Setting Up an IPv4/IPv6 Dual-Stack Network in a VPC

Precautions

• The IPv4/IPv6 dual-stack function is free for now, but will be billed at a later date (price yet to be determined).
• The IPv6 function is now available for open beta test incertain regions. You can use the IPv6 function only after obtaining the OBT permission.
• Only certain ECS specifications support IPv6 networks. You need to select such ECSs in supported regions.
  On the ECS console, click Buy ECS. On the displayed page, check the ECS specifications. If Yes is shown in the IPv6 column, the ECS with this specification supports IPv6.

  Figure 2 ECS specifications
  
• The network planning in this example is for your reference only. Once a VPC and subnet are created, the CIDR blocks cannot be changed. Before creating VPCs, determine how many VPCs, the number of subnets, and what CIDR blocks or connectivity options you will need.

  For details, see VPC and Subnet Planning Suggestions.

Procedure

Preparations

Before creating resources such as VPCs and ECSs, you need to sign up for a HUAWEI ID, enable Huawei Cloud services, complete real-name authentication, and top up your account. Ensure that your account has sufficient balance.

1. You have created a HUAWEI ID, enabled Huawei Cloud services, and completed real-name authentication.
   If you already have a HUAWEI ID, skip this part. If you do not have a HUAWEI ID, perform the following operations to create one:

   1. Sign up for a HUAWEI ID and enable Huawei Cloud services.
   2. Complete real-name authentication.
2. You need to ensure that your account has sufficient balance. Top up your account if your account has insufficient balance.

Step 1: Create a VPC and Subnet

1. Go to the Create VPC page.
2. On the Create VPC page, set parameters as needed.

   In this example, you need to create a VPC and subnet, and enable IPv6 for this subnet.

   Figure 3 Creating a VPC
   
   Figure 4 Setting a subnet
   

   Table 1 VPC parameter descriptions

   Parameter	Example Value	Description
   Region	CN-Hong Kong	The region where the VPC is created. Select the region nearest to you to ensure the lowest possible latency. The VPC, ECS, and EIP used in this example must be in the same region. The region cannot be changed after the VPC is created.
   Name	vpc-A	The VPC name. Set it to vpc-A. The name can be modified after vpc-A is created.
   IPv4 CIDR Block	192.168.0.0/16	The IPv4 CIDR block of vpc-A. You are advised to select from the following CIDR blocks: 10.0.0.0/8-24: The IP address ranges from 10.0.0.0 to 10.255.255.255, and the netmask ranges from 8 to 24. 172.16.0.0/12-24: The IP address ranges from 172.16.0.0 to 172.31.255.255, and the netmask ranges from 12 to 24. 192.168.0.0/16-24: The IP address ranges from 192.168.0.0 to 192.168.255.255, and the netmask ranges from 16 to 24. The IPv4 CIDR block cannot be changed after the vpc-A is created.
   Enterprise Project	default	The enterprise project by which VPCs are centrally managed. Select an existing enterprise project for vpc-A. The enterprise project cannot be changed after the vpc-A is created.
   Advanced Settings (Optional) > Tag	Tag key: test Tag value: 01	The tag that is used to classify and identify resources. Add tags to vpc-A as required. After vpc-A is created, you can add additional tags to vpc-A or delete existing tags from it.
   Advanced Settings (Optional) > Description	-	Supplementary information about vpc-A. Enter the description as required. The description can be modified after vpc-A is created.

   Table 2 Subnet parameter descriptions

   Parameter	Example Value	Description
   AZ	AZ4	An AZ is a geographic location with independent power supply and network facilities in a region. Each region contains multiple AZs. AZs are physically isolated but connected through an internal network. Subnets of a VPC can be located in different AZs without affecting communications. You can select any AZ in a region. The ECS and VPC can be in different AZs. For example, you can select AZ1 for the ECS and AZ3 for the VPC subnet. The AZ cannot be changed after the VPC is created. You can select an AZ for a subnet only in certain regions. See the available regions on the management console.
   Subnet Name	subnet-A01	The subnet name. Set it to subnet-A01. The name can be modified after subnet-A01 is created.
   IPv4 CIDR Block	192.168.0.0/24	The IPv4 CIDR block of subnet-A01, which is a unique CIDR block with a range of IP addresses in vpc-A. The CIDR block cannot be changed after subnet-A01 is created.
   IPv6 CIDR Block (Optional)	Enabled	Whether to assign IPv6 addresses. After this option is enabled, IPv6 addresses can be assigned to subnet-A01 the ECS. You can enable or disable this option after subnet-A01 is created.
   Associated Route Table	Default	The default route table that subnet-A01 is associated with. Each VPC comes with a default route table. Subnets in the VPC are then automatically associated with the default route table. The default route table has a preset system route that allows subnets in a VPC to communicate with each other. After subnet-A01 is created, you can create a custom route table and associate subnet-A01 with it.
   Advanced Settings (Optional) > Gateway	192.168.0.1	The gateway address of subnet-A01. You are advised to retain the default address. The gateway address cannot be changed after subnet-A01 is created.
   Advanced Settings (Optional) DNS Server Address Domain Name NTP Server Address IPv4 DHCP Lease Time	Not required	The parameters are configured for the ecs-A01 in vpc-A. In this example, retain the default values or leave them empty. You can change the values after subnet-A01 is created.
   Advanced Settings (Optional) > Tag	Tag key: test Tag value: 01	The tag that is used to classify and identify resources. Add tags to subnet-A01 as required. After subnet-A01 is created, you can add additional tags to subnet-A01 or delete existing tags from it.
   Advanced Settings (Optional) > Description	-	Supplementary information about subnet-A01. Enter the description as required. The description can be modified after subnet-A01 is created.

3. Click Create Now.

   Return to the VPC list to view vpc-A you have created.

Step 2: Buy an ECS

1. Go to the Buy ECS page.
2. On the Buy ECS page, set parameters as required.
   In this example, set the ECS name to ecs-A01 and configure other parameters as follows:

   • Network: Select vpc-A and subnet-A01 you have created.
     Select Automatically assign address. An IPv4 address and an IPv6 address will be assigned to ecs-A01.

     Figure 5 Network settings
     
   • Security Group: Create security group sg-A and add inbound and outbound rules to it. Each security group comes with system rules. You need to check and modify the rules as required to ensure that all rules in Table 3 are added.
     Figure 6 Inbound rules of sg-A
     
     Figure 7 Outbound rules of sg-A
     

     Table 3 sg-A rules

     Direction	Action	Type	Protocol & Port	Source/Destination	Description
     Inbound	Allow	IPv4	TCP: 22	Source: 10.1.0.7/32	Allows the local PC (10.1.0.7/32) to remotely log in to Linux ecs-A01 over SSH port 22.
     Inbound	Allow	IPv6	TCP: 22	Source: 2002:20::44/128	Allows the local PC (2002:20::44/128) to remotely log in to Linux ecs-A01 over SSH port 22.
     Inbound	Allow	IPv4	TCP: 3389	Source: 10.1.0.7/32	Allows the local PC (10.1.0.7/32) to remotely log in to Windows ecs-A01 over RDP port 3389.
     Inbound	Allow	IPv6	TCP: 3389	Source: 2002:20::44/128	Allows the local PC (2002:20::44/128) to remotely log in to Windows ecs-A01 over RDP port 3389.
     Inbound	Allow	IPv4	ICMP: All	Source: 0.0.0.0/0	Allows IPv4 ping traffic to ecs-A01 in vpc-A over all ICMP ports to verify network connectivity.
     Inbound	Allow	IPv6	ICMPV6: All	Source: ::/0	Allows IPv6 ping traffic to ecs-A01 in vpc-A over all ICMP ports to verify network connectivity.
     Inbound	Allow	IPv4	All	Source: current security group (sg-A)	Allows the ECSs in sg-A to communicate with each other using IPv4 addresses.
     Inbound	Allow	IPv6	All	Source: current security group (sg-A)	Allows the ECSs in Sg-A to communicate with each other using IPv6 addresses.
     Outbound	Allow	IPv4	All	Destination: 0.0.0.0/0	Allows ecs-A01 in sg-A to access the Internet using the IPv4 address.
     Outbound	Allow	IPv4	All	Destination: ::/0	Allows ecs-A01 in sg-A to access the Internet using the IPv6 address.

   • EIP: Select Not required.
     Figure 8 Selecting Not required
     

   You can configure other ECS parameters as required. For details, see Buying an ECS.

3. Click Submit.

   Return to the ECS list to view ecs-A01 you have bought.

4. Log in to ecs-A01 and check whether the ECS has obtained an IPv6 address.
   • By default, dynamic IPv6 address assignment is enabled for Windows public images.
   • Before enabling dynamic IPv6 address assignment for a Linux public image, check whether IPv6 is supported first.

     Currently, all Linux public images support IPv6. By default, dynamic IPv6 address assignment is enabled for Ubuntu 16. For other Linux public images, you need to enable this function.

   If an IPv6 address fails to be automatically assigned or the selected image cannot obtain an IPv6 address automatically, manually obtain the IPv6 address . Otherwise, ECSs cannot communicate with each other using IPv6 addresses.

Step 3: Buy an EIP and Bind It to ecs-A01

Buy an EIP and bind it to ecs-A01 so that it can communicate with the Internet using an IPv4 address.

1. Go to the Buy EIP page.
2. On the Buy EIP page, set the EIP name to eip-A.

   You can configure other EIP parameters as required. For details, see Buying an EIP.

3. Click Next.

   Return to the EIP list to view eip-A you have bought.

4. In the EIP list, locate eip-A and click Bind in the Operation column.

   The Bind EIP dialog box is displayed.

   Figure 9 Binding eip-A to ecs-A01
   
5. In the displayed dialog box, select ecs-A01 and click OK.

   Return to the EIP list. You can see that ecs-A01 is displayed in the Associated Instance column in the EIP list.

   Figure 10 eip-A bound to ecs-A01
   

Step 4: Buy a Shared Bandwidth and Add the ECS IPv6 Address to It

Buy a shared bandwidth and add the IPv6 address to the shared bandwidth so that ecs-A01 can communicate with Internet.

1. Go to the Buy Shared Bandwidth page.
2. On the displayed page, set the shared bandwidth name to bandwidth-A and configure other parameters as required.

   For details, see Assigning a Shared Bandwidth.

3. Click Next.

   Return to the shared bandwidth list to view bandwidth-A you have assigned.

4. Click Add Public IP Address in the Operation column.

   The Add Public IP Address dialog box is displayed.

   Figure 11 Adding the IPv6 address to bandwidth-A
   
5. Configure the parameters and click OK.
   • Public IP Address: Select IPv6 Address.
   • VPC: Select vpc-A.
   • Subnet: Select subnet-A01.
   • IPv6 Address: Select the IPv6 address assigned to ecs-A01.

Step 5: Verify Network Connectivity

1. Use the local PC to log in to ecs-A01 using the IPv4 EIP and IPv6 address.

   Multiple methods are available for logging in to an ECS. For details, see Logging In to an ECS.

   To remotely log in to ecs-A01 using PuTTY:

   • Enter the EIP of ecs-A01 under Host Name (or IP address), for example, 1.95.44.XX.
   • Enter the IPv6 address of ecs-A01 under Host Name (or IP address), for example, 2407:XXX:e857.
   Figure 12 PuTTY configurations
   
2. Verify whether ecs-A01 can communicate with the Internet over IPv4 and IPv6 networks.
   • Run the following command to verify IPv4 public network connectivity:

     ping IPv4 EIP or Domain name

     Example command:

     ping support.huaweicloud.com

     If information similar to the following is displayed, ecs-A01 can communicate with the Internet over the IPv4 network.

     [root@ecs-a01 ~]# ping support.huaweicloud.com
     PING hcdnw.cbg-notzj.c.cdnhwc2.com (203.193.226.103) 56(84) bytes of data.
     64 bytes from 203.193.226.103 (203.193.226.103): icmp_seq=1 ttl=51 time=2.17 ms
     64 bytes from 203.193.226.103 (203.193.226.103): icmp_seq=2 ttl=51 time=2.13 ms
     64 bytes from 203.193.226.103 (203.193.226.103): icmp_seq=3 ttl=51 time=2.10 ms
     64 bytes from 203.193.226.103 (203.193.226.103): icmp_seq=4 ttl=51 time=2.09 ms
     ...
     --- hcdnw.cbg-notzj.c.cdnhwc2.com ping statistics ---
     4 packets transmitted, 4 received, 0% packet loss, time 3004ms
     rtt min/avg/max/mdev = 2.092/2.119/2.165/0.063 ms

   • Run the following command to verify IPv6 public network connectivity:

     ping6 IPv6 public address

     In this example, 2002:20::45 is used as a public IP address. An example command is as follows:

     ping6 2002:20::45

     If information similar to the following is displayed, ecs-A01 can communicate with the Internet over the IPv6 network.

     [root@ecs-a01 ~]# ping6 2002:20::45
     PING 2002:20::45(2002:20::45) from 2002:20::45 : 56 data bytes
     64 bytes from 2002:20::45: icmp_seq=1 ttl=64 time=0.770 ms
     64 bytes from 2002:20::45: icmp_seq=2 ttl=64 time=0.295 ms
     64 bytes from 2002:20::45: icmp_seq=3 ttl=64 time=0.245 ms
     ^C
     --- 2002:20::45 ping statistics ---
     3 packets transmitted, 3 received, 0% packet loss, time 2080ms
     rtt min/avg/max/mdev = 0.245/0.436/0.770/0.237 ms