ASA ：DHCPv6中继配置示例和故障排除

下载选项

PDF (620.5 KB)
在各种设备上使用 Adobe Reader 查看
ePub (436.3 KB)
在 iPhone、iPad、Android、Sony Reader 或 Windows Phone 上使用各种应用查看
Mobi (Kindle) (1.5 MB)
在 Kindle 设备上查看或在多个设备上使用 Kindle 应用查看

已更新: 2015 年 9 月 10 日

文档 ID:200138

关于翻译

关于此翻译

思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言，希望全球的用户都能通过各自的语言得到支持性的内容。请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任，并建议您总是参考英文原始文档（已提供链接）。

简介

本文描述如何配置思科可适应安全工具(ASA)， DHCPv6中继代理并且包括那些基本故障排除。在ASA代码版本9.0中及以后， ASA支持

先决条件

要求

Cisco 建议您了解以下主题：

IPv6基本概念
寻址的IPv6机制
DHCPv6数据包流
DHCP中继概念

使用的组件

本文档中的信息根据ASA 5500版本9.1.2。

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您使用的是真实网络，请确保您已经了解所有命令的潜在影响。

有状态的与无状态的DHCPv6

如果了解地址分配不同的说法在IPv6的，帮助您知道DHCPv6中继功能如何在ASA运作。对动态地址分配的Refre在IPv6使用SLAAC和DHCP简介的无状态的地址自动配置(SLAAC)和DHCPv6。

网络图

此配置示例描述如何配置ASA作为DHCPv6中继代理。在此配置中，客户端是IPv6客户端连接的接口。 服务器是DHCPv6服务器2001:db8:200:2/64是可及的接口。

DHCPv6与DHCPv4消息类型

无状态的DHCPv6中继

配置

这是无状态的DHCPv6中继配置的基本配置在ASA ：

interface GigabitEthernet0/1
 nameif CLIENT
 security-level 100
ipv6 address 2001:db8:100::1/64
 ipv6 enable
 ipv6 nd other-config-flag
!
interface GigabitEthernet0/0
 nameif SERVER
 security-level 0
ipv6 address 2001:db8:200:1/64
 ipv6 enable
!
ipv6 dhcprelay server 2001:db8:200:2 inside
ipv6 dhcprelay enable outside

数据包流

使用无状态的DHCPv6，这是从客户端的数据包流：

ASA截断这些数据包并且包裹他们到DHCP中继格式：

验证

调试

如果启用dhcprelay调试的IPv6并且调试IPv6 dhcp，则相关输出打印对屏幕。此输出从一个工作的方案被采取：

IPv6 DHCP: Received INFORMATION-REQUEST from fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::c671:feff:fe93:b51a (CLIENT)
    dst ff02::1:2
    type INFORMATION-REQUEST(11), xid 1588088
    option ELAPSED-TIME(8), len 2
    elapsed-time 0
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option ORO(6), len 6
    DNS-SERVERS,DOMAIN-LIST,UNKNOWN
IPv6 DHCP_RELAY: Relaying INFORMATION-REQUEST from fe80::c671:feff:fe93:b51a on CLIENT
IPv6 DHCP_RELAY: Creating relay binding for fe80::c671:feff:fe93:b51a at interface CLIENT
IPv6 DHCP_RELAY:   to 2001:db8:200::2 via 2001:db8:200::2 using SERVER
IPv6 DHCP: Sending RELAY-FORWARD to 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::1
    dst 2001:db8:200::2 (SERVER)
    type RELAY-FORWARD(12), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 34
    type INFORMATION-REQUEST(11), xid 1588088
    option ELAPSED-TIME(8), len 2
      elapsed-time 0
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option ORO(6), len 6
      DNS-SERVERS,DOMAIN-LIST,UNKNOWN
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP: Received RELAY-REPLY from 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::2 (SERVER)
    dst 2001:db8:200::1
    type RELAY-REPLY(13), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 67
    type REPLY(7), xid 1588088
    option SERVERID(2), len 10
      00030001002414a33c94
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option DNS-SERVERS(23), len 16
      2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
      cisco.com
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP_RELAY: Relaying RELAY-REPLY from 2001:db8:200::2 on SERVER
IPv6 DHCP_RELAY:   relayed msg: REPLY
IPv6 DHCP_RELAY:   to fe80::c671:feff:fe93:b51a
IPv6 DHCP: Sending REPLY to fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::219:7ff:fe24:2e44
    dst fe80::c671:feff:fe93:b51a (CLIENT)
    type REPLY(7), xid 1588088
    option SERVERID(2), len 10
    00030001002414a33c94
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option DNS-SERVERS(23), len 16
    2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
    cisco.com

在INFORMATION-REQUEST请求包中，客户端仅请求dns-server和域，预计，因为cilent为无状态的DHCPv6配置。

Wireshark快照

DHCP客户端请求

ASA中继的DHCP请求

从服务器的DHCP回复

转发的回复对客户端

有状态的DHCPv6

配置

这是有状态的DHCPv6中继配置的基本配置在ASA ：

interface GigabitEthernet0/1
 nameif CLIENT
 security-level 100
ipv6 address 2001:db8:100::1/64
 ipv6 enable
!
interface GigabitEthernet0/0
 nameif SERVER
 security-level 0
ipv6 address 2001:db8:200:1/64
 ipv6 enable
!
ipv6 dhcprelay server 2001:db8:200:2 inside
ipv6 dhcprelay enable outside

数据包流

使用有状态的DHCPv6，这是从客户端的数据包流：

ASA截断这些数据包并且包裹他们到DHCP中继格式：

验证

调试

IPv6 DHCP: Received SOLICIT from fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::c671:feff:fe93:b51a (CLIENT)
    dst ff02::1:2
    type SOLICIT(1), xid 2490681
    option ELAPSED-TIME(8), len 2
    elapsed-time 0
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option ORO(6), len 4
    DNS-SERVERS,DOMAIN-LIST
    option IA-NA(3), len 12
    IAID 0x00040001, T1 0, T2 0
IPv6 DHCP_RELAY: Relaying SOLICIT from fe80::c671:feff:fe93:b51a on CLIENT
IPv6 DHCP_RELAY: Creating relay binding for fe80::c671:feff:fe93:b51a at interface CLIENT
IPv6 DHCP_RELAY:   to 2001:db8:200::2 via 2001:db8:200::2 using SERVER
IPv6 DHCP: Sending RELAY-FORWARD to 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::1
    dst 2001:db8:200::2 (SERVER)
    type RELAY-FORWARD(12), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 48
    type SOLICIT(1), xid 2490681
    option ELAPSED-TIME(8), len 2
      elapsed-time 0
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option ORO(6), len 4
      DNS-SERVERS,DOMAIN-LIST
    option IA-NA(3), len 12
      IAID 0x00040001, T1 0, T2 0
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP: Received RELAY-REPLY from 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::2 (SERVER)
    dst 2001:db8:200::1
    type RELAY-REPLY(13), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 111
    type ADVERTISE(2), xid 2490681
    option SERVERID(2), len 10
      00030001002414a33c94
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option IA-NA(3), len 40
      IAID 0x00040001, T1 43200, T2 69120
      option IAADDR(5), len 24
        IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
        preferred INFINITY, valid INFINITY
    option DNS-SERVERS(23), len 16
      2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
      cisco.com
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP_RELAY: Relaying RELAY-REPLY from 2001:db8:200::2 on SERVER
IPv6 DHCP_RELAY:   relayed msg: ADVERTISE
IPv6 DHCP_RELAY:   to fe80::c671:feff:fe93:b51a
IPv6 DHCP: Sending ADVERTISE to fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::219:7ff:fe24:2e44
    dst fe80::c671:feff:fe93:b51a (CLIENT)
    type ADVERTISE(2), xid 2490681
    option SERVERID(2), len 10
    00030001002414a33c94
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option IA-NA(3), len 40
    IAID 0x00040001, T1 43200, T2 69120
    option IAADDR(5), len 24
      IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
      preferred INFINITY, valid INFINITY
    option DNS-SERVERS(23), len 16
    2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
    cisco.com
IPv6 DHCP: Received REQUEST from fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::c671:feff:fe93:b51a (CLIENT)
    dst ff02::1:2
    type REQUEST(3), xid 2492842
    option ELAPSED-TIME(8), len 2
    elapsed-time 0
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option ORO(6), len 4
    DNS-SERVERS,DOMAIN-LIST
    option SERVERID(2), len 10
    00030001002414a33c94
    option IA-NA(3), len 40
    IAID 0x00040001, T1 0, T2 0
    option IAADDR(5), len 24
      IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
      preferred INFINITY, valid INFINITY
IPv6 DHCP_RELAY: Relaying REQUEST from fe80::c671:feff:fe93:b51a on CLIENT
IPv6 DHCP_RELAY:   to 2001:db8:200::2 via 2001:db8:200::2 using SERVER
IPv6 DHCP: Sending RELAY-FORWARD to 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::1
    dst 2001:db8:200::2 (SERVER)
    type RELAY-FORWARD(12), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 90
    type REQUEST(3), xid 2492842
    option ELAPSED-TIME(8), len 2
      elapsed-time 0
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option ORO(6), len 4
      DNS-SERVERS,DOMAIN-LIST
    option SERVERID(2), len 10
      00030001002414a33c94
    option IA-NA(3), len 40
      IAID 0x00040001, T1 0, T2 0
      option IAADDR(5), len 24
        IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
        preferred INFINITY, valid INFINITY
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP: Received RELAY-REPLY from 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::2 (SERVER)
    dst 2001:db8:200::1
    type RELAY-REPLY(13), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 111
    type REPLY(7), xid 2492842
    option SERVERID(2), len 10
      00030001002414a33c94
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option IA-NA(3), len 40
      IAID 0x00040001, T1 43200, T2 69120
      option IAADDR(5), len 24
        IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
        preferred INFINITY, valid INFINITY
    option DNS-SERVERS(23), len 16
      2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
      cisco.com
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP_RELAY: Relaying RELAY-REPLY from 2001:db8:200::2 on SERVER
IPv6 DHCP_RELAY:   relayed msg: REPLY
IPv6 DHCP_RELAY:   to fe80::c671:feff:fe93:b51a
IPv6 DHCP: Sending REPLY to fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::219:7ff:fe24:2e44
    dst fe80::c671:feff:fe93:b51a (CLIENT)
    type REPLY(7), xid 2492842
    option SERVERID(2), len 10
    00030001002414a33c94
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option IA-NA(3), len 40
    IAID 0x00040001, T1 43200, T2 69120
    option IAADDR(5), len 24
      IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
      preferred INFINITY, valid INFINITY
    option DNS-SERVERS(23), len 16
    2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
    cisco.com

Wireshark快照

恳求(1)

DHCPv6客户端传送请求信息为了找出DHCPv6服务器。

ASA中继请求消息。

通告(2)

服务器传送通告信息为了表明为DHCP服务是可用的，以回应从客户端接收的请求消息。

REQUEST (3)

客户端发送Request信息为了要求配置参数，包括IP地址或分配的前缀，从一个特定服务器。

回复(7)

服务器传送包含已分配地址和配置参数以回应请求的回复信息，请求，更新或者重新绑定从客户端接收的消息。服务器传送包含配置参数以回应Information-request消息的回复信息。服务器传送回复信息以回应确认的确认消息或拒绝地址分配到客户端是适当的对客户端连接的链路。服务器传送回复信息为了确认版本的收据或拒绝消息。

故障排除

确认连接用DHCPv6服务器。

ciscoasa# show ipv6 neighbor
IPv6 Address                              Age Link-layer Addr State Interface

2001:db8:200::2                             0 0024.14a3.3c98  REACH SERVER

确认您收到从客户端的数据包，当它请求IPv6地址。客户端发送的数据包将取决于地址分配设置(即有状态的与无状态)。

当客户端开始DHCPv6进程时，发送路由器恳求消息为了发现IPv6路由器在线状态链路的。它传送组播路由器垦请信息为了提示IPv6路由器响应。在路由器垦请消息的以太网报头，这些字段显示：

源地址域是请求IPv6地址主机的MAC地址。
目的地址字段设置到33-33-00-00-00-02。

在路由器垦请消息的IPv6报头，这些字段显示。

源地址域设置为链路本地IPv6地址分配到发送的接口或IPv6未指明的地址(：：)。
目的地址字段设置为链路本地范围所有路由器组播地址(FF02::2)。
跳Limit字段设置到255。

合情合理IPv6路由器发送未经请求的路由器通告消息路由器通告消息由主机包含需的信息为了确定链路前缀、链路最大传输单元(MTU)和特定路由。

ciscoasa(config)# show capture capin detail

      fe80::c671:feff:fe93:b51a.546 > ff02::1:2.547:  [udp sum ok] udp 42
      [hlim 255] (len 100)---->Request from client

      fe80::219:7ff:fe24:2e44.547 > fe80::c671:feff:fe93:b51a.546:  [udp sum ok]
      udp 75 [class 0xe0] (len 133, hlim 255)

      
ciscoasa(config)# show capture capout detail 
2 packets captured

   1: 12:06:52.700799       2001:db8:200:1.547 > 2001:db8:200:2.547:  udp 88
    [class 0xe0]---->ASA forwards request to DHCPv6 router

   2: 12:06:53.289047      2001:db8:200:2.547 > 2001:db8:200:1.547:  udp 121
   [class 0xe0]----> Reply from DHCPV6 server.

DHCP中继输出

ciscoasa# show ipv6 dhcprelay binding
1 in use, 1 most used

Client: fe80::c671:feff:fe93:b51a (CLIENT)
  DUID: 00030001c471fe93b516, Timeout in 56 seconds

注意：捆绑由ASA删除在短期之后。这在dhcprelay调试的IPv6被看到。

IPv6 DHCP_RELAY: Deleting binding for fe80::c671:feff:fe93:b51a at interface CLIENT

ciscoasa# show ipv6 dhcprelay statistics

Relay Messages:
  SOLICIT                                       2
  ADVERTISE                                     2
  REQUEST                                       2
  CONFIRM                                       0
  RENEW                                         0
  REBIND                                        0
  REPLY                                         9
  RELEASE                                       1
  DECLINE                                       0
  RECONFIGURE                                   0
  INFORMATION-REQUEST                           6
  RELAY-FORWARD                                 11
  RELAY-REPLY                                   11

Relay Errors:
  Malformed message:                            0
  Block allocation/duplication failure:         0
  Hop count limit exceeded:                     0
  Forward binding creation failure:             0
  Reply binding lookup failure:                 0
  No output route:                              0
  Conflict relay server route:                  0
  Failed to add server input rule:              0
  Unit or context is not active:                0

Total Relay Bindings Created:                   8

版本地址

在他们执行使用它为网络后，客户端能发布他们的分配的DHCPv6地址。下一部分显示用在有状态的DHCPv6的地址版本关联的debug输出。

调试

IPv6 DHCP: Received RELEASE from fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::c671:feff:fe93:b51a (CLIENT)
    dst ff02::1:2
    type RELEASE(8), xid 3180815
    option ELAPSED-TIME(8), len 2
    elapsed-time 0
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option SERVERID(2), len 10
    00030001002414a33c94
    option IA-NA(3), len 40
    IAID 0x00040001, T1 0, T2 0
    option IAADDR(5), len 24
      IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
      preferred INFINITY, valid INFINITY
IPv6 DHCP_RELAY: Relaying RELEASE from fe80::c671:feff:fe93:b51a on CLIENT
IPv6 DHCP_RELAY: Creating relay binding for fe80::c671:feff:fe93:b51a at interface CLIENT
IPv6 DHCP_RELAY:   to 2001:db8:200::2 via 2001:db8:200::2 using SERVER
IPv6 DHCP: Sending RELAY-FORWARD to 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::1
    dst 2001:db8:200::2 (SERVER)
    type RELAY-FORWARD(12), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 82
    type RELEASE(8), xid 3180815
    option ELAPSED-TIME(8), len 2
      elapsed-time 0
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option SERVERID(2), len 10
      00030001002414a33c94
    option IA-NA(3), len 40
      IAID 0x00040001, T1 0, T2 0
      option IAADDR(5), len 24
        IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
        preferred INFINITY, valid INFINITY
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP: Received RELAY-REPLY from 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::2 (SERVER)
    dst 2001:db8:200::1
    type RELAY-REPLY(13), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 45
    type REPLY(7), xid 3180815
    option SERVERID(2), len 10
      00030001002414a33c94
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option STATUS-CODE(13), len 9
      status code SUCCESS(0)
      status message: SUCCESS
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP_RELAY: Relaying RELAY-REPLY from 2001:db8:200::2 on SERVER
IPv6 DHCP_RELAY:   relayed msg: REPLY
IPv6 DHCP_RELAY:   to fe80::c671:feff:fe93:b51a
IPv6 DHCP: Sending REPLY to fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::219:7ff:fe24:2e44
    dst fe80::c671:feff:fe93:b51a (CLIENT)
    type REPLY(7), xid 3180815
    option SERVERID(2), len 10
    00030001002414a33c94
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option STATUS-CODE(13), len 9
    status code SUCCESS(0)
    status message: SUCCESS

ASA ：DHCPv6中继配置示例和故障排除

下载选项

关于此翻译

目录

简介

先决条件

要求

使用的组件

有状态的与无状态的DHCPv6

网络图

DHCPv6与DHCPv4消息类型

无状态的DHCPv6中继

配置

数据包流

验证

调试

Wireshark快照

有状态的DHCPv6

配置

数据包流

验证

调试

Wireshark快照

故障排除

DHCP中继输出

版本地址

调试

相关信息

由思科工程师提供

此文档是否有帮助?

联系我们

本文档适用于以下产品

ASA ：DHCPv6中继配置示例和故障排除

下载选项

关于此翻译

目录

简介

使用的组件

有状态的与无状态的DHCPv6

网络图

DHCPv6与DHCPv4消息类型

无状态的DHCPv6中继

数据包流

调试

Wireshark快照

有状态的DHCPv6

数据包流

调试

Wireshark快照

DHCP中继输出

版本地址

调试

相关信息

由思科工程师提供

此文档是否有帮助?

联系我们

本文档适用于以下产品

分享