ASA ：DHCPv6中继配置示例和故障排除

下载选项

  • PDF     (665.2 KB)
    在各种设备上使用 Adobe Reader 查看
  • ePub     (445.1 KB)
    在 iPhone、iPad、Android、Sony Reader 或 Windows Phone 上使用各种应用查看
  • Mobi (Kindle)     (1.5 MB)
    在 Kindle 设备上查看或在多个设备上使用 Kindle 应用查看
已更新: 2015 年 9 月 10 日
文档 ID:200138

非歧视性语言

此产品的文档集力求使用非歧视性语言。在本文档集中，非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言，文档中可能无法确保完全使用非歧视性语言。 深入了解思科如何使用包容性语言。

关于此翻译

思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言，希望全球的用户都能通过各自的语言得到支持性的内容。 请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任，并建议您总是参考英文原始文档（已提供链接）。

简介

本文档介绍如何将思科自适应安全设备(ASA)配置为DHCPv6中继代理，并介绍一些基本的故障排除。在ASA代码版本9.0及更高版本中，ASA支持 

先决条件

要求

Cisco 建议您了解以下主题：

  • IPv6基本概念
  • IPv6编址机制
  • DHCPv6数据包流
  • DHCP中继概念

使用的组件

本文档中的信息基于ASA 5500 9.1.2版。

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您使用的是真实网络，请确保您已经了解所有命令的潜在影响。

有状态DHCPv6与无状态DHCPv6

如果您了解IPv6中不同的地址分配方法，它有助于您了解DHCPv6中继功能在ASA上的工作方式。有关无状态地址自动配置(SLAAC)和DHCPv6的简介，请参阅使用SLAAC和DHCP在IPv6中动态分配地址。

网络图

此示例配置描述如何将ASA配置为DHCPv6中继代理。在此配置中，CLIENT是IPv6客户端连接的接口。SERVER是DHCPv6服务器2001:db8:200:2/64可通过的接口。

200138-ASA-DHCPv6-Relay-configuration-example-00.png

DHCPv6与DHCPv4消息类型 

200138-ASA-DHCPv6-Relay-configuration-example-01.png

无状态DHCPv6中继

配置

以下是ASA上无状态DHCPv6中继配置的基本配置：

interface GigabitEthernet0/1
 nameif CLIENT
 security-level 100
ipv6 address 2001:db8:100::1/64
 ipv6 enable
 ipv6 nd other-config-flag
!
interface GigabitEthernet0/0
 nameif SERVER
 security-level 0
ipv6 address 2001:db8:200:1/64
 ipv6 enable
!
ipv6 dhcprelay server 2001:db8:200:2 inside
ipv6 dhcprelay enable outside

数据包流

对于无状态DHCPv6，以下是来自客户端的数据包流：

200138-ASA-DHCPv6-Relay-configuration-example-02.png

ASA拦截这些数据包并将其封装为DHCP中继格式：

200138-ASA-DHCPv6-Relay-configuration-example-03.png

验证

调试

如果启用debug ipv6 dhcprelay和debug ipv6 dhcp，则相关输出将打印到屏幕。此输出取自工作场景：

IPv6 DHCP: Received INFORMATION-REQUEST from fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::c671:feff:fe93:b51a (CLIENT)
    dst ff02::1:2
    type INFORMATION-REQUEST(11), xid 1588088
    option ELAPSED-TIME(8), len 2
    elapsed-time 0
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option ORO(6), len 6
    DNS-SERVERS,DOMAIN-LIST,UNKNOWN
IPv6 DHCP_RELAY: Relaying INFORMATION-REQUEST from fe80::c671:feff:fe93:b51a on CLIENT
IPv6 DHCP_RELAY: Creating relay binding for fe80::c671:feff:fe93:b51a at interface CLIENT
IPv6 DHCP_RELAY:   to 2001:db8:200::2 via 2001:db8:200::2 using SERVER
IPv6 DHCP: Sending RELAY-FORWARD to 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::1
    dst 2001:db8:200::2 (SERVER)
    type RELAY-FORWARD(12), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 34
    type INFORMATION-REQUEST(11), xid 1588088
    option ELAPSED-TIME(8), len 2
      elapsed-time 0
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option ORO(6), len 6
      DNS-SERVERS,DOMAIN-LIST,UNKNOWN
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP: Received RELAY-REPLY from 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::2 (SERVER)
    dst 2001:db8:200::1
    type RELAY-REPLY(13), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 67
    type REPLY(7), xid 1588088
    option SERVERID(2), len 10
      00030001002414a33c94
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option DNS-SERVERS(23), len 16
      2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
      cisco.com
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP_RELAY: Relaying RELAY-REPLY from 2001:db8:200::2 on SERVER
IPv6 DHCP_RELAY:   relayed msg: REPLY
IPv6 DHCP_RELAY:   to fe80::c671:feff:fe93:b51a
IPv6 DHCP: Sending REPLY to fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::219:7ff:fe24:2e44
    dst fe80::c671:feff:fe93:b51a (CLIENT)
    type REPLY(7), xid 1588088
    option SERVERID(2), len 10
    00030001002414a33c94
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option DNS-SERVERS(23), len 16
    2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
    cisco.com

在INFORMATION-REQUEST请求数据包中，客户端仅请求DNS-Server和域，因为客户端配置为无状态DHCPv6，所以这是预期的。

Wireshark快照

DHCP客户端请求

200138-ASA-DHCPv6-Relay-configuration-example-04.png

ASA中继的DHCP请求

200138-ASA-DHCPv6-Relay-configuration-example-05.png

从服务器发送DHCP应答

200138-ASA-DHCPv6-Relay-configuration-example-06.png

回复已转发到客户端

200138-ASA-DHCPv6-Relay-configuration-example-07.png

有状态DHCPv6

配置

以下是ASA上有状态DHCPv6中继配置的基本配置：

interface GigabitEthernet0/1
 nameif CLIENT
 security-level 100
ipv6 address 2001:db8:100::1/64
 ipv6 enable
!
interface GigabitEthernet0/0
 nameif SERVER
 security-level 0
ipv6 address 2001:db8:200:1/64
 ipv6 enable
!
ipv6 dhcprelay server 2001:db8:200:2 inside
ipv6 dhcprelay enable outside 

数据包流

使用有状态DHCPv6时，以下是来自客户端的数据包流：

200138-ASA-DHCPv6-Relay-configuration-example-08.png

ASA拦截这些数据包并将其封装为DHCP中继格式：

200138-ASA-DHCPv6-Relay-configuration-example-09.png

验证

 调试

IPv6 DHCP: Received SOLICIT from fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::c671:feff:fe93:b51a (CLIENT)
    dst ff02::1:2
    type SOLICIT(1), xid 2490681
    option ELAPSED-TIME(8), len 2
    elapsed-time 0
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option ORO(6), len 4
    DNS-SERVERS,DOMAIN-LIST
    option IA-NA(3), len 12
    IAID 0x00040001, T1 0, T2 0
IPv6 DHCP_RELAY: Relaying SOLICIT from fe80::c671:feff:fe93:b51a on CLIENT
IPv6 DHCP_RELAY: Creating relay binding for fe80::c671:feff:fe93:b51a at interface CLIENT
IPv6 DHCP_RELAY:   to 2001:db8:200::2 via 2001:db8:200::2 using SERVER
IPv6 DHCP: Sending RELAY-FORWARD to 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::1
    dst 2001:db8:200::2 (SERVER)
    type RELAY-FORWARD(12), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 48
    type SOLICIT(1), xid 2490681
    option ELAPSED-TIME(8), len 2
      elapsed-time 0
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option ORO(6), len 4
      DNS-SERVERS,DOMAIN-LIST
    option IA-NA(3), len 12
      IAID 0x00040001, T1 0, T2 0
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP: Received RELAY-REPLY from 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::2 (SERVER)
    dst 2001:db8:200::1
    type RELAY-REPLY(13), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 111
    type ADVERTISE(2), xid 2490681
    option SERVERID(2), len 10
      00030001002414a33c94
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option IA-NA(3), len 40
      IAID 0x00040001, T1 43200, T2 69120
      option IAADDR(5), len 24
        IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
        preferred INFINITY, valid INFINITY
    option DNS-SERVERS(23), len 16
      2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
      cisco.com
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP_RELAY: Relaying RELAY-REPLY from 2001:db8:200::2 on SERVER
IPv6 DHCP_RELAY:   relayed msg: ADVERTISE
IPv6 DHCP_RELAY:   to fe80::c671:feff:fe93:b51a
IPv6 DHCP: Sending ADVERTISE to fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::219:7ff:fe24:2e44
    dst fe80::c671:feff:fe93:b51a (CLIENT)
    type ADVERTISE(2), xid 2490681
    option SERVERID(2), len 10
    00030001002414a33c94
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option IA-NA(3), len 40
    IAID 0x00040001, T1 43200, T2 69120
    option IAADDR(5), len 24
      IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
      preferred INFINITY, valid INFINITY
    option DNS-SERVERS(23), len 16
    2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
    cisco.com
IPv6 DHCP: Received REQUEST from fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::c671:feff:fe93:b51a (CLIENT)
    dst ff02::1:2
    type REQUEST(3), xid 2492842
    option ELAPSED-TIME(8), len 2
    elapsed-time 0
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option ORO(6), len 4
    DNS-SERVERS,DOMAIN-LIST
    option SERVERID(2), len 10
    00030001002414a33c94
    option IA-NA(3), len 40
    IAID 0x00040001, T1 0, T2 0
    option IAADDR(5), len 24
      IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
      preferred INFINITY, valid INFINITY
IPv6 DHCP_RELAY: Relaying REQUEST from fe80::c671:feff:fe93:b51a on CLIENT
IPv6 DHCP_RELAY:   to 2001:db8:200::2 via 2001:db8:200::2 using SERVER
IPv6 DHCP: Sending RELAY-FORWARD to 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::1
    dst 2001:db8:200::2 (SERVER)
    type RELAY-FORWARD(12), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 90
    type REQUEST(3), xid 2492842
    option ELAPSED-TIME(8), len 2
      elapsed-time 0
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option ORO(6), len 4
      DNS-SERVERS,DOMAIN-LIST
    option SERVERID(2), len 10
      00030001002414a33c94
    option IA-NA(3), len 40
      IAID 0x00040001, T1 0, T2 0
      option IAADDR(5), len 24
        IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
        preferred INFINITY, valid INFINITY
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP: Received RELAY-REPLY from 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::2 (SERVER)
    dst 2001:db8:200::1
    type RELAY-REPLY(13), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 111
    type REPLY(7), xid 2492842
    option SERVERID(2), len 10
      00030001002414a33c94
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option IA-NA(3), len 40
      IAID 0x00040001, T1 43200, T2 69120
      option IAADDR(5), len 24
        IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
        preferred INFINITY, valid INFINITY
    option DNS-SERVERS(23), len 16
      2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
      cisco.com
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP_RELAY: Relaying RELAY-REPLY from 2001:db8:200::2 on SERVER
IPv6 DHCP_RELAY:   relayed msg: REPLY
IPv6 DHCP_RELAY:   to fe80::c671:feff:fe93:b51a
IPv6 DHCP: Sending REPLY to fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::219:7ff:fe24:2e44
    dst fe80::c671:feff:fe93:b51a (CLIENT)
    type REPLY(7), xid 2492842
    option SERVERID(2), len 10
    00030001002414a33c94
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option IA-NA(3), len 40
    IAID 0x00040001, T1 43200, T2 69120
    option IAADDR(5), len 24
      IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
      preferred INFINITY, valid INFINITY
    option DNS-SERVERS(23), len 16
    2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
    cisco.com

Wireshark快照

SOLICIT(1)

DHCPv6客户端发送Solicit消息以查找DHCPv6服务器。

200138-ASA-DHCPv6-Relay-configuration-example-10.png

ASA中继Solicit消息。

200138-ASA-DHCPv6-Relay-configuration-example-11.png

ADVERTISE(2)

服务器发送通告消息以指示其可用于DHCP服务，以响应从客户端收到的请求消息。

200138-ASA-DHCPv6-Relay-configuration-example-12.png

200138-ASA-DHCPv6-Relay-configuration-example-13.png

请求(3)

客户端发送请求消息以从特定服务器请求配置参数，包括IP地址或授权前缀。

200138-ASA-DHCPv6-Relay-configuration-example-14.png

回复(7)

服务器发送包含已分配地址和配置参数的回复消息，以响应从客户端收到的请求、请求、续订或重新绑定消息。服务器发送包含配置参数的应答消息以响应信息请求消息。服务器发送回复消息以响应确认消息，确认或拒绝分配给客户端的地址适合客户端所连接的链路。服务器发送回复消息以确认收到释放或拒绝消息。

200138-ASA-DHCPv6-Relay-configuration-example-15.png

故障排除

确认与DHCPv6服务器的连接。

ciscoasa# show ipv6 neighbor
IPv6 Address                              Age Link-layer Addr State Interface

2001:db8:200::2                             0 0024.14a3.3c98  REACH SERVER

确认在客户端请求IPv6地址时收到来自该客户端的数据包。客户端发送的数据包取决于地址分配设置（即有状态与无状态）。

当客户端开始DHCPv6进程时，它会发送路由器请求消息以发现链路上存在IPv6路由器。它发送组播路由器请求消息以提示IPv6路由器做出响应。在路由器请求消息的以太网报头中，以下字段显示：

  • 源地址字段是请求IPv6地址的主机的MAC地址。
  • “目标地址”字段设置为33-33-00-00-00-02。

在路由器请求消息的IPv6报头中，显示这些字段。

  • “源地址”字段设置为分配给发送接口的本地链路IPv6地址或未指定IPv6地址(::)。
  • Destination Address字段设置为本地链路范围的所有路由器组播地址(FF02::2)。
  • 跳数限制字段设置为255。

作为响应，IPv6路由器发送未经请求的路由器通告消息路由器通告消息包含主机确定链路前缀、链路最大传输单元(MTU)和特定路由所需的信息。

ciscoasa(config)# show capture capin detail

      fe80::c671:feff:fe93:b51a.546 > ff02::1:2.547:  [udp sum ok] udp 42
      [hlim 255] (len 100)---->Request from client

      fe80::219:7ff:fe24:2e44.547 > fe80::c671:feff:fe93:b51a.546:  [udp sum ok]
      udp 75 [class 0xe0] (len 133, hlim 255)

      
ciscoasa(config)# show capture capout detail 
2 packets captured

   1: 12:06:52.700799       2001:db8:200:1.547 > 2001:db8:200:2.547:  udp 88
    [class 0xe0]---->ASA forwards request to DHCPv6 router

   2: 12:06:53.289047      2001:db8:200:2.547 > 2001:db8:200:1.547:  udp 121
   [class 0xe0]----> Reply from DHCPV6 server.

DHCP中继输出

ciscoasa# show ipv6 dhcprelay binding
1 in use, 1 most used

Client: fe80::c671:feff:fe93:b51a (CLIENT)
  DUID: 00030001c471fe93b516, Timeout in 56 seconds

注意：ASA在短时间后删除绑定。在debug ipv6 dhcprelay中可见此情况。

IPv6 DHCP_RELAY: Deleting binding for fe80::c671:feff:fe93:b51a at interface CLIENT
ciscoasa# show ipv6 dhcprelay statistics

Relay Messages:
  SOLICIT                                       2
  ADVERTISE                                     2
  REQUEST                                       2
  CONFIRM                                       0
  RENEW                                         0
  REBIND                                        0
  REPLY                                         9
  RELEASE                                       1
  DECLINE                                       0
  RECONFIGURE                                   0
  INFORMATION-REQUEST                           6
  RELAY-FORWARD                                 11
  RELAY-REPLY                                   11

Relay Errors:
  Malformed message:                            0
  Block allocation/duplication failure:         0
  Hop count limit exceeded:                     0
  Forward binding creation failure:             0
  Reply binding lookup failure:                 0
  No output route:                              0
  Conflict relay server route:                  0
  Failed to add server input rule:              0
  Unit or context is not active:                0

Total Relay Bindings Created:                   8

版本地址

客户端在完成对网络的DHCPv6分配地址的使用后，可以释放其DHCPv6分配地址。下一节显示与有状态DHCPv6中的地址释放关联的调试输出。

调试

IPv6 DHCP: Received RELEASE from fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::c671:feff:fe93:b51a (CLIENT)
    dst ff02::1:2
    type RELEASE(8), xid 3180815
    option ELAPSED-TIME(8), len 2
    elapsed-time 0
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option SERVERID(2), len 10
    00030001002414a33c94
    option IA-NA(3), len 40
    IAID 0x00040001, T1 0, T2 0
    option IAADDR(5), len 24
      IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
      preferred INFINITY, valid INFINITY
IPv6 DHCP_RELAY: Relaying RELEASE from fe80::c671:feff:fe93:b51a on CLIENT
IPv6 DHCP_RELAY: Creating relay binding for fe80::c671:feff:fe93:b51a at interface CLIENT
IPv6 DHCP_RELAY:   to 2001:db8:200::2 via 2001:db8:200::2 using SERVER
IPv6 DHCP: Sending RELAY-FORWARD to 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::1
    dst 2001:db8:200::2 (SERVER)
    type RELAY-FORWARD(12), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 82
    type RELEASE(8), xid 3180815
    option ELAPSED-TIME(8), len 2
      elapsed-time 0
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option SERVERID(2), len 10
      00030001002414a33c94
    option IA-NA(3), len 40
      IAID 0x00040001, T1 0, T2 0
      option IAADDR(5), len 24
        IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
        preferred INFINITY, valid INFINITY
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP: Received RELAY-REPLY from 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::2 (SERVER)
    dst 2001:db8:200::1
    type RELAY-REPLY(13), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 45
    type REPLY(7), xid 3180815
    option SERVERID(2), len 10
      00030001002414a33c94
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option STATUS-CODE(13), len 9
      status code SUCCESS(0)
      status message: SUCCESS
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP_RELAY: Relaying RELAY-REPLY from 2001:db8:200::2 on SERVER
IPv6 DHCP_RELAY:   relayed msg: REPLY
IPv6 DHCP_RELAY:   to fe80::c671:feff:fe93:b51a
IPv6 DHCP: Sending REPLY to fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::219:7ff:fe24:2e44
    dst fe80::c671:feff:fe93:b51a (CLIENT)
    type REPLY(7), xid 3180815
    option SERVERID(2), len 10
    00030001002414a33c94
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option STATUS-CODE(13), len 9
    status code SUCCESS(0)
    status message: SUCCESS

相关信息

了解各种DHCP选项

ASA DHCP 中继配置示例

配置ASA以传递IPv6流量

通过 CLI 和 ASDM 配置实现 ASA 数据包捕获示例

TAC Authored

由思科工程师提供

此文档是否有帮助?

Feedback反馈

联系我们

本文档适用于以下产品