ac 米兰官网IPサービスでVPN/ローカルブレイクアウトを利用する対象装置：F70/F71/F220/F221/F220 EX/F221 EX

VNE各社のac 米兰官网IPサービスでL2TP/IPsecおよびL2TPv3/IPsecを利用する場合の設定例です。

ac 米兰官网機能については下記の機能説明資料をご参照ください。

本ac 米兰官网は、次のサービスに適用可能です。

VNE事業者	IPoEサービス名	ac 米兰官网	ac 米兰官网 (txt)
朝日ac 米兰官网	「v6 コネクト IPv4 over ac 米兰官网接続（IPIP）」	「v6 コネクト IPv4 over ac 米兰官网接続（IPIP）」	このac 米兰官网のご利用は
アルテリア・ ac 米兰官网ス	「クロスac 米兰官网」	ac 米兰官网IP1/RA-Proxyを利用	このac 米兰官网のご利用は
		ac 米兰官网IP1/DHCPv6-PDを利用	このac 米兰官网のご利用は
		ac 米兰官网IP8/IP16/RA-Proxyを利用	このac 米兰官网のご利用は
		ac 米兰官网IP8/IP16/DHCPv6-PDを利用	このac 米兰官网のご利用は
ac 米兰官网ーネットマルチフィード	「transix IPv4接続（ac 米兰官网IP）」	ac 米兰官网IP/RA-Proxyを利用	このac 米兰官网のご利用は
ac 米兰官网ーネットマルチフィード	「transix IPv4接続（ac 米兰官网IP）」	ac 米兰官网IP/DHCPv6-PDを利用	このac 米兰官网のご利用は
JPIX	「v6プラス」	ac 米兰官网IPサービス	このac 米兰官网のご利用は

補足・注意点

以下のac 米兰官网は、単独では使用できません。必ず上記動的サービスのac 米兰官网と組み合わせてご使用ください。
先に上記ac 米兰官网サービスの設定を行ってから、以下の設定を適用する手順でお願いします。
以下のac 米兰官网のPDFファイルをご確認ください。補足欄にコマンドの補足説明や注意点を記載しております。

構成とac 米兰官网

VPN/ac 米兰官网

IPoE網にてVPN接続して、通常のインターネット向け通信をVPN経由、SaaS向け通信をブレイクアウトしてV4overV6トンネル経由とするためのac 米兰官网です。

ac 米兰官网	ac 米兰官网（txt）
VPN/ac 米兰官网を利用する（Proxyサーバを利用）New	このac 米兰官网のご利用は

ac 米兰官网のローカルブレイクアウト機能に関係する箇所（PDFファイルの黄色セル部分）を下記の「アプリケーション毎の設定」を参考に変更すれば、お客様の環境におけるProxyサーバの利用有無やLBO対象のアプリケーションに合わせて利用可能です。

アプリケーション毎のac 米兰官网（ローカルブレイクアウト機能を使う）

'); subwindow.document.write('

'); subwindow.document.close(); }

<pre>access-list 109 deny ip any any
access-list 110 spi ip any any
access-list 4000 permit icmp6 any any neighbor-advertisement
access-list 4000 permit icmp6 any any neighbor-solicitation
access-list 4000 permit icmp6 any any router-advertisement
access-list 4000 permit udp any any eq 546
access-list 4009 deny ac 米兰官网 any any
access-list 4010 spi ac 米兰官网 any any
access-list 4100 permit tcp any any eq 53
access-list 4100 permit udp any any eq 53
access-list 4101 permit tcp any ::1/128
access-list 4101 permit udp any ::1/128
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip name-server ::1
!
ip dhcp server-profile LAN
 address 192.168.0.2 192.168.0.254
 lease-time 28800
 dns 192.168.0.1
 gateway 192.168.0.1
exit
!
ip nat list 1 192.168.0.0 0.0.0.255
!
ac 米兰官网 dhcp client-profile NGN
 option-request dns-server
 retries infinity
exit
!
ac 米兰官网 dhcp server-profile LANv6
 dns port-channel 1
exit
!
ipinip tunnel-profile IPIP1
 profile-mode ipip
 source ac 米兰官网 port-channel 11
 destination address ##トンネル終端装置のac 米兰官网アドレス##
 ipinip fragment pre
exit
!
logging buffer level informational
!
hostname FITELnet
!
interface GigaEthernet 1/1
 vlan-id 11
 bridge-group 11
 channel-group 11
 policy-route input DNS-POLICY
exit
!
interface GigaEthernet 2/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 ac 米兰官网 access-group 4000 in
 ac 米兰官网 access-group 4009 in
 ac 米兰官网 access-group 4010 out
exit
!
interface Port-channel 1
 ac 米兰官网 enable
 ac 米兰官网 nd receive-ra prefix-delegation port-channel 11
 ac 米兰官网 router-lifetime-receive-enable
 ac 米兰官网 trust-ra-prefix-lifetime
 ac 米兰官网 dhcp service client
 ac 米兰官网 dhcp client-profile NGN
exit
!
interface Port-channel 11
 ip dhcp service server
 ip dhcp server-profile LAN
 ip address 192.168.0.1 255.255.255.0
 ac 米兰官网 enable
 ac 米兰官网 address autoconfig interface-id ##インタフェースID##
 ac 米兰官网 nd other-config-flag
 ac 米兰官网 nd send-ra
 ac 米兰官网 trust-ra-prefix-lifetime
 ac 米兰官网 dhcp service server
 ac 米兰官网 dhcp server-profile LANv6
 mss 1420
 ddns-client address ac 米兰官网 action http-client 1 delay 10 interval 3600
exit
!
interface Tunnel 1
 ip address ##固定IPv4グローバルアドレス## 255.255.255.255
 ip access-group 109 in
 ip access-group 110 out
 ip nat inside source list 1 interface
 tunnel mode ipinip tunnel-profile IPIP1
exit
!
class-map DNS6
 match ac 米兰官网 access-group 4100
exit
!
class-map DNS6_LO
 match ac 米兰官网 access-group 4101
exit
!
policy-route-map DNS-POLICY
 !
 class DNS6
  search-sequence 10
  count
  action nexthop ##ネクストホップアドレス(ac 米兰官网)##
 exit
 !
 class DNS6_LO
  search-sequence 1
  count
  action transmit
 exit
 !
exit
!
local policy-route DNS-POLICY
!
dns-server ip enable
dns-server ac 米兰官网 enable
!
proxydns domain 1 any * any dhcp ac 米兰官网 port-channel 1 source-interface port-channel 11
proxydns address 1 any dhcp ac 米兰官网 port-channel 1 source-interface port-channel 11
!
http-client 1
 request-timeout 10 retry 5
 method 1 get url ##アップデートサーバURL## user ##ユーザID## pass ##パスワード##
 reference-interface port-channel 11
 source-interface port-channel 11
 logging on
exit
!
end</pre>

<pre>access-list 109 deny ip any any
access-list 110 spi ip any any
access-list 4000 permit icmp6 any any neighbor-advertisement
access-list 4000 permit icmp6 any any neighbor-solicitation
access-list 4000 permit icmp6 any any router-advertisement
access-list 4000 permit udp any any eq 546
access-list 4009 deny ac 米兰官网 any any
access-list 4010 spi ac 米兰官网 any any
access-list 4100 permit tcp any any eq 53
access-list 4100 permit udp any any eq 53
access-list 4101 permit tcp any ::1/128
access-list 4101 permit udp any ::1/128
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip name-server ::1
!
ip dhcp server-profile LAN
 address 192.168.0.2 192.168.0.254
 lease-time 28800
 dns 192.168.0.1
 gateway 192.168.0.1
exit
!
ip nat list 1 192.168.0.0 0.0.0.255
!
ac 米兰官网 dhcp client-profile NGN
 option-request dns-server
 retries infinity
exit
!
ac 米兰官网 dhcp server-profile LANv6
 dns port-channel 1
exit
!
ipinip tunnel-profile IPIP1
 profile-mode ipip
 source ac 米兰官网 port-channel 11
 destination address ##トンネル終端装置 ac 米兰官网アドレス##
 ipinip fragment pre
exit
!
logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username test privilege 15 password 2 $LAruCQ4A$T3O69MOhXaiNub6xoHNsG1
!
hostname FITELnet
!
interface GigaEthernet 1/1
 vlan-id 11
 bridge-group 11
 channel-group 11
 policy-route input DNS-POLICY
exit
!
interface GigaEthernet 2/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 ac 米兰官网 access-group 4000 in
 ac 米兰官网 access-group 4009 in
 ac 米兰官网 access-group 4010 out
exit
!
interface Port-channel 1
 ac 米兰官网 enable
 ac 米兰官网 nd receive-ra prefix-delegation port-channel 11
 ac 米兰官网 router-lifetime-receive-enable
 ac 米兰官网 trust-ra-prefix-lifetime
 ac 米兰官网 dhcp service client
 ac 米兰官网 dhcp client-profile NGN
exit
!
interface Port-channel 11
 ip dhcp service server
 ip dhcp server-profile LAN
 ip address 192.168.0.1 255.255.255.0
 ac 米兰官网 enable
 ac 米兰官网 address autoconfig interface-id ##インタフェースID##
 ac 米兰官网 nd other-config-flag
 ac 米兰官网 nd send-ra
 ac 米兰官网 trust-ra-prefix-lifetime
 ac 米兰官网 dhcp service server
 ac 米兰官网 dhcp server-profile LANv6
 mss 1420
 link-state always-up
 ddns-client address ac 米兰官网 action http-client 1 delay 10 interval 600
exit
!
interface Tunnel 1
 ip address ##固定IPv4グローバルアドレス## 255.255.255.255
 ip access-group 109 in
 ip access-group 110 out
 ip nat inside source list 1 interface
 tunnel mode ipinip tunnel-profile IPIP1
exit
!
class-map DNS6
 match ac 米兰官网 access-group 4100
exit
!
class-map DNS6_LO
 match ac 米兰官网 access-group 4101
exit
!
policy-route-map DNS-POLICY
 !
 class DNS6
  search-sequence 10
  count
  action nexthop ##ネクストホップアドレス(ac 米兰官网)##
 exit
 !
 class DNS6_LO
  search-sequence 1
  count
  action transmit
 exit
 !
exit
!
local policy-route DNS-POLICY
!
line console
 exec-timeout 0
 authorization exec default local
exit
!
line telnet
 exec-timeout 0
exit
!
dns-server ip enable
dns-server ac 米兰官网 enable
!
proxydns domain 1 any * any dhcp ac 米兰官网 port-channel 1 source-interface port-channel 11
proxydns address 1 any dhcp ac 米兰官网 port-channel 1 source-interface port-channel 11
!
http-client 1
 request-timeout 10 retry 5
 method 1 get url https://##Basic認証ID##:##Basic認証パスワード##@##アップデートサーバURL## d ##DDNS ID## p ##DDNSパスワード## u ##FQDN## a $i6
 reference-interface port-channel 11
 source-interface port-channel 11
 logging on
exit
!
end</pre>

<pre>access-list 109 deny ip any any
access-list 110 spi ip any any
access-list 4000 permit icmp6 any any neighbor-advertisement
access-list 4000 permit icmp6 any any neighbor-solicitation
access-list 4000 permit icmp6 any any router-advertisement
access-list 4000 permit udp any any eq 546
access-list 4009 deny ac 米兰官网 any any
access-list 4010 spi ac 米兰官网 any any
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip name-server ::1
!
ip dhcp server-profile LAN
 address 192.168.0.2 192.168.0.254
 lease-time 28800
 dns 192.168.0.1
 gateway 192.168.0.1
exit
!
ip nat list 1 192.168.0.0 0.0.0.255
!
ac 米兰官网 route ::/0 dhcp port-channel 1
!
ac 米兰官网 dhcp client-profile NGN
 option-request prefix-delegation
 option-request dns-server
 retries infinity
exit
!
ac 米兰官网 dhcp server-profile LANv6
 dns port-channel 1
exit
!
ipinip tunnel-profile IPIP1
 profile-mode ipip
 source ac 米兰官网 port-channel 11
 destination address ##トンネル終端装置 ac 米兰官网アドレス##
 ipinip fragment pre
exit
!
logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username test privilege 15 password 2 $LAruCQ4A$T3O69MOhXaiNub6xoHNsG1
!
hostname FITELnet
!
interface GigaEthernet 1/1
 vlan-id 11
 bridge-group 11
 channel-group 11
exit
!
interface GigaEthernet 2/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 ac 米兰官网 access-group 4000 in
 ac 米兰官网 access-group 4009 in
 ac 米兰官网 access-group 4010 out
exit
!
interface Port-channel 1
 ac 米兰官网 enable
 ac 米兰官网 dhcp service client
 ac 米兰官网 dhcp client-profile NGN
exit
!
interface Port-channel 11
 ip dhcp service server
 ip dhcp server-profile LAN
 ip address 192.168.0.1 255.255.255.0
 ac 米兰官网 enable
 ac 米兰官网 address dhcp port-channel 1 ##インタフェースID##/64
 ac 米兰官网 nd other-config-flag
 ac 米兰官网 nd send-ra
 ac 米兰官网 trust-ra-prefix-lifetime
 ac 米兰官网 dhcp service server
 ac 米兰官网 dhcp server-profile LANv6
 mss 1420
 link-state always-up
 ddns-client address ac 米兰官网 action http-client 1 delay 10 interval 600
exit
!
interface Tunnel 1
 ip address ##固定IPv4グローバルアドレス## 255.255.255.255
 ip access-group 109 in
 ip access-group 110 out
 ip nat inside source list 1 interface
 tunnel mode ipinip tunnel-profile IPIP1
exit
!
line console
 exec-timeout 0
 authorization exec default local
exit
!
line telnet
 exec-timeout 0
exit
!
dns-server ip enable
dns-server ac 米兰官网 enable
!
proxydns domain 1 any * any dhcp ac 米兰官网 port-channel 1 source-interface port-channel 11
proxydns address 1 any dhcp ac 米兰官网 port-channel 1 source-interface port-channel 11
!
http-client 1
 request-timeout 10 retry 5
 method 1 get url https://##Basic認証ID##:##Basic認証パスワード##@##アップデートサーバURL## d ##DDNS ID## p ##DDNSパスワード## u ##FQDN## a $i6
 reference-interface port-channel 11
 source-interface port-channel 11
 logging on
exit
!
end</pre>

<pre>access-list 100 permit ip any host ##固定IP8アドレス-2##
access-list 100 permit ip any host ##固定IP8アドレス-3##
access-list 100 permit ip any host ##固定IP8アドレス-4##
access-list 100 permit ip any host ##固定IP8アドレス-5##
access-list 109 deny ip any any
access-list 110 spi ip any any
access-list 4000 permit icmp6 any any neighbor-advertisement
access-list 4000 permit icmp6 any any neighbor-solicitation
access-list 4000 permit icmp6 any any router-advertisement
access-list 4000 permit udp any any eq 546
access-list 4009 deny ac 米兰官网 any any
access-list 4010 spi ac 米兰官网 any any
access-list 4100 permit tcp any any eq 53
access-list 4100 permit udp any any eq 53
access-list 4101 permit tcp any ::1/128
access-list 4101 permit udp any ::1/128
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip name-server ::1
!
ip dhcp server-profile LAN
 address 192.168.0.2 192.168.0.254
 lease-time 28800
 dns 192.168.0.1
 gateway 192.168.0.1
exit
!
ip nat list 1 192.168.0.0 0.0.0.255
ip nat default action pass
!
ac 米兰官网 dhcp client-profile NGN
 option-request dns-server
 retries infinity
exit
!
ac 米兰官网 dhcp server-profile LANv6
 dns port-channel 1
exit
!
ipinip tunnel-profile IPIP1
 profile-mode ipip
 source ac 米兰官网 port-channel 11
 destination address ##トンネル終端装置 ac 米兰官网アドレス##
 ipinip fragment pre
exit
!
logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username test privilege 15 password 2 $LAruCQ4A$T3O69MOhXaiNub6xoHNsG1
!
hostname FITELnet
!
interface GigaEthernet 1/1
 vlan-id 11
 bridge-group 11
 channel-group 11
 policy-route input DNS-POLICY
exit
!
interface GigaEthernet 1/2
 vlan-id 12
 bridge-group 12
 channel-group 12
exit
!
interface GigaEthernet 2/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 ac 米兰官网 access-group 4000 in
 ac 米兰官网 access-group 4009 in
 ac 米兰官网 access-group 4010 out
exit
!
interface Port-channel 1
 ac 米兰官网 enable
 ac 米兰官网 nd receive-ra prefix-delegation port-channel 11
 ac 米兰官网 router-lifetime-receive-enable
 ac 米兰官网 trust-ra-prefix-lifetime
 ac 米兰官网 dhcp service client
 ac 米兰官网 dhcp client-profile NGN
exit
!
interface Port-channel 11
 ip dhcp service server
 ip dhcp server-profile LAN
 ip address 192.168.0.1 255.255.255.0
 ac 米兰官网 enable
 ac 米兰官网 address autoconfig interface-id ##インタフェースID##
 ac 米兰官网 nd other-config-flag
 ac 米兰官网 nd send-ra
 ac 米兰官网 trust-ra-prefix-lifetime
 ac 米兰官网 dhcp service server
 ac 米兰官网 dhcp server-profile LANv6
 mss 1420
 link-state always-up
 ddns-client address ac 米兰官网 action http-client 1 delay 10 interval 600
exit
!
interface Port-channel 12
 ip address ##固定IP8アドレス-6## 255.255.255.248
 mss 1420
exit
!
interface Tunnel 1
 ip address ##固定IP8アドレス-1## 255.255.255.255
 ip access-group 100 in
 ip access-group 109 in
 ip access-group 110 out
 ip nat inside source list 1 interface
 tunnel mode ipinip tunnel-profile IPIP1
exit
!
class-map DNS6
 match ac 米兰官网 access-group 4100
exit
!
class-map DNS6_LO
 match ac 米兰官网 access-group 4101
exit
!
policy-route-map DNS-POLICY
 !
 class DNS6
  search-sequence 10
  count
  action nexthop ##ネクストホップアドレス(ac 米兰官网)##
 exit
 !
 class DNS6_LO
  search-sequence 1
  count
  action transmit
 exit
 !
exit
!
local policy-route DNS-POLICY
!
line console
 exec-timeout 0
 authorization exec default local
exit
!
line telnet
 exec-timeout 0
exit
!
dns-server ip enable
dns-server ac 米兰官网 enable
!
proxydns domain 1 any * any dhcp ac 米兰官网 port-channel 1 source-interface port-channel 11
proxydns address 1 any dhcp ac 米兰官网 port-channel 1 source-interface port-channel 11
!
http-client 1
 request-timeout 10 retry 5
 method 1 get url https://##Basic認証ID##:##Basic認証パスワード##@##アップデートサーバURL## d ##DDNS ID## p ##DDNSパスワード## u ##FQDN## a $i6
 reference-interface port-channel 11
 source-interface port-channel 11
 logging on
exit
!
end</pre>

<pre>access-list 100 permit ip any host ##固定IP8アドレス-2##
access-list 100 permit ip any host ##固定IP8アドレス-3##
access-list 100 permit ip any host ##固定IP8アドレス-4##
access-list 100 permit ip any host ##固定IP8アドレス-5##
access-list 109 deny ip any any
access-list 110 spi ip any any
access-list 4000 permit icmp6 any any neighbor-advertisement
access-list 4000 permit icmp6 any any neighbor-solicitation
access-list 4000 permit icmp6 any any router-advertisement
access-list 4000 permit udp any any eq 546
access-list 4009 deny ac 米兰官网 any any
access-list 4010 spi ac 米兰官网 any any
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip name-server ::1
!
ip dhcp server-profile LAN
 address 192.168.0.2 192.168.0.254
 lease-time 28800
 dns 192.168.0.1
 gateway 192.168.0.1
exit
!
ip nat list 1 192.168.0.0 0.0.0.255
ip nat default action pass
!
ac 米兰官网 route ::/0 dhcp port-channel 1
!
ac 米兰官网 dhcp client-profile NGN
 option-request prefix-delegation
 option-request dns-server
 retries infinity
exit
!
ac 米兰官网 dhcp server-profile LANv6
 dns port-channel 1
exit
!
ipinip tunnel-profile IPIP1
 profile-mode ipip
 source ac 米兰官网 port-channel 11
 destination address ##トンネル終端装置 ac 米兰官网アドレス##
 ipinip fragment pre
exit
!
logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username test privilege 15 password 2 $LAruCQ4A$T3O69MOhXaiNub6xoHNsG1
!
hostname FITELnet
!
interface GigaEthernet 1/1
 vlan-id 11
 bridge-group 11
 channel-group 11
exit
!
interface GigaEthernet 1/2
 vlan-id 12
 bridge-group 12
 channel-group 12
exit
!
interface GigaEthernet 2/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 ac 米兰官网 access-group 4000 in
 ac 米兰官网 access-group 4009 in
 ac 米兰官网 access-group 4010 out
exit
!
interface Port-channel 1
 ac 米兰官网 enable
 ac 米兰官网 dhcp service client
 ac 米兰官网 dhcp client-profile NGN
exit
!
interface Port-channel 11
 ip dhcp service server
 ip dhcp server-profile LAN
 ip address 192.168.0.1 255.255.255.0
 ac 米兰官网 enable
 ac 米兰官网 address dhcp port-channel 1 ##インタフェースID##/64
 ac 米兰官网 nd other-config-flag
 ac 米兰官网 nd send-ra
 ac 米兰官网 trust-ra-prefix-lifetime
 ac 米兰官网 dhcp service server
 ac 米兰官网 dhcp server-profile LANv6
 mss 1420
 link-state always-up
 ddns-client address ac 米兰官网 action http-client 1 delay 10 interval 600
exit
!
interface Port-channel 12
 ip address ##固定IP8アドレス-6## 255.255.255.248
 mss 1420
exit
!
interface Tunnel 1
 ip address ##固定IP8アドレス-1## 255.255.255.255
 ip access-group 100 in
 ip access-group 109 in
 ip access-group 110 out
 ip nat inside source list 1 interface
 tunnel mode ipinip tunnel-profile IPIP1
exit
!
line console
 exec-timeout 0
 authorization exec default local
exit
!
line telnet
 exec-timeout 0
exit
!
dns-server ip enable
dns-server ac 米兰官网 enable
!
proxydns domain 1 any * any dhcp ac 米兰官网 port-channel 1 source-interface port-channel 11
proxydns address 1 any dhcp ac 米兰官网 port-channel 1 source-interface port-channel 11
!
http-client 1
 request-timeout 10 retry 5
 method 1 get url https://##Basic認証ID##:##Basic認証パスワード##@##アップデートサーバURL## d ##DDNS ID## p ##DDNSパスワード## u ##FQDN## a $i6
 reference-interface port-channel 11
 source-interface port-channel 11
 logging on
exit
!
end</pre>

<pre>access-list 109 deny ip any any
access-list 110 spi ip any any
access-list 4000 permit icmp6 any any neighbor-advertisement
access-list 4000 permit icmp6 any any neighbor-solicitation
access-list 4000 permit icmp6 any any router-advertisement
access-list 4000 permit udp any any eq 546
access-list 4009 deny ac 米兰官网 any any
access-list 4010 spi ac 米兰官网 any any
access-list 4100 permit tcp any any eq 53
access-list 4100 permit udp any any eq 53
access-list 4101 permit tcp any ::1/128
access-list 4101 permit udp any ::1/128
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip name-server ::1
!
ip dhcp server-profile LAN
 address 192.168.0.2 192.168.0.254
 lease-time 28800
 dns 192.168.0.1
 gateway 192.168.0.1
exit
!
ip nat list 1 192.168.0.0 0.0.0.255
!
ac 米兰官网 dhcp client-profile NGN
 option-request dns-server
 retries infinity
exit
!
ac 米兰官网 dhcp server-profile LANv6
 dns port-channel 1
exit
!
ipinip tunnel-profile IPIP1
 profile-mode ipip
 source ac 米兰官网 port-channel 11
 destination address ##トンネル終端装置 ac 米兰官网アドレス##
 ipinip fragment pre
exit
!
logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username test privilege 15 password 2 $LAruCQ4A$T3O69MOhXaiNub6xoHNsG1
!
hostname FITELnet
!
interface GigaEthernet 1/1
 vlan-id 11
 bridge-group 11
 channel-group 11
 policy-route input DNS-POLICY
exit
!
interface GigaEthernet 2/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 ac 米兰官网 access-group 4000 in
 ac 米兰官网 access-group 4009 in
 ac 米兰官网 access-group 4010 out
exit
!
interface Port-channel 1
 ac 米兰官网 enable
 ac 米兰官网 nd receive-ra prefix-delegation port-channel 11
 ac 米兰官网 router-lifetime-receive-enable
 ac 米兰官网 trust-ra-prefix-lifetime
 ac 米兰官网 dhcp service client
 ac 米兰官网 dhcp client-profile NGN
exit
!
interface Port-channel 11
 ip dhcp service server
 ip dhcp server-profile LAN
 ip address 192.168.0.1 255.255.255.0
 ac 米兰官网 enable
 ac 米兰官网 address autoconfig interface-id ##インタフェースID##
 ac 米兰官网 nd other-config-flag
 ac 米兰官网 nd send-ra
 ac 米兰官网 trust-ra-prefix-lifetime
 ac 米兰官网 dhcp service server
 ac 米兰官网 dhcp server-profile LANv6
 mss 1420
 ddns-client address ac 米兰官网 action http-client 1 delay 10 interval 600
exit
!
interface Tunnel 1
 ip address ##固定IPv4グローバルアドレス## 255.255.255.255
 ip access-group 109 in
 ip access-group 110 out
 ip nat inside source list 1 interface
 tunnel mode ipinip tunnel-profile IPIP1
exit
!
class-map DNS6
 match ac 米兰官网 access-group 4100
exit
!
class-map DNS6_LO
 match ac 米兰官网 access-group 4101
exit
!
policy-route-map DNS-POLICY
 !
 class DNS6
  search-sequence 10
  count
  action nexthop ##ネクストホップアドレス(ac 米兰官网)##
 exit
 !
 class DNS6_LO
  search-sequence 1
  count
  action transmit
 exit
 !
exit
!
local policy-route DNS-POLICY
!
line console
 exec-timeout 0
 authorization exec default local
exit
!
line telnet
 exec-timeout 0
exit
!
dns-server ip enable
dns-server ac 米兰官网 enable
!
proxydns domain 1 any * any dhcp ac 米兰官网 port-channel 1 source-interface port-channel 11
proxydns address 1 any dhcp ac 米兰官网 port-channel 1 source-interface port-channel 11
!
http-client 1
 request-timeout 10 retry 5
 method 1 get url ##アップデートサーバURL## username ##USERNAME## password ##PASSWORD##
 reference-interface port-channel 11
 source-interface port-channel 11
 logging on
exit
!
end</pre>

<pre>access-list 109 deny ip any any
access-list 110 spi ip any any
access-list 4000 permit icmp6 any any neighbor-advertisement
access-list 4000 permit icmp6 any any neighbor-solicitation
access-list 4000 permit icmp6 any any router-advertisement
access-list 4000 permit udp any any eq 546
access-list 4009 deny ac 米兰官网 any any
access-list 4010 spi ac 米兰官网 any any
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip name-server ::1
!
ip dhcp server-profile LAN
 address 192.168.0.2 192.168.0.254
 lease-time 28800
 dns 192.168.0.1
 gateway 192.168.0.1
exit
!
ip nat list 1 192.168.0.0 0.0.0.255
!
ac 米兰官网 route ::/0 dhcp port-channel 1
!
ac 米兰官网 dhcp client-profile NGN
 option-request prefix-delegation
 option-request dns-server
 retries infinity
exit
!
ac 米兰官网 dhcp server-profile LANv6
 dns port-channel 1
exit
!
ipinip tunnel-profile IPIP1
 profile-mode ipip
 source ac 米兰官网 port-channel 11
 destination address ##トンネル終端装置 ac 米兰官网アドレス##
 ipinip fragment pre
exit
!
logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username test privilege 15 password 2 $LAruCQ4A$T3O69MOhXaiNub6xoHNsG1
!
hostname FITELnet
!
interface GigaEthernet 1/1
 vlan-id 11
 bridge-group 11
 channel-group 11
exit
!
interface GigaEthernet 2/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 ac 米兰官网 access-group 4000 in
 ac 米兰官网 access-group 4009 in
 ac 米兰官网 access-group 4010 out
exit
!
interface Port-channel 1
 ac 米兰官网 enable
 ac 米兰官网 dhcp service client
 ac 米兰官网 dhcp client-profile NGN
exit
!
interface Port-channel 11
 ip dhcp service server
 ip dhcp server-profile LAN
 ip address 192.168.0.1 255.255.255.0
 ac 米兰官网 enable
 ac 米兰官网 address dhcp port-channel 1 ##インタフェースID##
 ac 米兰官网 nd other-config-flag
 ac 米兰官网 nd send-ra
 ac 米兰官网 trust-ra-prefix-lifetime
 ac 米兰官网 dhcp service server
 ac 米兰官网 dhcp server-profile LANv6
 mss 1420
 ddns-client address ac 米兰官网 action http-client 1 delay 10 interval 600
exit
!
interface Tunnel 1
 ip address ##固定IPv4グローバルアドレス## 255.255.255.255
 ip access-group 109 in
 ip access-group 110 out
 ip nat inside source list 1 interface
 tunnel mode ipinip tunnel-profile IPIP1
exit
!
line console
 exec-timeout 0
 authorization exec default local
exit
!
line telnet
 exec-timeout 0
exit
!
dns-server ip enable
dns-server ac 米兰官网 enable
!
proxydns domain 1 any * any dhcp ac 米兰官网 port-channel 1 source-interface port-channel 11
proxydns address 1 any dhcp ac 米兰官网 port-channel 1 source-interface port-channel 11
!
http-client 1
 request-timeout 10 retry 5
 method 1 get url ##アップデートサーバURL## username ##USERNAME## password ##PASSWORD##
 reference-interface port-channel 11
 source-interface port-channel 11
 logging on
exit
!
end</pre>

<pre>access-list 109 deny ip any any
access-list 110 spi ip any any
access-list 4000 permit icmp6 any any neighbor-advertisement
access-list 4000 permit icmp6 any any neighbor-solicitation
access-list 4000 permit icmp6 any any router-advertisement
access-list 4000 permit udp any any eq 546
access-list 4009 deny ac 米兰官网 any any
access-list 4010 spi ac 米兰官网 any any
access-list 4100 permit tcp any any eq 53
access-list 4100 permit udp any any eq 53
access-list 4101 permit tcp any ::1/128
access-list 4101 permit udp any ::1/128
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip name-server ::1
!
ip dhcp server-profile LAN
 address 192.168.0.2 192.168.0.254
 lease-time 28800
 dns 192.168.0.1
 gateway 192.168.0.1
exit
!
ip nat list 1 192.168.0.0 0.0.0.255
!
ac 米兰官网 dhcp client-profile NGN
 option-request dns-server
 retries infinity
exit
!
ac 米兰官网 dhcp server-profile LANv6
 dns port-channel 1
exit
!
ipinip tunnel-profile IPIP1
 profile-mode ipip
 source ac 米兰官网 port-channel 11
 destination address ##BRのac 米兰官网アドレス##
 ipinip fragment pre
exit
!
logging buffer level informational
!
hostname FITELnet
!
interface GigaEthernet 1/1
 vlan-id 11
 bridge-group 11
 channel-group 11
 policy-route input DNS-POLICY
exit
!
interface GigaEthernet 2/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 ac 米兰官网 access-group 4000 in
 ac 米兰官网 access-group 4009 in
 ac 米兰官网 access-group 4010 out
exit
!
interface Port-channel 1
 ac 米兰官网 enable
 ac 米兰官网 nd receive-ra prefix-delegation port-channel 11
 ac 米兰官网 router-lifetime-receive-enable
 ac 米兰官网 trust-ra-prefix-lifetime
 ac 米兰官网 dhcp service client
 ac 米兰官网 dhcp client-profile NGN
exit
!
interface Port-channel 11
 ip dhcp service server
 ip dhcp server-profile LAN
 ip address 192.168.0.1 255.255.255.0
 ac 米兰官网 enable
 ac 米兰官网 address autoconfig interface-id ##インタフェースID##
 ac 米兰官网 nd other-config-flag
 ac 米兰官网 nd send-ra
 ac 米兰官网 trust-ra-prefix-lifetime
 ac 米兰官网 dhcp service server
 ac 米兰官网 dhcp server-profile LANv6
 mss 1420
 ddns-client address ac 米兰官网 action http-client 1 delay 10 interval 3600
exit
!
interface Tunnel 1
 ip address ##固定IPv4グローバルアドレス## 255.255.255.255
 ip access-group 109 in
 ip access-group 110 out
 ip nat inside source list 1 interface
 tunnel mode ipinip tunnel-profile IPIP1
exit
!
class-map DNS6
 match ac 米兰官网 access-group 4100
exit
!
class-map DNS6_LO
 match ac 米兰官网 access-group 4101
exit
!
policy-route-map DNS-POLICY
 !
 class DNS6
  search-sequence 10
  count
  action nexthop ##ネクストホップアドレス(ac 米兰官网)##
 exit
 !
 class DNS6_LO
  search-sequence 1
  count
  action transmit
 exit
 !
exit
!
local policy-route DNS-POLICY
!
dns-server ip enable
dns-server ac 米兰官网 enable
!
proxydns domain 1 any * any dhcp ac 米兰官网 port-channel 1 source-interface port-channel 11
proxydns address 1 any dhcp ac 米兰官网 port-channel 1 source-interface port-channel 11
!
http-client 1
 request-timeout 10 retry 5
 method 1 get url ##アップデートサーバURL## user ##ユーザID## pass ##パスワード##
 reference-interface port-channel 11
 source-interface port-channel 11
 logging on
exit
!
end</pre>

<pre>access-list 4001 permit udp ##ac 米兰官网 VPNピアアドレス##/128 eq 500 any eq 500
access-list 4001 permit 50 ##ac 米兰官网 VPNピアアドレス##/128 any
!
no ip route 0.0.0.0 0.0.0.0 tunnel 1
ip route 0.0.0.0 0.0.0.0 tunnel 2
!
local-breakout enable
local-breakout proxy-server ip any port #LBO対象パケットの宛先ポート番号#
local-breakout LBO tunnel 1
!
lbo-profile LBO
 http-snooping enable with-route
 domain *sample.com
exit
!
crypto ipsec replay-check disable
!
crypto ipsec policy IPsec_POLICY
 set security-association always-up
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-sha512-hmac esp-aes
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 src 2 ac 米兰官网 any
 dst 1 ipv4 any
 dst 2 ac 米兰官网 any
exit
!
crypto isakmp keepalive always-send interval 35
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
crypto isakmp negotiation always-up-params interval 100 max-initiate 1 max-pending 1 delay 3
!
crypto isakmp policy ISAKMP_POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 15
 lifetime 86400
 hash sha-512
exit
!
crypto isakmp profile PROF
 match identity host IPsec.example.com
 local-address source-interface port-channel 1
 self-identity user-fqdn CPE@IPsec.example.com
 set isakmp-policy ISAKMP_POLICY
 set ipsec-policy IPsec_POLICY
 set peer ##ac 米兰官网 VPNピアアドレス##
 ike-version 2
 local-key key
exit
!
crypto map MAP ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF
exit
!
interface GigaEthernet 2/1
 ac 米兰官网 access-group 4001 in
exit
!
interface Port-channel ##LAN Port-channel番号##
 mss 1350
 http-snooping enable
exit
!
interface Tunnel 2
 tunnel mode ipsec map MAP
exit</pre>

ページの先頭へ