NAT64 Stateful
Last updated
Last updated
Load nat64.lab1.init.cfg
R1 is an internet subscriber and XR1 is an internet server. Configure NAT64 on R6 so that R1 (IPv6-only) can reach XR1 which is IPv4-only (192.0.2.1).
Use 100.1.1.1 as the translated IPv4 address on R6
Only allow traffic sourced from 2001::/64 to be translated for NAT64
Use the prefix 64:ff96::/96 for NAT64
NAT64 is an IPv6 transition mechanism which allows an IPv6-only host to communicate with IPv4-only hosts. This allows an IPv6-only client to reach the IPv4 internet.
A well-known prefix of 64:ff9b::/96 has been allocated for NAT64. (In this lab we are asked to use 64:ff96::/96, which was an oversight initially by me, but tests your understanding of using a non-default prefix). The IPv4 address is mapped to this prefix to give the IPv6-only client a IPv6 address to use for the IPv4 host. The NAT64 device maps this IP to IPv4, and then source NATs the IPv6 client to a IPv4 address. With stateful NAT, we use a PAT (overload) to conserve IPv4 address space.
To begin, we enable nat64 on all interfaces that will participate in NAT64. This command goes on the IPv6 interfaces which will receive traffic destined to 64:ff96::/96, as well as the outgoing/incoming IPv4 interface.
Next we configure the NAT rules. This is quite similar to NAT44. We use an ACL to define which sources will match the NAT rule, define the NAT64 stateful prefix, define the NAT64 IPv4 NAT pool, and then define the NAT rule. Note that the IPv4 addresses used in the pool cannot exist on the router itself.
R6 will automatically create a NAT virtual interface (NVI). Static routes for the V4 pool (100.1.1.1/32) and the NAT64 prefix are automatically added as well, and point to the NVI:
We can now redistribute static into OSPFv3 in order to advertise 64:ff96::/96 into the IGP. This attracts the NAT64 traffic to R6.
Normally a DNS64 server would be used to resolve A records to AAAA-synthesized records. But in this lab we can manually map 192.0.2.1 to the NAT64 destination address as follows:
Since we are allowing all traffic that is sourced from 2001::/64, we can also ping from another host, for example R2:
We can see the stateful NAT entries on R6:
