IBM Cloud: VPCのVSIにRFC1918（プライベートIP）以外のIPアドレス(RFC6598)を割り振って疎通確認してみた

#1. はじめに
RFC1918(10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)のレンジ衝突を避けるために、どうしてもCGNアドレス（100.64.0.0/10: RFC6598）を使いたいという場合がある。
[IBM Cloud docs](https://cloud.ibm.com/docs/vpc?topic=vpc-interconnectivity#routing-considerations-iana&locale=en)にはRFC1918以外のIPアドレスをVPC内・外に定義している以下の構成図が記載されている。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/ede63e6d-75d8-a115-8c3d-88e5097d652e.png)

本検証では、オンプレミス側までRFC6598のアドレスを割り振る構成を作るのは大変なので、VPC上のVSIにのみRFC6598のIPアドレスを割り振り、オンプレミス側（実際はDirect Link経由でアクセス可能なPower Systems Virtual Server上のAIX)はRFC1918に従うという前提で問題なく疎通できるかを検証してみた。。

#2. 環境の構築
##2-1. VPCにRFC6598範囲内のAddress prefixを作成する
今回は、`100.64.0.0/10`をTokyo1 Zoneに丸ごと割り当ててみた。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/72a281ec-e0d2-96d5-08bf-99421400989f.png)

##2-2. Subnetの作成
上記で作成したAddress prefixから100.64.0.0/24をSubnetとして定義する。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/f9cff608-3b02-7822-c412-8c0a1c3fd43d.png)

##2-3. VSIの作成

上記で作成したSubnetを指定してVSIを作成する。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/fab66a98-4625-aac7-aa9f-11e5bc2172d5.png)
無事、`100.64.0.4`というIPアドレスが割り当てられてプロビジョニングされた。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/58828123-86a8-2034-3b83-416f95cd4579.png)

#3. 疎通テスト

##3-1. Floating IPが割り当てられているTokyo1 Zone上のサーバーにpublic NW経由でログインして、RFC6598のIPを持つVSIにping試行 -> 成功

```
# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 02:00:01:02:70:58 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.4/24 brd 10.0.0.255 scope global dynamic eth0
       valid_lft 263sec preferred_lft 263sec
    inet6 fe80::1ff:fe02:7058/64 scope link
       valid_lft forever preferred_lft forever

# ping -c 3 100.64.0.4
PING 100.64.0.4 (100.64.0.4) 56(84) bytes of data.
64 bytes from 100.64.0.4: icmp_seq=1 ttl=64 time=0.326 ms
64 bytes from 100.64.0.4: icmp_seq=2 ttl=64 time=0.408 ms
64 bytes from 100.64.0.4: icmp_seq=3 ttl=64 time=0.346 ms

--- 100.64.0.4 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 0.326/0.360/0.408/0.034 ms

# ssh 100.64.0.4
[root@rfc6598-test1 ~]#
```

##3-2. Tokyo2 Zone上のVSIにログインして、RFC6598のIPを持つVSIにping試行 -> 成功

なお、このTokyo2 Zone上のVSIが利用するsubnetがpublic gatewayに関連づけられていても、無事にpingはできた。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/7f8c79eb-a3d5-9d31-d86c-19a769fbdf7d.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/72d2e272-8af9-9632-d08f-092cfcb14850.png)


```
# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 02:00:48:02:71:37 brd ff:ff:ff:ff:ff:ff
    inet 10.1.0.7/24 brd 10.1.0.255 scope global dynamic eth0
       valid_lft 226sec preferred_lft 226sec
    inet6 fe80::48ff:fe02:7137/64 scope link
       valid_lft forever preferred_lft forever


# ping -c 3 100.64.0.4
PING 100.64.0.4 (100.64.0.4) 56(84) bytes of data.
64 bytes from 100.64.0.4: icmp_seq=1 ttl=57 time=1.51 ms
64 bytes from 100.64.0.4: icmp_seq=2 ttl=57 time=1.62 ms
64 bytes from 100.64.0.4: icmp_seq=3 ttl=57 time=1.64 ms

--- 100.64.0.4 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 1.515/1.595/1.644/0.065 ms

# ssh 100.64.0.4
[root@rfc6598-test1 ~]#
```

##3-3. （オンプレミス相当の）Power Systems Virtual Server上のAIXからDirect Link経由でRFC6598のIPを持つVSIにping試行 -> 成功

今回は、Power Systems Virtual Serverからアクセスしてみた。
100.64.0.0/10へのstatic routeを構成した上でテストした。

```
bash-4.3# netstat -nr |grep -e Destination -e 100.64
Destination        Gateway           Flags   Refs     Use  If   Exp  Groups
100.64/10          192.168.50.1      UGS       0        11 en1      -      -

bash-4.3# ping -c 3 100.64.0.4
PING 100.64.0.4 (100.64.0.4): 56 data bytes
64 bytes from 100.64.0.4: icmp_seq=0 ttl=54 time=1 ms
64 bytes from 100.64.0.4: icmp_seq=1 ttl=54 time=1 ms
64 bytes from 100.64.0.4: icmp_seq=2 ttl=54 time=1 ms

--- 100.64.0.4 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 1/1/1 ms

bash-4.3# ssh 100.64.0.4
[root@rfc6598-test1 ~]#
```

##3-4 RFC6598のIPを持つVSIからICOSへのping試行 -> 成功

```txt:Regional-Endpointsへのping
[root@rfc6598-test1 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 02:00:01:1b:a7:cb brd ff:ff:ff:ff:ff:ff
    inet 100.64.0.4/24 brd 100.64.0.255 scope global noprefixroute dynamic eth0
       valid_lft 286sec preferred_lft 286sec
[root@rfc6598-test1 ~]# ping -c 3 s3.direct.jp-tok.cloud-object-storage.appdomain.cloud
PING s3.direct.jp-tok.cloud-object-storage.appdomain.cloud (161.26.0.22) 56(84) bytes of data.
64 bytes from 16.00.1aa1.ip4.static.sl-reverse.com (161.26.0.22): icmp_seq=1 ttl=249 time=1.13 ms
64 bytes from 16.00.1aa1.ip4.static.sl-reverse.com (161.26.0.22): icmp_seq=2 ttl=249 time=1.11 ms
64 bytes from 16.00.1aa1.ip4.static.sl-reverse.com (161.26.0.22): icmp_seq=3 ttl=249 time=1.11 ms

--- s3.direct.jp-tok.cloud-object-storage.appdomain.cloud ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 1.117/1.122/1.132/0.028 ms
```

```txt:Cross-region-Endpointsへのping
[root@rfc6598-test1 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 02:00:01:1b:a7:cb brd ff:ff:ff:ff:ff:ff
    inet 100.64.0.4/24 brd 100.64.0.255 scope global noprefixroute dynamic eth0
       valid_lft 286sec preferred_lft 286sec
[root@rfc6598-test1 ~]# ping -c 3  s3.direct.tok.ap.cloud-object-storage.appdomain.cloud
PING s3.direct.tok.ap.cloud-object-storage.appdomain.cloud (161.26.85.10) 56(84) bytes of data.
64 bytes from a.55.1aa1.ip4.static.sl-reverse.com (161.26.85.10): icmp_seq=1 ttl=253 time=0.288 ms
64 bytes from a.55.1aa1.ip4.static.sl-reverse.com (161.26.85.10): icmp_seq=2 ttl=253 time=0.339 ms
64 bytes from a.55.1aa1.ip4.static.sl-reverse.com (161.26.85.10): icmp_seq=3 ttl=253 time=0.431 ms

--- s3.direct.tok.ap.cloud-object-storage.appdomain.cloud ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2001ms
rtt min/avg/max/mdev = 0.288/0.352/0.431/0.063 ms
```