该实验要求如下：

配置GRE
实现总部和分部客户端PC之间私有IPv4地址和IPv6相互通信
隧道IPv4地址：10.1.12.0/24
隧道IPv6地址：2001:12::/64
NAT
实现所有的PC通过NAT转换访问client1，使用Easy-ip技术实现
NAT Server
FTP公网IP地址为110.1.1.100，client1通过此公网IP访问FTP服务
路由
全网使用静态路由来实现通信

该实验拓扑图如下

1、配置底层IP地址信息

FW1的配置

interface GigabitEthernet0/0/0
 ip binding vpn-instance default
 ip address 192.168.0.1 255.255.255.0
 alias GE0/METH
interface GigabitEthernet1/0/0
 ipv6 enable
 ip address 10.1.1.254 255.255.255.0
 ipv6 address 100::2/64
interface GigabitEthernet1/0/1
ip address 10.1.3.254 255.255.255.0
interface GigabitEthernet1/0/2
 ip address 110.1.1.1 255.255.255.0
#

ISP的配置

vlan batch 69 110 202
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 110
interface GigabitEthernet0/0/2
 port link-type access
 port default vlan 202
interface GigabitEthernet0/0/3
 port link-type access
 port default vlan 69
interface Vlanif69
 ip address 69.1.1.2 255.255.255.0
interface Vlanif110
 ip address 110.1.1.2 255.255.255.0
interface Vlanif202
 ip address 202.1.1.2 255.255.255.0

FW2的地址配置

interface GigabitEthernet1/0/0
 ipv6 enable
 ip address 10.1.2.254 255.255.255.0
 ipv6 address 200::2/64
interface GigabitEthernet1/0/2
 undo shutdown
 ip address 202.1.1.1 255.255.255.0

2、在FW1和FW2上创建firewall zong区域

FW1

firewall zone trust
 add interface GigabitEthernet1/0/0
firewall zone untrust
 add interface GigabitEthernet1/0/2
firewall zone dmz
 add interface GigabitEthernet1/0/1

FW2的配置

firewall zone trust
 add interface GigabitEthernet1/0/0
firewall zone untrust
 add interface GigabitEthernet1/0/2

3、配置GRE和tunnel隧道

静态路由配置—提供FW1与FW2之间可达
FW1

ip route-static 202.1.1.0 24 110.1.1.2

FW2

ip route-static 110.1.1.0 24 202.1.1.2

FW1

interface Tunnel1
 ipv6 enable
 ip address 10.1.12.1 255.255.255.0
 ipv6 address 2001:12::1/64
 tunnel-protocol gre
 source 110.1.1.1
 destination 202.1.1.1
#
firewall zone untrust
 add interface Tunnel1

FW2

interface Tunnel1
 ipv6 enable
 ip address 10.1.12.2 255.255.255.0
 ipv6 address 2001:12::2/64
 tunnel-protocol gre
 source 202.1.1.1
 destination 110.1.1.1
#
firewall zone untrust
 add interface Tunnel1

4、配置安全策略—GRE协议策略

FW1/FW2

security-policy
 rule name gre
  source-zone local
  source-zone untrust
  destination-zone local
  destination-zone untrust
  service gre
  action permit

静态路由配置—提供到达对方内部网段路由走TUNNEL接口
FW1

ip route-static 10.1.2.0 24 Tunnel1
ipv6 route-static 200:: 64 Tunnel1

FW2

ip route-static 10.1.1.0 24.0 Tunnel1
ipv6 route-static 100:: 64 Tunnel1

5、配置安全策略—能够放行V4和V6流量

FW1/FW2

security-policy
 rule name data_v4	#放行IPV4的流量
  source-zone trust
  source-zone untrust
  destination-zone trust
  destination-zone untrust
  source-address 10.1.1.1 32
  source-address 10.1.2.1 32
  destination-address 10.1.1.1 32
  destination-address 10.1.2.1 32
  service icmp
  action permit
 rule name data_v6	#放行IPV6的流量
  source-zone trust
  source-zone untrust
  destination-zone trust
  destination-zone untrust
  source-address 100::1 128
  source-address 200::1 128
  destination-address 100::1 128
  destination-address 200::1 128
  service icmpv6
  action permit

6、配置NAT

静态路由—FW和client之间的可达
FW1

ip route-static 69.1.1.0 24 110.1.1.2

FW2

ip route-static 69.1.1.0 24 202.1.1.2

FW1

nat-policy
 rule name easy_ip
  source-zone trust
  destination-zone untrust
  source-address 10.1.1.1 32
  action source-nat easy-ip
#
security-policy
 rule name pc1_c1
  source-zone trust
  destination-zone untrust
  source-address 10.1.1.1 32
  destination-address 69.1.1.1 32
  service icmp
  action permit

FW2

nat-policy
 rule name easy_ip
  source-zone trust
  destination-zone untrust
  source-address 10.1.2.1 32
  action source-nat easy-ip
#
security-policy
 rule name pc1_c1
  source-zone trust
  destination-zone untrust
  source-address 10.1.2.1 32
  destination-address 69.1.1.1 32
  service icmp
  action permit

7.NAT server

NAT Server
FTP公网IP地址为110.1.1.100，client1通过此公网IP访问FTP服务
FW1

 nat server FTP protocol tcp global 110.1.1.100 ftp inside 10.1.3.1 ftp

FW1

security-policy
 rule name c1_ftp
  source-zone untrust
  destination-zone dmz
  source-address 69.1.1.1 mask 255.255.255.255
  destination-address 10.1.3.1 mask 255.255.255.255
  service ftp
  action permit

8、进行测试
PC1ping通PC2的IPV4/IPV6地址

PC1ping通client1

在client1上通过110.1.1.100访问FTP服务器

测试成功，实验完成