host in the IPv4 network to access the headquarters.

Figure 1 Network diagram

 

Table 1 Interface and IP address assignment

Device	Interface	IP address	Device	Interface	IP address
Device A	Vlan-int10	2.1.1.1/24	Device B	Vlan-int10	3.1.1.1/24
	Vlan-int20	2002:0201:0101:1::1/64		Vlan-int20	2002:0301:0101:1::1/64
	Vlan-int30	2002:0201:0101:2::1/64		Vlan-int30	2002:0301:0101:2::1/64
	Tunnel 1	3001::1/64		Tunnel 1	3001::2/64
	Tunnel 2	2001::5EFE:0201:0101/64

 

Applicable hardware and software versions

The following matrix shows the hardware and software versions to which this configuration example is applicable:

 

Hardware	Software version
S6520XE-HI switch series	Supported in Release 11xx
S5560X-EI switch series	Not supported
S5500V2-EI switch series	Not supported
MS4520V2-30F switch	Not supported
S5560S-EI switch series S5560S-SI switch series	Not supported
S5130S-HI switch series S5130S-EI switch series S5130S-SI switch series S5130S-LI switch series	Not supported
S5120V2-SI switch series S5120V2-LI switch series	Not supported
S3100V3-EI switch series S3100V3-SI switch series	Not supported
S5110V2 switch series	Not supported
S5110V2-SI switch series	Not supported
S5000V3-EI switch series	Not supported
S5000E-X switch series	Not supported
WAS6000 switch series	Not supported
E128C switch E152C switch E500C switch series E500D switch series	Not supported
MS4520V2 switch series (except the MS4520V2-30F switch)	Not supported
MS4320V2 switch series MS4300V2 switch series MS4320 switch series MS4200 switch series	Not supported
WS5850-WiNet switch series	Not supported
WS5820-WiNet switch series WS5810-WiNet switch series	Not supported

 

Restrictions and guidelines

When you configure an ISATAP tunnel and a 6to4 tunnel, follow these restrictions and guidelines:

·     You do not need to configure a destination address for a 6to4 tunnel, because the destination IPv4 address is embedded in the 6to4 IPv6 address whose format is 2002:IPv4-destination-address::/64.

·     You do not need to configure a destination address for an ISATAP tunnel, because the destination IPv4 address is embedded in the ISATAP address whose format is Prefix:0:5EFE:IPv4-destination-address.

·     Disable RA suppression on Device A and Device B to allow hosts to acquire address prefixes automatically. This configuration ensures that hosts in the same network use the same address prefix.

After RA suppression is disabled, the ISATAP host and hosts in the headquarters acquire address prefixes from RA messages advertised by Device A. Hosts in the branches acquire address prefixes from RA messages advertised by Device B.

·     A tunneled packet cannot be directly routed based on its destination address. The packet is sent to a tunnel-type service loopback group, which then delivers the packet to the forwarding module for Layer 3 forwarding. Therefore, you must configure a tunnel-type service loopback group. Otherwise, the tunnel interface will fail to forward and receive packets.

Procedures

Make sure Device A and Device B can reach each other through IPv4.

Configuring Device A

# Configure an IP address for VLAN-interface 10.

<DeviceA> system-view

[DeviceA] vlan 10

[DeviceA-vlan10] port Ten-GigabitEthernet 1/0/1

[DeviceA-vlan10] quit

[DeviceA] interface vlan-interface 10

[DeviceA-Vlan-interface10] ip address 2.1.1.1 24

[DeviceA-Vlan-interface10] quit

# Configure IP addresses for other interfaces as shown in Table 1. (Details not shown.)

# Create service loopback group 1 and specify its service type as tunnel.

[DeviceA] service-loopback group 1 type tunnel

# Add Ten-GigabitEthernet 1/0/4 to service loopback group 1.

[DeviceA] interface Ten-GigabitEthernet 1/0/4

[DeviceA-Ten-GigabitEthernet1/0/4] port service-loopback group 1

[DeviceA-Ten-GigabitEthernet1/0/4] quit

# Create a 6to4 tunnel interface Tunnel 1.

[DeviceA] interface tunnel 1 mode ipv6-ipv4 6to4

# Specify an IPv6 address for the tunnel interface.

[DeviceA-Tunnel1] ipv6 address 3001::1/64

# Specify the source interface as VLAN-interface 10 for the tunnel interface.

[DeviceA-Tunnel1] source vlan-interface 10

[DeviceA-Tunnel1] quit

# Configure a static route destined for 2002:0301:0101::/48 through the tunnel interface.

[DeviceA] ipv6 route-static 2002:0301:0101:: 48 tunnel 1

# Create an ISATAP tunnel interface Tunnel 2.

[DeviceA] interface tunnel 2 mode ipv6-ipv4 isatap

# Specify an IPv6 address for the tunnel interface.

[DeviceA-Tunnel2] ipv6 address 2001::5EFE:0201:0101 64

# Specify the source interface as VLAN-interface 10 for the tunnel interface.

[DeviceA-Tunnel2] source  vlan-interface 10

[DeviceA-Tunnel2] quit

# Configure a static route destined for 2001::/16 through the tunnel interface.

[DeviceA] ipv6 route-static 2001:: 16 tunnel 2

# Disable RA suppression.

[DeviceA] interface Tunnel 2

[DeviceA-Tunnel2] undo ipv6 nd ra halt

[DeviceA-Tunnel2] quit

[DeviceA] interface vlan-interface 20

[DeviceA-Vlan-interface20] undo ipv6 nd ra halt

[DeviceA-Vlan-interface20] quit

[DeviceA] interface  vlan-interface 30

[DeviceA-Vlan-interface30] undo ipv6 nd ra halt

[DeviceA-Vlan-interface30] quit

Configuring Device B

# Configure an IP address for VLAN-interface 10.

<DeviceB> system-view

[DeviceB] vlan 10

[DeviceB-vlan10] port Ten-GigabitEthernet 1/0/1

[DeviceB-vlan10] quit

[DeviceB] interface  vlan-interface 10

[DeviceB-Vlan-interface10] ip address 3.1.1.1 24

[DeviceB-Vlan-interface10] quit

# Configure IP addresses for other interfaces as shown in Table 1. (Details not shown.)

# Create service loopback group 1 and specify its service type as tunnel.

[DeviceB] service-loopback group 1 type tunnel

# Add Ten-GigabitEthernet 1/0/4 to service loopback group 1.

[DeviceB] interface Ten-GigabitEthernet 1/0/4

[DeviceB-Ten-GigabitEthernet1/0/4] port service-loopback group 1

[DeviceB-Ten-GigabitEthernet1/0/4] quit

# Create a 6to4 tunnel interface Tunnel 1.

[DeviceB] interface tunnel 1 mode ipv6-ipv4 6to4

# Specify an IPv6 address for the tunnel interface.

[DeviceB-Tunnel1] ipv6 address 3001::2/64

# Specify the source interface as VLAN-interface 10 for the tunnel interface.

[DeviceB-Tunnel1] source  vlan-interface 10

[DeviceB-Tunnel1] quit

# Configure a static route destined for 2002:0201:0101::/48 through the tunnel interface.

[DeviceB] ipv6 route-static 2002:0201:0101:: 48 tunnel 1

# Disable RA suppression.

[DeviceB] interface vlan-interface 20

[DeviceB-Vlan-interface20] undo ipv6 nd ra halt

[DeviceB-Vlan-interface20] quit

[DeviceB] interface vlan-interface 30

[DeviceB-Vlan-interface30] undo ipv6 nd ra halt

[DeviceB-Vlan-interface30] quit

Configuring the ISATAP host

Configurations on the ISATAP host vary by operating system. The following example is performed on Windows XP.

# Install IPv6.

C:\>ipv6 install

# Configure an ISATAP tunnel.

C:\>netsh interface ipv6 isatap set router 2.1.1.1

# Display information about the ISATAP tunnel interface.

C:\>ipv6 if 2

Interface 2: Automatic Tunneling Pseudo-Interface

  Guid {48FCE3FC-EC30-E50E-F1A7-71172AEEE3AE}

  does not use Neighbor Discovery

  uses Router Discovery

  routing preference 1

  EUI-64 embedded IPv4 address: 1.1.1.2

  router link-layer address: 2.1.1.1

    preferred global 2001::5efe:1.1.1.2, life 29d23h59m46s/6d23h59m46s (public)

    preferred link-local fe80::5efe:1.1.1.2, life infinite

  link MTU 1500 (true link MTU 65515)

  current hop limit 255

  reachable time 42500ms (base 30000ms)

  retransmission interval 1000ms

  DAD transmits 0

  default site prefix length 48

The host has acquired the prefix 2001::/64 and has automatically generated the global unicast address 2001::5efe:1.1.1.2. The message "uses Router Discovery" indicates that the router discovery function is enabled on the host.

# Display information about IPv6 routes on the host.

C:\>ipv6 rt

2001::/64 -> 2 pref 1if+8=9 life 29d23h59m43s (autoconf)

::/0 -> 2/fe80::5efe:1.1.1.1 pref 1if+256=257 life 29m43s (autoconf)

Verifying the configuration

# Verify that Host A and Host B can ping each other.

D:\>ping6 -s 2002:0201:0101:1::2 2002:0301:0101:1::2

 

Pinging 2002:0301:0101:1::2

from 2002:0201:0101:1::2 with 32 bytes of data:

 

Reply from 2002:0301:0101:1::2: bytes=32 time=13ms

Reply from 2002:0301:0101:1::2: bytes=32 time=1ms

Reply from 2002:0301:0101:1::2: bytes=32 time=1ms

Reply from 2002:0301:0101:1::2: bytes=32 time<1ms

 

Ping statistics for 2002:0301:0101:1::2:

    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 0ms, Maximum = 13ms, Average = 3ms

# Verify that the ISATAP host can ping Host A.

C:\Documents and Settings\Administrator>pingv6 2002:0201:0101:1::2

 

Pinging 2002:0201:0101:1::2 with 32 bytes of data:

 

Reply from 2002:0201:0101:1::2: time=33ms

Reply from 2002:0201:0101:1::2: time=32ms

Reply from 2002:0201:0101:1::2: time=32ms

Reply from 2002:0201:0101:1::2: time=33ms

 

Ping statistics for 2002:0201:0101:1::2:

 Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

 Minimum = 32ms, Maximum = 33ms, Average = 32ms

Configuration files

·     Device A:

#

 service-loopback group 1 type tunnel

#

vlan 10

#

vlan 20

#

vlan 30

#

interface Vlan-interface10

 ip address 2.1.1.1 255.255.255.0

#

interface Vlan-interface20

 ipv6 address 2002:201:101:1::1/64

 undo ipv6 nd ra halt

#

interface Vlan-interface30

 ipv6 address 2002:201:101:2::1/64

 undo ipv6 nd ra halt

#

interface Ten-GigabitEthernet1/0/1

 port link-mode bridge

 port access vlan 10

#

interface Ten-GigabitEthernet1/0/2

 port link-mode bridge

 port access vlan 20

#

interface Ten-GigabitEthernet1/0/3

 port link-mode bridge

 port access vlan 30

#

interface Ten-GigabitEthernet1/0/4

 port link-mode bridge

 port service-loopback group 1

#

interface Tunnel1 mode ipv6-ipv4 6to4

 source Vlan-interface10

 ipv6 address 3001::1/64

#

interface Tunnel2 mode ipv6-ipv4 isatap

 source Vlan-interface10

 ipv6 address 2001::5EFE:201:101/64

 undo ipv6 nd ra halt

#

 ipv6 route-static 2001:: 16 Tunnel2

 ipv6 route-static 2002:301:101:: 48 Tunnel1

#                               

·     Device B:

#

 service-loopback group 1 type tunnel

#

vlan 10

#

vlan 20

#

vlan 30

#

interface Vlan-interface10

 ip address 3.1.1.1 255.255.255.0

#

interface Vlan-interface20

 ipv6 address 2002:301:101:1::1/64

 undo ipv6 nd ra halt

#

interface Vlan-interface30

 ipv6 address 2002:301:101:2::1/64

 undo ipv6 nd ra halt

#

interface Ten-GigabitEthernet1/0/1

 port link-mode bridge

 port access vlan 10

#

interface Ten-GigabitEthernet1/0/2

 port link-mode bridge

 port access vlan 20

#

interface Ten-GigabitEthernet1/0/3

 port link-mode bridge

 port access vlan 30

#

interface Ten-GigabitEthernet1/0/4

 port link-mode bridge

 port service-loopback group 1

#

interface Tunnel1 mode ipv6-ipv4 6to4

 source Vlan-interface10

 ipv6 address 3001::2/64

#

 ipv6 route-static 2002:201:101:: 48 Tunnel1

#