動的IPサービス（MAP-E）でVPN/ローカルブレイクアウトを利用する｜IPoEの設定｜設定例｜ルータ・ネットワーク機器

VNE各社の動的IPサービス（MAP-E）でVPN/ローカルブレイクアウトを利用する場合の設定例です。

ローカルブレイクアウト機能については下記の機能説明資料をご参照ください。

本設定例は、次のサービスに適用可能です。

VNE事業者	IPoEサービス名	設定例	設定例 (txt)
NTTコミュニケーションズ	「OCNバーチャルコネクトサービス（IPoE）」	動的IPを利用	この設定のご利用は
JPIX	「v6プラス」 IPv6/IPv4インターネットサービス	HGWあり/ひかり電話あり	この設定のご利用は
		HGWあり/ひかり電話なし	この設定のご利用は
		HGWなし/ひかり電話なし	この設定のご利用は
BIGLOBE	「IPv6オプション」	HGWあり/ひかり電話あり	この設定のご利用は
BIGLOBE	「IPv6オプション」	HGWなし/ひかり電話なし	この設定のご利用は

ローカルブレイクアウト機能（機能説明）

補足・注意点

以下の設定例は、単独では使用できません。必ず上記動的サービスの設定例と組み合わせてご使用ください。
先に上記動的サービスの設定を行ってから、以下の設定を適用する手順でお願いします。
以下の設定例のPDFファイルをご確認ください。補足欄にコマンドの補足説明や注意点を記載しております。

構成と設定例

VPN/ローカルブレイクアウト

IPoE網にてVPN接続して、通常のインターネット向け通信をVPN経由、SaaS向け通信をブレイクアウトしてV4overV6トンネル経由とするための設定例です。

設定例	設定例（txt）
VPN/ローカルブレイクアウトを利用する（Proxyサーバを利用）New	この設定のご利用は

設定例のローカルブレイクアウト機能に関係する箇所（PDFファイルの黄色セル部分）を下記の「アプリケーション毎の設定」を参考に変更すれば、お客様の環境におけるProxyサーバの利用有無やLBO対象のアプリケーションに合わせて利用可能です。

アプリケーション毎の設定（ローカルブレイクアウト機能を使う）

<pre>
access-list 109 deny ip any any
access-list 110 spi ip any any
access-list 4000 permit icmp6 any any neighbor-advertisement
access-list 4000 permit icmp6 any any neighbor-solicitation
access-list 4000 permit icmp6 any any router-advertisement
access-list 4000 permit udp any any eq 546
access-list 4009 deny ipv6 any any
access-list 4010 spi ipv6 any any
access-list 4100 permit tcp any any eq 53
access-list 4100 permit udp any any eq 53
access-list 4101 permit tcp any ::1/128
access-list 4101 permit udp any ::1/128
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip name-server ::1
!
ip dhcp server-profile DHCPv4_server
 address 192.168.100.2 192.168.100.254
 lease-time 259200
 dns 192.168.100.1
 gateway 192.168.100.1
exit
!
ip nat list 1 192.168.100.0 0.0.0.255
ip nat wellknown 1 1 65535 off
ip nat port-sharing enable
!
ipv6 dhcp client-profile DHCPv6_client
 option-request dns-server
 option-request dns-server-domain
 retries infinity
exit
!
ipv6 dhcp server-profile DHCPv6_server
 dns port-channel 2
 domain port-channel 2
exit
!
event-action 1
 event-condition match-all
 event interface tunnel 1 up
 event timer countdown 180 replay
 action 1.1 cli exec command ping ##宛先IPアドレス## source 192.168.100.1 repeat 1
exit
!
ipinip tunnel-profile MAPCE
 profile-mode map-encap option-c
 map rule-get
 ipinip fragment pre
exit
!
logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username test privilege 15 password 2 $1$LAruCQ4A$T3O69MOhXaiNub6xoHNsG1
!
hostname FITELnet
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 policy-route input DNS-POLICY
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 channel-group 2
 ipv6 access-group 4000 in
 ipv6 access-group 4009 in
 ipv6 access-group 4010 out
 ipv6 access-group spi ftp-data enable
exit
!
interface Port-channel 1
 ip dhcp service server
 ip dhcp server-profile DHCPv4_server
 ip address 192.168.100.1 255.255.255.0
 ipv6 enable
 ipv6 address autoconfig
 ipv6 address autoconfig-map-encap MAPCE
 ipv6 nd other-config-flag
 ipv6 nd send-ra
 ipv6 trust-ra-prefix-lifetime
 ipv6 dhcp service server
 ipv6 dhcp server-profile DHCPv6_server
 mss 1420
 link-state always-up
exit
!
interface Port-channel 2
 ipv6 enable
 ipv6 nd receive-ra prefix-delegation port-channel 1
 ipv6 router-lifetime-receive-enable
 ipv6 trust-ra-prefix-lifetime
 ipv6 dhcp service client
 ipv6 dhcp client-profile DHCPv6_client
exit
!
interface Tunnel 1
 ip access-group 109 in
 ip access-group 110 out
 ip access-group spi ftp-data enable
 ip nat inside source list 1 map-encap overload
 tunnel mode ipinip tunnel-profile MAPCE
exit
!
line console
 exec-timeout 0
 authorization exec default local
exit
!
line telnet
 exec-timeout 0
exit
!
class-map DNS6
 match ipv6 access-group 4100
exit
!
class-map DNS6_LO
 match ipv6 access-group 4101
exit
!
policy-route-map DNS-POLICY
 !
 class DNS6
  search-sequence 10
  count
  action nexthop ##ネクストホップアドレス(IPv6)##
 exit
 !
 class DNS6_LO
  search-sequence 1
  count
  action transmit
 exit
 !
exit
!
local policy-route DNS-POLICY
!
dns-server ip enable
dns-server ipv6 enable
!
proxydns domain 1 any * any dhcp ipv6 port-channel 2 source-interface port-channel 1
proxydns address 1 any dhcp ipv6 port-channel 2 source-interface port-channel 1
!
end
</pre>

<pre>
access-list 100 permit udp any eq 67 any eq 68
access-list 109 deny ip any any
access-list 110 spi ip any any
access-list 4000 permit icmp6 any any neighbor-advertisement
access-list 4000 permit icmp6 any any neighbor-solicitation
access-list 4000 permit icmp6 any any router-advertisement
access-list 4000 permit udp any any eq 546
access-list 4009 deny ipv6 any any
access-list 4010 spi ipv6 any any
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip name-server ::1
!
ip dhcp client-profile DHCPv4_client
 retries infinity
exit
!
ip dhcp server-profile DHCPv4_server
 address 192.168.100.2 192.168.100.254
 lease-time 259200
 dns 192.168.100.1
 gateway 192.168.100.1
exit
!
ip nat list 1 192.168.100.0 0.0.0.255
ip nat wellknown 1 1 65535 off
ip nat port-sharing enable
!
ipv6 dhcp client-profile DHCPv6_client
 option-request prefix-delegation
 option-request dns-server
 option-request dns-server-domain
 retries infinity
exit
!
ipv6 dhcp server-profile DHCPv6_server
 dns port-channel 2
 domain port-channel 2
exit
!
ipinip tunnel-profile MAPCE
 profile-mode map-encap option-a
 map rule-get
 ipinip fragment pre
exit
!
logging buffer level informational
!
hostname FITELnet_MAPCE
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 channel-group 2
 ip access-group 100 in
 ip access-group 109 in
 ip access-group 110 out
 ipv6 access-group 4000 in
 ipv6 access-group 4009 in
 ipv6 access-group 4010 out
exit
!
interface Port-channel 1
 ip dhcp service server
 ip dhcp server-profile DHCPv4_server
 ip address 192.168.100.1 255.255.255.0
 ipv6 enable
 ipv6 address dhcp port-channel 2 ::f:0:0:0:1/64
 ipv6 nd other-config-flag
 ipv6 nd send-ra
 ipv6 trust-ra-prefix-lifetime
 ipv6 dhcp service server
 ipv6 dhcp server-profile DHCPv6_server
 mss 1420
exit
!
interface Port-channel 2
 ip dhcp service client
 ip dhcp client-profile DHCPv4_client
 ipv6 enable
 ipv6 address autoconfig
 ipv6 address autoconfig-map-encap MAPCE
 ipv6 nd receive-ra
 ipv6 router-lifetime-receive-enable
 ipv6 trust-ra-prefix-lifetime
 ipv6 dhcp service client
 ipv6 dhcp client-profile DHCPv6_client
exit
!
interface Tunnel 1
 ip access-group 109 in
 ip access-group 110 out
 ip nat inside source list 1 map-encap overload
 tunnel mode ipinip tunnel-profile MAPCE
exit
!
dns-server ip enable
dns-server ipv6 enable
!
proxydns domain 1 any ntt.setup ::1/128 dhcp-no-skip ipv4 port-channel 2
proxydns domain 2 any * any dhcp ipv6 port-channel 2
proxydns address 1 any dhcp ipv6 port-channel 2
!
end
</pre>

<pre>
access-list 100 permit udp any eq 67 any eq 68
access-list 109 deny ip any any
access-list 110 spi ip any any
access-list 4000 permit icmp6 any any neighbor-advertisement
access-list 4000 permit icmp6 any any neighbor-solicitation
access-list 4000 permit icmp6 any any router-advertisement
access-list 4000 permit udp any any eq 546
access-list 4009 deny ipv6 any any
access-list 4010 spi ipv6 any any
access-list 4100 permit tcp any any eq 53
access-list 4100 permit udp any any eq 53
access-list 4101 permit tcp any ::1/128
access-list 4101 permit udp any ::1/128
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip name-server ::1
!
ip dhcp client-profile DHCPv4_client
 retries infinity
exit
!
ip dhcp server-profile DHCPv4_server
 address 192.168.100.2 192.168.100.254
 lease-time 259200
 dns 192.168.100.1
 gateway 192.168.100.1
exit
!
ip nat list 1 192.168.100.0 0.0.0.255
ip nat wellknown 1 1 65535 off
ip nat port-sharing enable
!
ipv6 dhcp client-profile DHCPv6_client
 option-request dns-server
 option-request dns-server-domain
 retries infinity
exit
!
ipv6 dhcp server-profile DHCPv6_server
 dns port-channel 2
 domain port-channel 2
exit
!
ipinip tunnel-profile MAPCE
 profile-mode map-encap option-a
 map rule-get
 ipinip fragment pre
exit
!
logging buffer level informational
!
hostname FITELnet_MAPCE
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 policy-route input DNS-POLICY
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 channel-group 2
 ip access-group 100 in
 ip access-group 109 in
 ip access-group 110 out
 ipv6 access-group 4000 in
 ipv6 access-group 4009 in
 ipv6 access-group 4010 out
exit
!
interface Port-channel 1
 ip dhcp service server
 ip dhcp server-profile DHCPv4_server
 ip address 192.168.100.1 255.255.255.0
 ipv6 enable
 ipv6 address autoconfig
 ipv6 address autoconfig-map-encap MAPCE
 ipv6 nd other-config-flag
 ipv6 nd send-ra
 ipv6 trust-ra-prefix-lifetime
 ipv6 dhcp service server
 ipv6 dhcp server-profile DHCPv6_server
 mss 1420
exit
!
interface Port-channel 2
 ip dhcp service client
 ip dhcp client-profile DHCPv4_client
 ipv6 enable
 ipv6 nd receive-ra prefix-delegation port-channel 1
 ipv6 router-lifetime-receive-enable
 ipv6 trust-ra-prefix-lifetime
 ipv6 dhcp service client
 ipv6 dhcp client-profile DHCPv6_client
exit
!
interface Tunnel 1
 ip access-group 109 in
 ip access-group 110 out
 ip nat inside source list 1 map-encap overload
 tunnel mode ipinip tunnel-profile MAPCE
exit
!
class-map DNS6
 match ipv6 access-group 4100
exit
!
class-map DNS6_LO
 match ipv6 access-group 4101
exit
!
policy-route-map DNS-POLICY
 !
 class DNS6
  search-sequence 10
  count
  action nexthop ##ネクストホップアドレス(IPv6)##
 exit
 !
 class DNS6_LO
  search-sequence 1
  count
  action transmit
 exit
 !
exit
!
local policy-route DNS-POLICY
!
dns-server ip enable
dns-server ipv6 enable
!
proxydns domain 1 any ntt.setup ::1/128 dhcp-no-skip ipv4 port-channel 2
proxydns domain 2 any * any dhcp ipv6 port-channel 2 source-interface port-channel 1
proxydns address 1 any dhcp ipv6 port-channel 2 source-interface port-channel 1
!
end
</pre>

<pre>
access-list 100 permit udp any eq 67 any eq 68
access-list 109 deny ip any any
access-list 110 spi ip any any
access-list 4000 permit icmp6 any any neighbor-advertisement
access-list 4000 permit icmp6 any any neighbor-solicitation
access-list 4000 permit icmp6 any any router-advertisement
access-list 4000 permit udp any any eq 546
access-list 4009 deny ipv6 any any
access-list 4010 spi ipv6 any any
access-list 4100 permit tcp any any eq 53
access-list 4100 permit udp any any eq 53
access-list 4101 permit tcp any ::1/128
access-list 4101 permit udp any ::1/128
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip name-server ::1
!
ip dhcp client-profile DHCPv4_client
 retries infinity
exit
!
ip dhcp server-profile DHCPv4_server
 address 192.168.100.2 192.168.100.254
 lease-time 259200
 dns 192.168.100.1
 gateway 192.168.100.1
exit
!
ip nat list 1 192.168.100.0 0.0.0.255
ip nat wellknown 1 1 65535 off
ip nat port-sharing enable
!
ipv6 dhcp client-profile DHCPv6_client
 option-request dns-server
 option-request dns-server-domain
 retries infinity
exit
!
ipv6 dhcp server-profile DHCPv6_server
 dns port-channel 2
 domain port-channel 2
exit
!
ipinip tunnel-profile MAPCE
 profile-mode map-encap option-b
 map rule-get
 ipinip fragment pre
exit
!
logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username st privilege 15 password 2 $1$yg27Q4xa$FzRzJaCNDLIPbh86A/Q9z/
!
hostname FITELnet
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 policy-route input DNS-POLICY
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 channel-group 2
 ip access-group 100 in
 ip access-group 109 in
 ip access-group 110 out
 ipv6 access-group 4000 in
 ipv6 access-group 4009 in
 ipv6 access-group 4010 out
 ipv6 access-group spi ftp-data enable
exit
!
interface Port-channel 1
 ip dhcp service server
 ip dhcp server-profile DHCPv4_server
 ip address 192.168.100.1 255.255.255.0
 ipv6 enable
 ipv6 address autoconfig
 ipv6 address autoconfig-map-encap MAPCE
 ipv6 nd other-config-flag
 ipv6 nd send-ra
 ipv6 trust-ra-prefix-lifetime
 ipv6 dhcp service server
 ipv6 dhcp server-profile DHCPv6_server
 link-state always-up
 mss 1420
exit
!
interface Port-channel 2
 ip dhcp service client
 ip dhcp client-profile DHCPv4_client
 ipv6 enable
 ipv6 nd receive-ra prefix-delegation port-channel 1
 ipv6 router-lifetime-receive-enable
 ipv6 trust-ra-prefix-lifetime
 ipv6 dhcp service client
 ipv6 dhcp client-profile DHCPv6_client
exit
!
interface Tunnel 1
 ip access-group 109 in
 ip access-group 110 out
 ip access-group spi ftp-data enable
 ip nat inside source list 1 map-encap overload
 tunnel mode ipinip tunnel-profile MAPCE
exit
!
line console
 exec-timeout 0
 authorization exec default local
exit
!
line telnet
 exec-timeout 0
exit
!
class-map DNS6
 match ipv6 access-group 4100
exit
!
class-map DNS6_LO
 match ipv6 access-group 4101
exit
!
policy-route-map DNS-POLICY
 !
 class DNS6
  search-sequence 10
  count
  action nexthop ##ネクストホップアドレス(IPv6)##
 exit
 !
 class DNS6_LO
  search-sequence 1
  count
  action transmit
 exit
 !
exit
!
local policy-route DNS-POLICY
!
dns-server ip enable
dns-server ipv6 enable
!
proxydns domain 1 any ntt.setup ::1/128 dhcp-no-skip ipv4 port-channel 2
proxydns domain 2 any * any dhcp ipv6 port-channel 2
proxydns address 1 any dhcp ipv6 port-channel 2
!
end
</pre>

<pre>
access-list 109 deny ip any any
access-list 110 spi ip any any
access-list 4000 permit icmp6 any any neighbor-advertisement
access-list 4000 permit icmp6 any any neighbor-solicitation
access-list 4000 permit icmp6 any any router-advertisement
access-list 4000 permit udp any any eq 546
access-list 4009 deny ipv6 any any
access-list 4010 spi ipv6 any any
access-list 4100 permit tcp any any eq 53
access-list 4100 permit udp any any eq 53
access-list 4101 permit tcp any ::1/128
access-list 4101 permit udp any ::1/128
!
ip route 0.0.0.0 0.0.0.0 tunnel 1
ip name-server ::1
!
ip dhcp server-profile DHCPv4_server
 address 192.168.100.2 192.168.100.254
 lease-time 259200
 dns 192.168.100.1
 gateway 192.168.100.1
exit
!
ip nat list 1 192.168.100.0 0.0.0.255
ip nat wellknown 1 1 65535 off
ip nat port-sharing enable
!
ipv6 dhcp client-profile DHCPv6_client
 option-request dns-server
 option-request dns-server-domain
 retries infinity
exit
!
ipv6 dhcp server-profile DHCPv6_server
 dns port-channel 2
 domain port-channel 2
exit
!
ipinip tunnel-profile MAPCE
 profile-mode map-encap option-b
 map rule-get
 ipinip fragment pre
exit
!
logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username st privilege 15 password 2 $1$yg27Q4xa$FzRzJaCNDLIPbh86A/Q9z/
!
hostname FITELnet
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 policy-route input DNS-POLICY
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 channel-group 2
 ipv6 access-group 4000 in
 ipv6 access-group 4009 in
 ipv6 access-group 4010 out
 ipv6 access-group spi ftp-data enable
exit
!
interface Port-channel 1
 ip dhcp service server
 ip dhcp server-profile DHCPv4_server
 ip address 192.168.100.1 255.255.255.0
 ipv6 enable
 ipv6 address autoconfig
 ipv6 address autoconfig-map-encap MAPCE
 ipv6 nd other-config-flag
 ipv6 nd send-ra
 ipv6 trust-ra-prefix-lifetime
 ipv6 dhcp service server
 ipv6 dhcp server-profile DHCPv6_server
 link-state always-up
 mss 1420
exit
!
interface Port-channel 2
 ipv6 enable
 ipv6 nd receive-ra prefix-delegation port-channel 1
 ipv6 router-lifetime-receive-enable
 ipv6 trust-ra-prefix-lifetime
 ipv6 dhcp service client
 ipv6 dhcp client-profile DHCPv6_client
exit
!
interface Tunnel 1
 ip access-group 109 in
 ip access-group 110 out
 ip access-group spi ftp-data enable
 ip nat inside source list 1 map-encap overload
 tunnel mode ipinip tunnel-profile MAPCE
exit
!
line console
 exec-timeout 0
 authorization exec default local
exit
!
line telnet
 exec-timeout 0
exit
!
class-map DNS6
 match ipv6 access-group 4100
exit
!
class-map DNS6_LO
 match ipv6 access-group 4101
exit
!
policy-route-map DNS-POLICY
 !
 class DNS6
  search-sequence 10
  count
  action nexthop ##ネクストホップアドレス(IPv6)##
 exit
 !
 class DNS6_LO
  search-sequence 1
  count
  action transmit
 exit
 !
exit
!
local policy-route DNS-POLICY
!
dns-server ip enable
dns-server ipv6 enable
!
proxydns domain 1 any * any dhcp ipv6 port-channel 2
proxydns address 1 any dhcp ipv6 port-channel 2
!
end
</pre>

<pre>
access-list 4001 permit udp ##IPv6 VPNピアアドレス##/128 eq 500 any eq 500
access-list 4001 permit 50 ##IPv6 VPNピアアドレス##/128 any
!
no ip route 0.0.0.0 0.0.0.0 tunnel 1
ip route 0.0.0.0 0.0.0.0 tunnel 2
!
local-breakout enable
local-breakout proxy-server ip any port #LBO対象パケットの宛先ポート番号#
local-breakout LBO tunnel 1
local-breakout http-snooping source-interface port-channel ##LAN Port-channel番号##
!
lbo-profile LBO
 http-snooping enable with-route
 domain *sample.com
exit
!
crypto ipsec replay-check disable
!
crypto ipsec policy IPsec_POLICY
 set security-association always-up
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-sha512-hmac esp-aes
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 src 2 ipv6 any
 dst 1 ipv4 any
 dst 2 ipv6 any
exit
!
crypto isakmp keepalive always-send interval 35
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
crypto isakmp negotiation always-up-params interval 100 max-initiate 1 max-pending 1 delay 3
!
crypto isakmp policy ISAKMP_POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 15
 lifetime 86400
 hash sha-512
exit
!
crypto isakmp profile PROF
 match identity host IPsec.example.com
 local-address source-interface port-channel 1
 self-identity user-fqdn CPE@IPsec.example.com
 set isakmp-policy ISAKMP_POLICY
 set ipsec-policy IPsec_POLICY
 set peer ##IPv6 VPNピアアドレス##
 ike-version 2
 local-key key
exit
!
crypto map MAP ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF
exit
!
interface GigaEthernet 2/1
 ipv6 access-group 4001 in
exit
!
interface Port-channel ##LAN Port-channel番号##
 mss 1350
 http-snooping enable
exit
!
interface Tunnel 2
 tunnel mode ipsec map MAP
exit
</pre>

ページの先頭へ

動的IPサービス（MAP-E）でVPN/ローカルブレイクアウトを利用する対象装置：F70/F71/F220/F221/F220 EX/F221 EX

補足・注意点

構成と設定例

VPN/ローカルブレイクアウト