IPv6 CGN Solutions: Introduction to Carrier Grade NAT

IPv6 HSI CGN Solution
Introduction
www.huawei.com
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Foreword
⚫
Currently, DS+NAT444 and DS-lite are mainstream IPv6 transition
solutions in the industry. Both solutions are implemented by
using the CGN devices or boards.
⚫
When deploying new devices, carriers need to consider many
factors, such as the deployment costs, impacts on services, and
subsequent capacity expansion.
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page1
Objective
⚫
Upon completion of this course, you will be able to:

Describe the functions of the CGN in the IPv6 transition solutions

Describe CGN deployment solutions

Describe characteristics of CGN NAT and NAT traversal

Describe characteristics of the CGN port allocation solutions

Describe the CGN user tracing solutions

Complete data configuration in typical CGN application scenarios
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page2
Contents
1. Overview of CGN
2. Introduction to CGN networking solutions
3. Introduction to CGN NAT and NAT traversal
4. Introduction to the CGN port allocation solution
5. Introduction to CGN user tracing solutions
6. Configuration example for the typical CGN application scenarios
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page3
Contents
1. Overview of CGN
2. Introduction to CGN networking solution
3. Introduction to CGN NAT and NAT traversal
4. Introduction to the CGN port allocation solution
5. Introduction to CGN user tracing solutions
6. Configuration example for the typical CGN application scenarios
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page4
Contents
1. Overview of CGN

Terms related to CGN

NAT

DS+NAT44(4) solution

DS-lite solution

Factors affecting CGN deployment
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page5
Terms Related to CGN
⚫
CGN---Carrier Grade NAT
⚫
NAT ---Network Address Translation:

NAT addresses the issue of IPv4 address exhaustion. It is major
function is to reuse addresses. NATs are classified into basic NAT and
network address port translator (NAPT).
⚫
DS---Dual-stack
⚫
NAT444: twice IPv4-to-IPv4 address translation

NAT444 consists of CPE NAT44 and CGN NAT44. These two levels of
NAT are independent of each other. NAT444 increases the address
reuse rate.
⚫
DS-Lite--- Dual-Stack Lite
⚫
CPE ---Customer Premises Equipment
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page6
NAT—Basic NAT Address Translation
⚫
Basic NAT is also called NO-PAT mode in which only the IP address is
translated. Each private IP address is mapped to a public IP address.
Therefore, the public network address resource cannot be saved.
Host
Direction
Before NAT
After NAT
Outbound
192.168.1.3
20.1.1.1
Src: 192.168.1.3
Dst: 1.1.1.2
NAT
192.168.1.1
Intranet
192.168.1.3
Src: 1.1.1.2
Dst: 192.168.1.3
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Src: 20.1.1.1
Dst: 1.1.1.2
Server
20.1.1.1
Internet
Src: 1.1.1.2
Dst: 20.1.1.1
Page7
1.1.1.2
NAT— NAPT Address Translation
⚫
In NAPT mode, both the private IP address and port number are translated into a public
IP address and port number. Source addresses of packets coming from different private
addresses can be mapped to the same public address, but the port numbers of these
packets are translated into different port numbers under this address. Therefore, these
packets can share the same address.
Host A
192.168.1.2
Direction
Before NAT
After NAT
Outbound
192.168.1.2:1111
20.1.1.1:1001
Outbound
192.168.1.2:2222
20.1.1.1:1002
Outbound
192.168.1.3:1111
20.1.1.1:1003
Packet 1
Src:192.168.1.2:1111
Packet 2
Src: 192.168.1.2:2222
192.168.1.1
Intranet
Host B
Packet 1
Src: 20.1.1.1:1001
NAT
Packet 2
Src: 20.1.1.1:1002
Server
20.1.1.1
Internet
1.1.1.2
Packet 3
Src: 192.168.1.3:1111
Packet 3
Src: 20.1.1.1:1003
192.168.1.3
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page8
DS+NAT44(4)
Terminal
Access
Metro
Servers
CR
BRAS
TV
Core
CGN
CPE
PC
LSW
P
IPv4/IPv6 DualStack
PE
Phone
OLT
BRAS
PE
CR
P
CGN
IPv6
NAT44
NAT44
Private IPv4
IPv4
Private IPv4
Public IPv4
CPE Route Mode
DS+NAT444
Public IPv4
CPE Bridge Mode
DS+NAT44
IPv6
NAT44
Private IPv4
IPv6
⚫
In the DS+NAT44(4) solution, the packet containing the private IPv4
address must be redirected to the CGN device or board. The CGN
performs NAT to translate the source private IPv4 address into a public
IP address, and then forwards the packet.
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page9
DS-lite
Terminal
Access
Metro
Servers
CR
BRAS
TV
Core
CGN
PC
CPE
DSLAM
IPv6-Only
P
Dual
stakck
PE
Phone
OLT
PE
CR
BRAS
P
CGN
NAT44
Private IPv4
4in6 Tunnel
IPv6
CPE routemode
DS-Lite+NAT+PPPoE
Public IPv4
IPv6
⚫
IPv4
For access requests sent from IPv4 users, the CPE sets up a 4in6 tunnel with
the CGN. A user obtains the private IPv4 address from the CPE. The CGN
translates the private IPv4 address into a public IPv4 address, which is used to
access the IPv4 Internet.
⚫
In the DS-lite solution, the CGN sets up 4in6 tunnels and implements NAT
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page10
Factors Affecting CGN Deployment
3. CAPEX
• Equipment Cost
2. Impacts on services
• User management
• Engineering delivery
costs and risks
• User tracing
3
• Intelligent network
services
• Lawful interception
1. Impacts on the bearer
network
4. OPEX
• O&M interface
• Troubleshooting
2
Factors
affecting CGN
deployment
1
• Network traffic direction
4
• Equipment upgrade
5
5. Impacts on network
evolution
• Smooth network evolution
• Network reliability
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page11
Self-Test Questions
1. Functions of the CGN in the mainstream IPv6 transition solutions
(including DS+NAT444 and DS-lite) are (
)
A. Setting up 4in6 tunnels with the CPE
B. Parsing domain names for the IPv6 services
C.
Translating the MAN IPv6 addresses into IPv4 addresses
D. Performing NAT on uplink private network packets of the MAN
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page12
Contents
1. Overview of CGN
2. Introduction to CGN networking solution
3. Introduction to CGN NAT and NAT traversal
4. Introduction to the CGN port allocation solution
5. Introduction to CGN user tracing solutions
6. Configuration example for the typical CGN application scenarios
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page13
Contents
2. Introduction to CGN networking solution

Classification of CGN forms

Comparison of CGN forms

CGN networking solutions

Comparison of CGN networking solutions
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page14
Classification of CGN Forms–Stand-alone
CGN
⚫
A stand-alone CGN can be mounted beside or directly to other network
devices
CR
CR
PE
PE
CGN
CGN
CGN
CGN
CR
CR
Directly mounted between
the CR and the PE
CR
Directly mounted between
the CR and the BRAS
CR
CGN
BRAS
BRAS
CR
CGN
Mounted beside the CR
BRAS
CR
BRAS
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
CGN BRAS
Mounted beside
the BRAS
Page15
BRAS CGN
Classification of CGN Forms–Integrated CGN
CR
CR
CR
CGN board installed on
a BRAS
CGN board installed on
a CR
BRAS/SR
CR
BRAS/SR
BRAS
BRAS
Comparison of the preceding deployment modes is as follows:
⚫

The mode in which the CGN board is installed on a CR is applicable to the scenario where
users are scattered. The costs at the early stage are low. As the number of users increases,
however, the distributed CGN needs to be added. Users cannot be managed and real-time
tracing is difficult to implement.

The mode in which the CGN board is installed on a BRAS is applicable to the
scenario where users are centralized. This mode allows lean user management
and facilitates real-time tracing.
Page16
System Architecture of the Integrated CGN
1
3
LPU
LPU
SFU
2
VSUI-20-A
(CGN)
⚫
The integrated CGN is implemented by the VSUI series board, which is a multicore service board. This board is a centralized board that does not provide any
outbound interface.
⚫
Service flow: The interface board routes the traffic to the service board. The
service board completes the CGN function and then sends the traffic to the
interface board. The interface board sends the traffic out of the system.
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page17
Comparison of CGN Forms
Stand-alone CGN
Feasibility of
deployment
Integrated CGN
Integrated with a CR
Integrated with an SR/BRAS
Occupies a forwarding port
Occupies a forwarding slot
Occupies a forwarding slot.
External
interfaces
Uses a stand-alone subrack. The number
of interfaces is limited
Shares a subrack with other boards. The
number of interfaces is not limited.
Shares a subrack with other boards. The
number of interfaces is not limited
Cost
The cost is high. A device must be added
The cost is low. Only a board needs to be
added.
The cost is low. Only a board needs to be
added
Tracing
capability
Does not participate in user
authentication. Cannot detect users. The
tracing capability is poor.
Does not support online tracing
Does not participate in user authentication.
Cannot detect users. The tracing capability
is poor.
Does not support online tracing.
Participates in user authentication. Can
detect users. The tracing capability is good.
Supports online tracing.
Reliability
Connected to dual hosts in side
mounting mode. The reliability is high,
but functions are not rich, and the
cooperation with the network is poor.
Supports the two-board configuration
Supports the two-board configuration.
Is integrated with network services. Supports
various protection modes of the network. The
reliability is high.，
Service
capability and
user
management
Does not provide the service capability.
Cannot detect users.
Does not provide the service capability.
Cannot detect users.
Provides functions to maintain accessed
users.
Has strong control capability.
Capacity and
scalability
The capacity and scalability are high
The capacity and scalability are affected by
the vacant slots on the device with which
the CGN is integrated.
Provides functions to maintain accessed users.
Has strong control capability.
The capacity and scalability are affected by
the empty slots on the device with which the
CGN is integrated.
Change in
network
topology
A device is added, which changes the
existing network topology
Only boards are added, which does not
change the existing network topology
Only boards are added, which does not
change the existing network topology.
Page18
CGN Networking Solutions—Centralized
Mode
Deployment of the CGN in centralized mode
Backbone
⚫
Deployment position: deployed at the egress of the MAN
⚫
Deployment mode: stand-alone CGN device mounted beside
the CR
⚫
IDC
low. It is easy to deploy new devices in a centralized manner.
CGN deployment position
CR
CGN
⚫
L3
MAN
Deployment difficulty: The investment at the early stage is
Traffic analysis: Traffic within a city is transferred to CRs and
CGN devices for processing. This increases the traffic
volume on CRs and the CGN is more likely to become a
SR
performance bottleneck.。
BRAS
⚫
Reliability: The CGN needs to maintain a large number of
sessions. Therefore, a single-point failure affects a large
LSW
Access
network
DSLAM
OLT
number of users. Reliability requirements are high and the
LSW
networking is complex
OLT
DSLAM
L2
⚫
Long-term trend: With flattening of the network and the
increase in IPv4 traffic, the position of the CGN will gradually
be moved downwards.。
⚫
CPE
CPE
CPE CPE
CPE
CPE
User management: The CGN deployment position is high on
the network. The CGN cannot obtain the user information.
CPE CPE
Therefore, it is difficult to implement user policy control and
user tracing.
⚫
Values: The total cost is low. The solution facilitates
centralized control and is suitable for fast deployment at the
early stage of IPv6 network deployment.
Page19
CGN Networking Solutions—Distributed
Mode
Deployment of the CGN in Distributed mode
⚫
Backbone
position
IDC
CR
Deployment position: deployed at the BRAS/SR
⚫
Deployment mode: board installed on a BRAS/SR
⚫
Deployment difficulty: The investment at the early
CGN
stage is highly. Should deploy in multiple points.
L3
MAN
⚫
SR
Traffic analysis: Traffic mode is unchanged and the
forwarding effectively is high. The performance of
BRAS
the equipment is low.
CGN deployment position
LSW
Access
network
DSLAM
OLT
⚫
LSW
number of sessions. Therefore, a single-point
OLT
DSLAM
Reliability: The CGN needs to maintain a few
failure affects a few number of users. Reliability
L2
requirements are low and the networking is simple
⚫
Fit for the distributed and flattening development
architecture nowadays.
CPE
CPE
CPE CPE
CPE
CPE
CPE CPE
⚫
Values:：the architecture of the network is
unchanged to realize address and NAT resource
distributed.
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page20
CGN Networking Solutions—Reliability
Centralized
mode
The fault affects
Trouble
No dual-device backup
dual-host backup
Centralize
d mode
The BRAS cannot detect faults
on the CGN. If faults on the
CGN are not rectified, users
will be always in online state
but cannot access the Internet
normally.
The active/standby backup is
often implemented using the
cold backup mode. The faulttriggered switching time is
determined by the route
convergence time and the
backup time of a large number
of NAT sessions.。
The BRAS can detect faults on
the CGN. A rollback domain is
configured on the BRAS to
force users to get offline and
dial up again and switch over
users to the public network
domain. In this way, users are
protected against faults on the
CGN.
The dual-host hot backup
mode is used. The
active/standby switchover is
implementing using VRRP. The
fault-triggered switching time
is determined by the BFD time
and the backup time of NAT
sessions.
users served by
all BRASs
connected to the
CR.
CR
Metro
Distributed mode
BRAS
PPP
The fault affects
only local users.
B4
Distribute
d mode
IPv4+IPv6
Page21
CGN Networking Solutions—Equipment Cost
(1/3)
Uplink LPU
Downlink LPU
⚫
When the CGN is deployed in distributed
mode, the traffic model is as follows:
CR

The data is routed to the service
board, redirected to the CGN board
based on a policy, sent to the
Uplink LPU
C
G
N
Downlink LPU
service board, and finally
forwarded by the service board.
⚫
Cost: A CGN board is added
BRAS
Centralized mode
SFU
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page22
CGN Networking Solutions—Equipment Cost
(2/3)
⚫
When the CGN is deployed in centralized
mode, the traffic model is as follows:
C
G
N
Up linkLPU
Up link LPU
Up link LPU
Down linkLPU
Down link LPU
Down link LPU

through the BRAS service board. The CR
redirects the user packet to the CGN device
CR
CGN
User data is routed to the CR on the MAN
based on the routing policy. The CGN device
processes the packet and sends it to the CR.
The model of the traffic from the Internet to
users is the reverse operations of the
UplinkLPU
outbound traffic model.
DownlinkLPU
⚫
BRAS
Cost: A CGN device is added to the
existing traffic model. A pair of interfaces
Centralized mode
must be added respectively on the CR
and the CGN device for interworking
SFU
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
between them.
Page23
CGN Networking Solutions—Equipment Cost
(3/3)
Cost calculation:
⚫
Preset conditions:
⚫

10G Port，processing capability of the CGN
board

Cost of equipment bit：CGN per Port cost=1；

CR per Port cost=1.5；CGN per Board cost=3

Deployment in every area
50
Bit Cost
Centralized mode
30
Distributed mode
deployment
10
Mode 1（10G traffic）：
⚫

Distributed mode：3

Centralized mode： 1×2+1.5×2+3 = 8
Mode 2（50G traffic）：
⚫
30G
10G
⚫
50G
100G
User Traffic
As the traffic increases, the cost per

Distributed mode ：3×3 = 9
bit in centralized deployment mode is

Centralized mode：1×10+1.5×10+3×3 = 34
much higher than that in distributed
Mode 3（100G traffic）：
⚫

Distributed mode：3×5 = 15

Centralized mode：1×20+1.5×20+3×5 = 59
deployment mode
Page24
CGN Networking Solutions—Engineering Delivery Costs
and Risks
Distributed Deployment of the
CGN Installed on the BRAS
Centralized Deployment of the CGN Mounted
Beside the CR
Public IP addresses are managed on the
BRAS
Public IP addresses are managed on the CR and the NAT device. Public
IP addresses used by all BRASs connected to the CR must be
consistently planned.
The CGN board must be purchased and
installed on the BRAS.
The BRAS must be upgraded to support the
CGN feature
The CR interface board and the NAT device and server must be
purchased.
The NAT device and log server must be installed. The CE must be
connected to the NAT device.
The configuration on BRAS must be
modified to support CGN users
Data used for interworking between the NAT device and the CR must
be configured. In addition, the NAT device must be configured.
Migration to the
live network
The migration involves only the BRAS. Risks
may arise only on devices under the BRAS
Adjustment must be made simultaneously on the BRAS, CR, and NAT
device to complete the migration. The CR is located on a key position
and faces greater risks.
Engineering
delivery and
operation
The delivery involves only the BRAS and is
irrelevant to the CR. Coordination between
different levels of O&M teams is not
required
The delivery involves the BRAS, CR, and NAT device. Issues related to
these devices must be planned in a centralized manner. The routing
information must be adjusted on the entire network. In addition,
coordination between different levels of O&M teams in different cities
or in the provincial center is required.
The CGN board is added. Related
configuration must be modified on the
BRAS
The boards of the NAT device and the CR interface board are added.
The configuration of the entire network must be modified.
Network
planning
Equipment
procurement,
installation, and
upgrade
Network
element
configuration
Service
expansion
Page25
CGN Networking Solutions—Network O&M
Cost
Analysis
O&M interface:
⚫

Generally, the O&M interface between the provincial company and the city companies of a carrier is located between the BRAS and the CR.
BRAS and devices under the BRAS are managed by city companies, whereas the CR and devices above the CR are managed by the
provincial company. If tunnels are faulty when the DS-lite centralized deployment mode is used, the O&M personnel of both the provincial
company and the city companies must cooperate with each to rectify the faults. This increases the coordination costs
B4
BRAS
IPv4+IPv6
⚫
Fault location:
DS-Lite
Tunnel
Company in
each city
AFTR
CR
Provincial
company
Distributed networking: 1->N fault location
Locate the fault by checking the BRAS and devices under the
BRAS
BRAS BRAS
BRAS BRAS BRAS BRAS
BRAS. With gradual deployment of the CGN and BRAS, the O&M
process is a 1->N process.
Centralized networking: 1+N fault location
Locate the fault by checking all BRASs and CRs on the access
CR
CR
CR
network and MAN. Therefore, the O&M process is a 1+N process
and devices in a large scope need to be checked to locate the fault. BRAS
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
BRAS
BRAS
Page26
BRAS
BRAS
BRAS BRAS
Comparison of CGN Networking Solutions(1/2)
Centralized Deployment of the CGN
CGN Mounted Beside a CR
Total
cost
User
manag
ement
Distributed Deployment of the CGN
CGN Board Installed on a CR
CGN Integrated with a BRAS or an SR
The cost is high when users are scattered and
low when users are centralized. CGN needs to be
deployed at multiple points and cannot be
controlled in a centralized manner. The
installation and subsequent O&M workload is
heavy.
The investment at the early stage is low. It is easy to deploy new devices in a centralized manner. The
private network routes of users must be advertised on the MAN. Private address planning and the
solution for isolating the public network routes from private network routes are complex.
The CGN deployment position is high on the network. The CGN cannot obtain the user information.
Therefore, it is difficult to implement user policy control and user tracing.
It is difficult to implement application level gateway (ALG) control on the NAT located at the core. This
seriously prevents deployment of new applications.
The log server must be deployed to record logs and implement tracing. This increases the investment and
O&M difficulty.
The CGN is integrated with the BRAS. The Radius
server reports the user log to implement user
tracing. The solution is simple and facilitates
user-based lean policy control and real-time and
accurate tracing.
Service
traffic
Traffic within a city is transferred to CRs and
CGN devices for processing. This increases
the traffic volume on CRs. The CGN can meet
the development requirements of new users.
Traffic within a city increases the traffic on CRs. The CGN
can hardly meet the service development requirements
due to the restriction of CR slots. If the loads of BRASs
on the live network cannot be distributed to different
CRs, the network topology must be changed to prevent
the failure of allocating different public IP addresses to
the same user.
Reliabil
ity
The CGN devices need to maintain a large
number of sessions. Therefore, a single-point
failure affects a large number of users.
Reliability requirements are high and the
networking is complex.
The CGN devices need to maintain a large number of
sessions. Therefore, a single-point failure affects a large
number of users. CRs must be upgraded. The CGN faults
affect CRs, introducing high risks. Reliability
requirements are high.
The traffic model is not changed. The forwarding
efficiency is high and performance requirements
are low.
Deploy
ment
value
New devices must be managed and
maintained. With flattening of the network
and increase in the IPv4 traffic, the CGN must
be gradually moved downwards.
Devices can be managed in a centralized manner. CGNs
and CRs belong to different O&M teams, which
increases difficulty in O&M coordination and is difficult
to meet the service development requirements. With
increase in the IPv4 traffic, the CGN must be gradually
moved downwards.
This solution can be deployed in areas where
users are centralized. The CGN can be directly
deployed in these areas without being moved
downwards like that in the centralized
deployment mode.
The traffic model is not changed. The forwarding
efficiency is high and performance requirements
are low.
Page27
Comparison of CGN Networking
Solutions(2/2)
Mainstream CGN deployment solutions:
⚫
Distributed deployment of CGN that is
integrated with the BRAS/SR
Centralized deployment of CGN
that is mounted beside the CR
⚫
⚫
⚫
⚫
The CGN deployment position is high on the
users are centralized.
network. The CGN cannot obtain the user
The CGN is integrated with the BRAS.
information. Therefore, it is difficult to
The tracing solution is simple, which
implement user policy control and user tracing.
facilitates user-based lean policy control.
⚫
CGNs in areas where users are scattered.
This solution is suitable for direct
deployment of CGNs in areas where
This solution is suitable for fast deployment of
⚫
Traffic within a city is transferred to CRs and
The traffic model is not changed. The
CGN devices for processing. This increases
forwarding efficiency is high and
the traffic volume on CRs and the CGN is
performance requirements are low.
more likely to become a performance
bottleneck.
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page28
Self-Test Questions
2. Mainstream CGN deployment solutions include (
)
A.
Distributed deployment of CGN that is integrated with the BRAS/SR
B.
Centralized deployment of CGN that is mounted beside the CR
C.
Distributed deployment of CGN that is mounted beside the BRAS/SR
D.
Centralized deployment of CGN that is integrated with the CR
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page29
Contents
1. Overview of CGN
2. Introduction to CGN networking solution
3. Introduction to CGN NAT and NAT traversal
4. Introduction to the CGN port allocation solution
5. Introduction to CGN user tracing solutions
6. Configuration example for the typical CGN application scenarios
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page30
Contents
3. Introduction to CGN NAT and NAT traversal

Introduction to CGN NAT

NAT Traversal
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page31
Introduction to CGN NAT—Full-Cone
⚫
Full-cone：Full-cone NAT is also called triplet NAT. In this mode, the peer
address and port translation mode is not cared. The device distributes
addresses and filters packets by creating triplet entries (source address,
source port number, and protocol type). The full-cone NAT reduces the
security performance, but supports a wider application of NAT traversal.
10.1.1.200:100 ->
121.12.124.20:80
10.1.1.200:100
<- 121.12.124.20:80
10.1.1.200
10.1.1.200:100
<- 131.15.124.22:80
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
152.100.1.21:10240 ->
121.12.124.20:80
152.100.1.21:10240
<- 121.12.124.20:80
152.100.1.21:10240
<- 131.15.124.22:80
Page32
121.12.124.20
131.15.124.22
Introduction to CGN NAT—Symmetrical
Mode
⚫
Symmetrical NAT is also called quintuple NAT. In quintuple NAT, if the
destination IP addresses and port numbers of packets are different but the
source IP addresses and port numbers are the same, the NAT device translates
the source IP addresses and port numbers into different external network IP
addresses and port numbers.
10.1.1.200:100 ->
121.12.124.20:80
10.1.1.200:100
<- 121.12.124.20:80
10.1.1.200
152.100.1.21:10240 ->
121.12.124.20:80
152.100.1.21:10240
<- 121.12.124.20:80
121.12.124.20
152.100.1.21:10240
<- 131.15.124.22:80
131.15.124.22
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page33
NAT Traversal—Overview(1/2)
Why is NAT traversal required?
⚫

With wide application of NAT, application layer protocols that use the IP address and port number as
communication IDs cannot run properly.

Applications, such as instant messaging (session and control messages), SIP (RTP/RTCP), and online
payment, require that session connections of the same host use the same source IP address. If the
same host originates sessions that contain the same IP address and port number, the NAT results
may be different due to the dynamic address translation of the standard NAT.

The standard NAT is implemented by changing the address information in the IP packet header or
UDP/TCP port number. The payload of some application layer protocols, however, contains the IP
address and port number. Consequently, some packets may be judged as invalid and therefore
discarded.

Assume that external networks need to use services provided by servers on an internal network. If a
standard NAT solution is used, when a packet coming from an external network arrives at the CGN,
NAT mapping may fail and the packet may be lost because the related triplet or quintuple entry is
not created.
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page34
NAT Traversal—Overview(2/2)
⚫
NAT traversal technologies

ALG
◼

Application scenario: ALG translation of frequently-used protocols
Full-cone mode
◼
It is also called triplet NAT. In this mode, the peer address and port translation mode is not cared. The device
distributes addresses and filters packets by creating triplet entries (source address, source port number, and
protocol type). The full-cone NAT reduces the security performance, but supports a wider application of NAT
traversal. Application scenario: P2P services

Direct distribution of public IP addresses and port forwarding
◼
Application scenario: External networks need to use services provided by internal networks. Considering the
complexity in deploying port forwarding, the solution of directly distributing public IP addresses is
recommended for this application scenario.

CGN-independent NAT traversal
◼
STUN、 TURN and so on
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page35
NAT Traversal—NAT ALG
Client and FTPS server set control
connection
Data
Packet
header
202.10.1.2
192.168.1.2
Send port Packet
S:192.168.1.2:1084
D:202.10.1.1:21
S:192.168.1.2:1084
D:202.10.1.1:21
S:192.168.1.2:1084
D:202.10.1.1:21
S:202.10.1.2:12486
D:202.10.1.1:21
Data
Set data transmit tunnel
Set the control connection with 202.10.1.2
NAT
Packet
header
dencapsulation
Data
Access
client
Private
network
I didn’t set connection
with192.168.1.2
CGN card
Send port packet
Packet
header
Metro
202.10.1.1
192.168.1.2
Data
Public
network
S:192.168.1.2:1084
Data
S:192.168.1.2:1084
D:202.10.1.1:21
S:192.168.1.2:1084
D:202.10.1.1:21
Data
Packet
header
Packet
header
NAT ALG
Handling
S:200.10.1.1:20
D:192.168.1.2:12486
S:202.10.1.1:20
D:192.168.1.2:12486
FTPS
server
S:200.10.1.2:12486
D:202.10.1.1:21
S:202.10.1.2:12486
D:202.100.1.1:21
Port packet load has been transferred
Data
FTPS server sent data connection to HOST
Packet
header
FTPS server sent data connection to HOST
trasmit the data on the established data tunnel
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page36
S:200.10.1.1:20
D:202.10.1.1:12486
S:202.10.1.1:20
D:202.100.1.2:12486
NAT Traversal—Full-Cone Mode
⚫
The full-cone mode is
applicable to P2P
services
BRAS
User 1
Triplet-based filtering that does not involve
the destination IP address and port
Protocol number
Source IP address: 192.168.1.2: 2
Destination IP address: *: *
1 . Registration
CGN 1
Access
2 . Communication
202.38.162.2
BRAS
P2P service
server
1. Registration
User 2
CGN2
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page37
CGN-Independent NAT Traversal–STUN
⚫
CGN 1
Access
My public address and port？
User 2
⚫
well-known server located on the public
network to obtain the NAT type and NAT
BRA
S
User 1
The application communicates with the
external network address and port number.
rendezvous server
Private
Public
network network
CGN2
BRA
S
Public Address POOL:
245.49.1.2: -…
202.38.162.2
The public address
and port are
245.49.1.2...
CGN-independent NAT traversal is implemented by the application
software itself.

STUN ( Session Traversal Utilities for NAT )

TURN ( Traversal Using Relay NAT )
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page38
Self-Test Questions
3. Which of the following modes are supported by the CGN to
implement NAT traversal? (
)
A. Full-cone mode
B. Symmetrical mode
C.
NAT ALG
D. STUN
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page39
Contents
1. Overview of CGN
2. Introduction to CGN networking solution
3. Introduction to CGN NAT and NAT traversal
4. Introduction to the CGN port allocation solution
5. Introduction to CGN user tracing solutions
6. Configuration example for the typical CGN application scenarios
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page40
Contents
4. Introduction to the CGN port allocation solution

Session-based port allocation

Port Range Pre-allocation

Comparison of Port Allocation Solutions
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page41
Traditional Session-based Port Allocation
⚫
Session-based port allocation:

The traditional NAT supports demand-based port allocation. Each
session of a user is randomly allocated a port with the public IP
address. This allocation mechanism causes many management
problems.

If a log record is generated for the address translation of each
session, a massive number of log records are generated. To reduce
the log size, the traditional session-based port allocation generally
uses the binary stream log mode to output log records.
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page42
Port Range Pre-allocation
IPv4
IPv4
Public Address POOL: 245.49.1.2: -…
CPE1
Private IPv4 10.112.1.2
port-range 1024
IPv4
BRAS
CGN
CR
Private IPv4 10.112.1.10
PC
IPv4
Private IPv4
Public IPv4
Start port 1
End port 1
…
10.112.1.2
245.49.1.2
3001
4024
…
10.112.1.10
245.49.1.2
6001
7024
…
CPE2
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page43
Internet
Comparison of Port Allocation Solutions
⚫
Session-based port allocation and port range pre-allocation can both resolve the
port allocation problems.
⚫
Advantages of the port range pre-allocation solution:

User tracing can be easily implemented based on the public address and the corresponding port range
allocated to each user.

The log information does not need to be recorded based on each session. This greatly reduces the
massive log information generated on the CGN and effectively reduces the system load.

The solution prevents a few users from over-consuming the address and port resources. The same public
address and port range are allocated for data streams that come from the same user or source IP address.
⚫
Disadvantages of the port range pre-allocation solution:

Based on the preset port range value, a fixed port range is reserved for each user. Therefore, the port
range value is set based on the maximum number of ports required by a user. This causes a waste of the
port resource and port allocation is less flexible.

Owing to the product limitations, the port range can only be set to 256, 512, 1024, 2048, or 4096.
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page44
Contents
1. Overview of CGN
2. Introduction to CGN networking solution
3. Introduction to CGN NAT and NAT traversal
4. Introduction to the CGN port allocation solution
5. Introduction to CGN user tracing solutions
6. Configuration example for the typical CGN application scenarios
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page45
Contents
5. Introduction to CGN user tracing solutions

Overview of User Tracing Solutions

Dynamic User Tracing Solution

Offline User Tracing Solution
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page46
Overview of User Tracing Solutions
⚫
Why is user tracing required?

User tracing is implemented to meet the national security monitoring requirement. For example,
when a person releases a post that contains reactionary contents on a network, the network
records the release time, user information, and the contents of the post. The user information
consists of <public IPv4 address of the user, public port number of the user>. The national security
organization can locate the user based on the time and public IPv4 address. For example, the
Radius server records the online and offline time and allocated public IPv4 addresses of all users.
⚫
Complexity of user tracing after the CGN deployment:

After the CGN is deployed, users are identified based on the public IPv4 address and port number
instead of the IPv4 address during user tracing. The uncertainty of the public IPv4 address and port
number occupied by a user makes user tracing more complex.
⚫
User tracing modes after the CGN deployment:

Dynamic user tracing: It is also called online user tracing. It is classified into Radius user tracing
and static algorithm user tracing.

Offline user tracing: It is a user tracing mode after users get offline. Users are traced based on the
log on the syslog server.
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page47
Dynamic User Tracing Solution(1/2)
⚫
Principle of dynamic user tracing:

The dynamic user tracing is applicable to the scenario where the CGN boards are installed on a BRAS and the BRAS generates the user
address mapping and reports it to the AAA server.

The BRAS selects the public address and port for user addresses and creates the user address mapping, to ensure that the BRAS can select
different combinations of addresses and ports for different user addresses.

The port range is allocated in advance.

The BRAS reports information such as the address and port range corresponding to the user address in the accounting-Request message by
using extended Radius attributes.

The AAA server obtains information such as the user address, public IP address, and port range, and maintains the mapping with user
information.
•
•
•
3
NAT-IP-Address: 26-161 Public address after NAT
NAT-Port-Start: 26-162 Start port number after NAT
NAT-Port-End: 26-163 End port number after NAT
The BRAS reports the user
address mapping to the
AAA server by using
Radius attributes.
Each BRAS creates the
user address mapping.
1
AAA
Server
2
BRAS integrated
with the CGN
2
1
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
The AAA server
maintains the mapping
between addresses and
user information.
2
BRAS integrated
with the CGN
1
Page48
BRAS integrated
with the CGN
Dynamic User Tracing Solution(2/2)
AAA
Server
PC
HG
DSLAM/MxU/OLT
BRAS integrated
with the
CGN
Internet
1 Set up a connection and initiate an authentication
User
access
and
authenticat
ion
3 Allocate a private IPv4 address to the user.
2
Report the allocated private IP
address to the AAA server using
Radius attributes.
4 Report the public IP address
and port range.
3
User
tracing
2
5
Search the user information and
address mapping table based
on the private IP address, and
translate the private IP address
into a public IP address and port
number.
7
4
Based on the private IP address,
allocate and report the translated
public IP address and port range
to the AAA server using Radius
attributes.
1 Private source address access request
Internet
access
1
User
2
authentication
The AAA server maintains the mapping
between user information (containing
homing CGNs, user names, domain
names, private IP addresses, and port
numbers) and address information (public
IP addresses and port numbers).
Public source address
access request
Query the user information and address
mapping table based on the pubic IP
addresses, port numbers, and time period to
obtain user names, and directly locate the user.
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
The AAA server maintains the user information
table, including the user names and domain
names. (The AAA server can issues an NAT
policy template to implement port preallocation.
6
The security organization
cannot locate the user who
accesses the network illegally
based on the obtained public
network address and port
number.
1 Query the user information based on the
public IP address and port number
2 Return the user information.
Page49
Offline User Tracing Solution(1/2)
⚫
Principle of offline user tracing:



When users are offline, security organizations query the log server and AAA server to obtain the user
information.
Offline user tracing is applicable to all the CGN deployment modes, for example, the CGN integrated with
the CR or BRAS or stand-alone CGN.
Generally, the log server stores user logs that are generated in three to six months.
The log server maintains the user log information,
including the time period, private IP address and
port, public IP address and port, and destination
address and port.
The CGN sends the log
information that contains the user
address mapping to the log
server using elog or syslog.
The CGN generates the mapping
between the private IP address and
public IP addresses and port ranges.
1
CGN
2
Log
server
2
1
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
2
CGN
1
Page50
CGN
Offline User Tracing Solution(2/2)
Log
server
PC
HG
DSLAM/MxU/OLT
BRAS
AAA
Server
CGN
Internet
1 Set up a connection and initiate an authentication.
User access
and
authenticatio
n
Internet
access
3 Allocate a private IPv4 address to the user.
2
2 User authentication
1
The AAA server maintains the user
information table, including user
names and domain names.
3
The AAA server maintains the
user information and private IP
address mapping table that
contains the home BRAS, user
names, domain names, and
private IP address.
4 Report the private IP address information.
Report the allocated private IP
address to the AAA server using
Radius attributes.
1 Private source address access
request
4
5
Search the user information and address
mapping table based on the private IP address,
and translate the private IP address into a
public IP address and port number.
2 Public source address access
request
3
The CGN sends the log information that
contains the user information and address
mapping to the log server in real time.
User
tracing
8
Query the user log information based on the
pubic IP addresses, port numbers, and time
period to obtain private IP address and port
number. Send the obtained information to
the AAA server.
9
2
Query the
log server
again.
3
Return the private IP
address and port
number.
Query the user information on the AAA
server based on the returned private IP
address and port number to obtain the user
name and locate the user.
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
The security organization cannot
locate the user who accesses the
network illegally based on the
obtained public network address
and port number.
Query the user information
based on the public IP address
and port number.
6
User log information
1
The AAA server does not have the
7 private
IP address information and
therefore sends a query request that
contains the public IP address and
port number to the log server
through the webservice interface.
4 Query the user information
to locate the user based on
the private IP address and
port number, and return the
user information
Page51
Self-Test Questions
4. To which of the following CGN networking mode is dynamic user
tracing applicable? (
)
A.
Distributed deployment of CGN that is integrated with the BRAS/SR
B.
Centralized deployment of CGN that is mounted beside the CR
C.
Distributed deployment of CGN that is mounted beside the BRAS/SR
D.
Centralized deployment of CGN that is integrated with the CR
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page52
Contents
1. Overview of CGN
2. Introduction to CGN networking solution
3. Introduction to CGN NAT and NAT traversal
4. Introduction to the CGN port allocation solution
5. Introduction to CGN user tracing solutions
6. Configuration example for the typical CGN application
scenarios
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page53
Contents
6. Configuration example for the typical CGN application
scenarios

CGN Integrated with BRAS to Support Internet Access of Users in
NAT444+PPPoE Mode

CGN Integrated with BRAS to Support Internet Access of Users in
DS-Lite+PPPoE Mode
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page54
CGN Integrated with BRAS to Support Internet
Access of Users in NAT444+PPPoE Mode
Ssylog
Server
GE6/0/0
PC1
CPE
CGN
Access
network
PC2
Radius
Server
ISP Core
BRAS
DHCP
Server
Web
Server
⚫
The CGN is integrated with the BRAS.
⚫
DS users access the BRAS through a CPE. The BRAS allocates an IPv6 address
to the CPE. The BRAS manages users, translates IPv4 addresses, and sets up
4in6 tunnels for users.
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page55
Configuration Procedure
1
Configure the user access part.
2
Configure NAT instance
3
Configure a domain and bind the domain
with a DS-lite instance
4
Configure the traffic policy
5
Advertise routes
6
Check the configuration
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page56
Configure NAT Instance(1/3)
#Allocate the license resource to service boards.
[ME60] nat session-table 6M slot 2
[ME60] nat session-table 6M slot 8
# Create a DS-lite instance
[ME60] nat instance 1
# Configure NAT mode as full-cone
[ME60-nat-instance-1] nat filter mode full-cone
#Set the port range and allocate a port segment to each private IP address. (Optional)
[ME60-nat-instance-1] port-range 2048
#Add service boards to the configured NAT instance. You can add two service boards that work in active/standby mode to an
instance.
[ME60-nat-instance-1] add slot 2 master
[ME60-nat-instance-1] add slot 8 slave
#Configure the NAT address pool. The public IP addresses required for address translation are selected from the address
segments configured in the address pool.
[ME60-nat-instance-1] nat address-group 1 112.112.10.1 112.112.10.254
#Configure the addresses in the address pool that are used for address translation.
[ME60-nat-instance-1] nat outbound any address-group 1
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page57
Configure NAT Instance(2/3)
# Enable the session limitation function to improve the security. (Optional)
[ME60-nat-instance-1] nat session-limit enable
[ME60-nat-instance-1] nat reverse-session-limit enable
# Adjust the number of limited sessions. (Optional and configured based on the network model)
[ME60-nat-instance-1] nat session-limit tcp 4096
[ME60-nat-instance-1] nat session-limit udp 4096
[ME60-nat-instance-1] nat reverse-session-limit tcp 4096
[ME60-nat-instance-1] nat reverse-session-limit udp 4096
# Configure a server that receives the NAT log. (This configuration is required when the syslog-based user
tracing is enabled. The address and port information are configured based on the actual situation.)
[ME60-nat-instance-1] nat log session enable
[ME60-nat-instance-1] nat session-log host 102.102.102.102 555 source
1.1.1.1 555 name 1
# By default, the NAT log is in Huawei format. When Huawei devices interwork with China Telecom servers,
the NAT log format must be changed to the China Telecom format.
[ME60] nat syslog descriptive format cn
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page58
Configure NAT Instance(3/3)
# Configure the NAT ALG functions as required.
[ME60-nat-instance-1] nat alg all
# Enable hot backup between boards. (Optional)
[ME60] nat board hot-backup enable
# Adjust the TCP-MSS negotiation value. (Optional)
[ME60] nat tcp-mss 1000
# Adjust the session aging time. (Optional)
[ME60] nat session aging-time tcp 300
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page59
Configure Domain Binding NAT
#Configure the user group used for Internet access.
[ME60] user-group 1
# Switch to the user access domain and bind the user group with the NAT instance.
[ME60-aaa] domain domain1
[ME60-aaa-domain-domain1] user-group 1 bind nat instance 1
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page60
Configure the traffic policy
#Configure the user control list (UCL) and match the user group.
[ME60] acl 6000
[ME60-acl-ucl-6000] rule 5 permit ip source user-group 1
#Configure a traffic classifier.
[ME60] traffic classifier nat444
[ME60-classifier- nat444] if-match acl 6000
#Configure the traffic behavior and bind the NAT instance.
[ME60] traffic behavior nat444
[ME60- behavior - nat444] nat bind instance 1
#Configure the traffic policy and bind the behavior in the system view.
[ME60] traffic policy nat444
[ME60- trafficpolicy - nat444] classifier nat444 behavior nat444
#Apply the traffic policy in the global configuration view. Only one traffic policy can be sent in one direction.
[ME60] traffic-policy nat444 inbound
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page61
Advertise Routes
#Directly import the user network routes (UNRs) in the routing protocol configuration so that all
NAT addresses are advertised as 32-bit host routes. When a user gets online and NAT is
performed, a route policy must be configured to filter out the private IP route of the user
when UNR routes are advertised.
[ME60]ip ip-prefix nat index 10 permit 112.112.10.1 24
[ME60]route-policy nat permit node 5
[ME60-route-policy] if-match ip-prefix nat
[ME60]ospf 1
[ME60-ospf-1]import-route unr route-policy nat
#Configure the destination route segment of static routes as the address segment in the
address pool and direct the route to NULL0. In the routing protocol, import static routes for
advertisement. (Recommended)
[ME60]ip route-static 112.112.10.0 255.255.255.0 NULL 0
[ME60]ospf 1
[ME60-ospf-1]import-route static
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page62
Check the Configuration
#Check online users information
display access-user user-id 2
User access index
: 2
State
: Used
User name
: 1111
Domain name
: domain1
。。。。。。（Omitted）
User IP address
: 10.10.10.198
。。。。。。（Omitted）
User-Group
: 1
NAT IP address
: 112.112.2.27
NAT Port Scope(Start,End)
: 2048,4095
#Check session information
display nat session table slot 2
Slot: 2 Engine: 0
Current total sessions: 1.
udp: 10.10.10.198:34[112.112.10.27:2944]-->112.112.2.3:2342
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page63
CGN Integrated with BRAS to Support Internet
Access of Users in DS-Lite+PPPoE Mode
Internet IPv6
BRAS
(DS-LITE)
DS-LITE
CPE
IPV6 access network
IPv4/IPv6
Internet IPv4
⚫
The CGN is integrated with the BRAS.
⚫
DS users access the BRAS through a CPE. The BRAS allocates an IPv6
address to the CPE. The BRAS manages users, translates IPv4 addresses,
and sets up 4in6 tunnels for users.
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page64
Configuration Procedure
1
Configure the user access part.
2
Configure an IPv6 address pool.
3
Configure a DS-lite instance.
4
Configure a domain and bind the
domain with a DS-lite instance.
5
Configure the traffic policy.
6
Advertise routes
7
Check the configuration
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page65
Configure IPv6 Address Pool(1/2)
#Create a prefix with the IPv6 attribute set to local and configure the address prefix, which is used to allocate a WAN
interface address to a CPE.
[ME60]ipv6 prefix 1 local
[ME60-ipv6-prefix-1]prefix 4001:10::48
# Create a prefix with the IPv6 attribute set to delegation and configure the address prefix, which is used to allocate the
public IPv6 address to a PC.
[ME60]ipv6 prefix 2 delegation
[ME60-ipv6-prefix-2] prefix 4002:10::/48
# Create an address pool with the IPv6 attribute set to local. Configure the DNS server address and AFTR domain name. Bind
the prefixes with the address pools.
[ME60]ipv6 pool 1
bas local
//Create an IPv6 local address pool
[ME60-ipv6-pool-1]dns-server 2001:1::E //Configure the IPv6 DNS server address.
[ME60-ipv6-pool-1]prefix 1
//Bind the IPv6 prefix with the address pool.
[ME60-ipv6-pool-1]aftr-name www.ds-lite.cn //Configure the AFTR domain name.
#Create an IPv6 delegation prefix address pool and bind the prefix with the address pool.
[ME60]ipv6 pool 2 bas delegation
[ME60-ipv6-pool-2]prefix 2
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page66
Configure IPv6 Address Pool(2/2)
#Switch to the AAA server view and bind the IPv6 local prefix address pool with the
delegation prefix address pool.
[ME60]aaa
[ME60-aaa]domain domain1
[ME60-aaa-domain-domain1]ipv6-pool 1
[ME60-aaa-domain-domain1]ipv6-pool 2
#Set managed-address-flag and other-flag to 1 so that addresses and DNS server are allocated
in IA_NA mode.
[ME60-aaa-domain-domian1]ipv6 nd autoconfig managed-address-
flag
[ME60-aaa-domain-domian1] ipv6 nd autoconfig other-flag
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page67
Configure DS-lite Instance
#Allocate the license resource to service boards. Configurations in the system view are shared by NAT and DS-lite. Both use the
NAT key word.
[ME60] nat session-table 6M slot 2
[ME60] nat session-table 6M slot 6
# Create a DS-lite instance.
[ME60] ds-lite instance 1
# Configure the endpoint addresses of the DS-lite tunnel.
[ME60- ds-lite -instance-1] local-ipv6 6001::1 prefix-length 64
# Configure the IPv6 address range of the remote CPEs that can be connected. You can configure multiple IPv6 addresses.
[ME60- ds-lite -instance-1] remote-ipv6 4001:10:: prefix-length 48
# Use the following command lines to configure the basic part of the DS-lite instance. The configuration is consistent with the
NAT instance configuration.
[ME60- ds-lite -instance-1] ds-lite filter mode full-cone
[ME60- ds-lite -instance-1] port-range 2048
[ME60- ds-lite -instance-1] add slot 2 master
[ME60- ds-lite -instance-1] add slot 6 slave
#The remaining configurations are optional and consistent with the NAT instance configurations.
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Configure Domain Binding DS-lite Instance
#Configure the user group used for Internet access.
[ME60] user-group 1
# Switch to the user access domain and bind the user group with the DS-lite instance.
[ME60-aaa] domain domain1
[ME60-aaa-domain-domain1] user-group 1 bind ds-lite
instance 1
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page69
Configure Traffic Policy
#Configure UCL , match the on line users
[ME60] acl ipv6 6000
[ME60-acl6-ucl-6000] rule 5 permit ipv6 source user-group 1
#Configure traffic classifier
[ME60] traffic classifier dslite
[ME60-classifier- dslite] if-match ipv6 acl 6000
#Configure traffic behavior
[ME60] traffic behavior dslite
[ME60- behavior - dslite] ds-lite bind instance 1
#Configure traffic policy and binding in the system view
[ME60] traffic policy dslite
[ME60-trafficpolicy-dslite] classifier dslite behavior dslite
[ME60] traffic-policy dslite inbound
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page70
Route Advertisement
#Configure the static route and the route segment is address pool to NULL0.
[ME60]ip route-static 112.112.10.0 255.255.255.0 NULL 0
[ME60]ipv6 route-static 4001:10:: 48 NULL0
[ME60]ipv6 route-static 4002:10:: 48 NULL0
[ME60]ospf 1
[ME60-ospf-1]import-route static
[ME60]ospfv3 1
[ME60-ospfv3-1]import-route static
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
//Import IPv6 static route
Page71
Check the Configuration(1/2)
#Check the 4to6 tunnel establishment
[ME60]display ds-lite tunnel table
Slot: 2 Engine: 0
Current total sessions: 1.
CPE:4001:0010::0001 -->
Local-ip:6001::0001
Slot: 2 Engine: 1
Current total sessions: 1.
CPE:4001:0010::0001 -->
Local-ip:6001::0001
Slot: 2 Engine: 2
Current total sessions: 1.
CPE:4001:0010::0001 -->
Local-ip:6001::0001
Slot: 2 Engine: 3
Current total sessions: 0.
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page72
Check the Configuration(2/2)
#Check NAT information
[ME60]display nat session table verbose
This operation will take a few minutes. Press 'Ctrl+C' to break ...
Slot: 2 Engine: 0
Current total sessions: 1.
udp: 10.10.10.198:34[112.112.10.27:2944]-->112.112.2.3:2342
DS-Lite Instance: 1
VPN:--->Tag:0x88b,FixedTag:0x4006805, Status:hit, TTL:00:00:50 ,Left:00:00:45 ,
Master
AppProID: 0x0, CPEIP:4001:10::1, FwdType:FORWARD
Nexthop:112.112.2.3
OutPort:0x7
-->packets:12, bytes:769, drop:0
<--packets:12, bytes:1124, drop:0
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page73
Self-Test Questions
5. In the CGN DS-lite solution, is it necessary to allocate an IPv4
address to a CPE? ( )
A. No
B. Yes
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page74
Summary
⚫
This course describes the mainstream CGN deployment solutions:

When adding CGN devices, carriers need to consider multiple factors such as costs and
impacts on services, and select an appropriate networking solution for their own networks.

The mainstream CGN network solutions include distributed deployment of CGNs integrated
with BRASs and centralized deployment of CGNs mounted beside CRs.

Major functions of the CGN include setup of 4in6 tunnels and NAT. During NAT444, users
under the CGN share the port resource. The port resource must be pre-allocated to
prevent a few users from over-consuming the port resource.

User tracing is a major concern of carriers. Deployment of new CGN devices increases
difficulty in user tracing. You need to learn how user tracing is implemented after CGN
devices are added.

CGNs must be added to deploy an IPv6 transition solution. You need to complete the basic
configurations related to the CGN when different IPv6 transition solutions are used.
Copyright © 2011 Huawei Technologies Co., Ltd. All rights reserved.
Page75
Thank you
www.huawei.com