HP VPN Firewall Appliances VPN Configuration Guide

vi
DNS64 function ··················································································································································· 387
AFT limitations ······················································································································································ 387
Protocols and standards ····································································································································· 387
AFT configuration task list ··········································································································································· 387
When communication is initiated by an IPv6 host··························································································· 387
When communication is initiated by an IPv4 host··························································································· 388
Configuration prerequisites ········································································································································· 388
Enabling AFT ································································································································································ 388
Configuring a DNS64 prefix ······································································································································ 388
Configuring an IVI prefix ············································································································································· 389
Configuring a 6to4 AFT policy ··································································································································· 389
Configuring 4to6 AFT policies ···································································································································· 390
Displaying and maintaining AFT ································································································································ 391
AFT configuration examples ······································································································································· 392
An IPv6 host with an IVI address initiates communication with an IPv4 host ··············································· 392
An IPv4 host initiates communication with an IPv6 host ················································································· 393
Configure the DNS64 function of AFT ·············································································································· 395
Troubleshooting AFT ···················································································································································· 398
Symptom 1 ··························································································································································· 398
Solution ································································································································································· 398
Symptom 2 ··························································································································································· 398
Solution ································································································································································· 399
Configuring DVPN ·················································································································································· 400
Feature and hardware compatibility ·························································································································· 400
Overview ······································································································································································· 400
Basic concepts ····················································································································································· 400
How DVPN operates ··········································································································································· 401
Network structures ··············································································································································· 401
DVPN implementation ········································································································································· 402
Supported DVPN features··································································································································· 405
Configuring DVPN in the Web interface ··················································································································· 406
Recommended configuration procedure ··········································································································· 406
Configuring a VPN domain ······························································································································· 407
Configuring an ISP domain ································································································································ 410
Displaying VAM client information ··················································································································· 412
Configuring DVPN tunnels ································································································································· 412
Displaying DVPN session information ··············································································································· 418
Full mesh DVPN configuration example ··········································································································· 420
Hub-Spoke DVPN configuration example ········································································································· 434
Configuring DVPN at the CLI ······································································································································ 446
DVPN configuration task list ······························································································································· 446
Configuring AAA ················································································································································· 446
Configuring the VAM server ······························································································································ 446
Configuring a VAM client ·································································································································· 449
Configuring an IPsec profile ······························································································································· 452
Configuring DVPN tunnel parameters ··············································································································· 453
Configuring routing ············································································································································· 455
Displaying and maintaining DVPN ··················································································································· 456
Full mesh DVPN configuration example ··········································································································· 456
Hub-spoke DVPN configuration example ········································································································· 470
Support and other resources ·································································································································· 481
Contacting HP ······························································································································································ 481
Subscription service ············································································································································ 481