F3726, F3211, F3174, R5135, R3816-HP Firewalls and UTM Devices VPN Configuration Guide-6PW100

Figure 68 Network diagram

384BConfiguration procedure

Make sure GigabitEthernet 0/1 on the ISATAP firewall and the ISATAP host can reach each other through

IPv4.

• Configure the firewall:

# Enable IPv6.

<Firewall> system-view

[Firewall] ipv6

# Configure addresses for interfaces.

[Firewall] interface gigabitethernet 0/2

[Firewall-GigabitEthernet0/2] ipv6 address 3001::1/64

[Firewall-GigabitEthernet0/2] quit

[Firewall] interface gigabitethernet 0/1

[Firewall-GigabitEthernet0/1] ip address 1.1.1.1 255.0.0.0

[Firewall-GigabitEthernet0/1] quit

# Configure an ISATAP tunnel.

[Firewall] interface tunnel 0

[Firewall-Tunnel0] ipv6 address 2001::5efe:0101:0101 64

[Firewall-Tunnel0] source gigabitethernet 0/1

[Firewall-Tunnel0] tunnel-protocol ipv6-ipv4 isatap

# Disable RA suppression so that the ISATAP host can acquire information such as the address

prefix from the RA message advertised by the ISATAP firewall.

[Firewall-Tunnel0] undo ipv6 nd ra halt

[Firewall-Tunnel0] quit

# Configure a static route to the ISATAP host.

[Firewall] ipv6 route-static 2001:: 16 tunnel 0

• Configure the ISATAP host:

Configurations on the ISATAP host vary depending on the operating system. The following

example is performed on Windows XP.

# Install IPv6.

C:\>ipv6 install

# On a host running Windows XP, the ISATAP interface is usually interface 2. Configure the IPv4

address of the ISATAP firewall on interface 2 to complete the configuration on the host. Before that,

view the ISATAP interface information:

C:\>ipv6 if 2

Interface 2: Automatic Tunneling Pseudo-Interface

Guid {48FCE3FC-EC30-E50E-F1A7-71172AEEE3AE}

does not use Neighbor Discovery