Apr
18

IPv6 NAT-PT is to be used with IPv4 to IPv6 migration scenarios and it’s purpose is to provide bi-directional connectivity between IPv4 and IPv6 domains. Cisco points out that many other transition techniques are possible, and NAT-PT (Network Address Translation – Protocol Translation) should not be used when other, more “native” options exist, such as having dual stack hosts communicate directly through dual stack routers. Another example provided of when NAT-PT is not needed is when two islands of IPv6 want to communicate over an IPv4-only backbone. We know that many different tunnels exist for this purpose. For more information about these tunnel techniques, see the Transition Technique series in this blog category.

For the job of NAT-PT, a dual-stack router with interfaces in both IPv4 and IPv6 networks is capable of performing this task. The difference from classic IPv4 NAT is that translations should be done both ways: IPv6 packets routed towards IPv4 hosts should have their src/dst addresses changed to some IPv4 equivalents and vice versa, while IPv4 packets sent toward IPv6 hosts should get both src and dst addresses replaced with IPv6 addresses.

The first question that arises when exploring NAT-PT is: how in the world does the IPv6 domain learn about IPv4 hosts? And for that matter, how does the IPv4 domain know about the existence of the IPv6 domain?

Well, the first idea that comes to mind to resolve this is it to provide static, bi-directional mappings. For example, we can manually program the router to rewrite destination addresses in IPv6 packets sent to an IPv6 address, for example 2000::960B:0202. Note that in this sample address 960B:0202 is 150.11.2.2 in dotted decimal. What about the source address? To translate the source address (e.g. 3001:11:0:1::1) we set up another mapping that tells the router to rewrite IPv4 packets (opposite direction) sent to 150.11.1.1 to 3001:11:0:1::1. Since the mapping is bi-directional, IPv6 packets with the src/dst address pair [3001:11:0:1::1, 2000::960B:0202] would get rewritten to IPv4 packets with the address pair [150.11.1.1, 150.11.2.2] and vice versa – an IPv4 packet src/dst [150.11.2.2, 150.11.1.1] would be rewritten to [2000::960B:0202, 3001:11:0:1::1].

Let us examine what this would look like in the IOS configuration. First, note that the IPv6 stack classifies packets for NAT-PT via a special IPv6 NAT prefix. This prefix represents the whole IPv4 address space (2^32) embedded within an IPv6 super-space. This prefix always has a length of 96 bits (128-32=96). Every IPv6 packet sent to this prefix is inspected by the NAT-PT engine.

IPv6 NAT-PT

Next, using the configuration depicted in the diagram, we aim to provide connectivity between the IPv6 Loopback100 of R1 and the IPv4 Loopback0 of R2. In the most simple case of static IPv6 to IPv4 mappings, the configuration would be:

R3:
!
! Enable NAT-PT on the interfaces
!
interface FastEthernet 0/0
 ipv6 nat
!
interface FastEthernet 0/1
 ipv6 nat

!
! Static translation for R1 Loopback0
!
ipv6 nat v6v4 source 3001:11:0:1::1 150.11.3.1

!
! Static translation for R2 Loopback0 
!
ipv6 nat v4v6 source static 150.11.2.2 2000::960b:0202

!
! IPv6 NAT prefix, needed to enable NAT-PT classification
!
ipv6 nat prefix 2000::/96

The great news is more flexible solutions are available for other deployment models. Suppose we want to provide access to an IPv4 server for a large group of IPv6 hosts. We may set up access to the IPv4 server using a static IPv4 to IPv6 mapping, and translate the IPv6 hosts’ source addresses into an IPv4 address pool. This way, only the IPv6 hosts will be able to initiate sessions to the IPv4 server, using dynamically allocated IPv4 addresses, but not vice-versa – the IPv6 hosts will not have any persistent mappings to the IPv4 address space.

R3:
!
! Enable NAT-PT on the interfaces
!
interface FastEthernet 0/0
 ipv6 nat
!
interface FastEthernet 0/1
 ipv6 nat

!
! Dynamic NAT for IPv6 to IPv4 traffic (the hosts) 
!
ipv6 nat v6v4 source list NAT_TRAFFIC pool IPV6_TO_IPV4

!
! Static translation for R2 Loopback0 (the server)
!
ipv6 nat v4v6 source static 150.11.2.2 2000::960b:0202

!
! Dynamic NAT IPv4 pool
!
ipv6 nat v6v4 pool IPV6_TO_IPV4 150.11.3.128 150.11.3.254 prefix-length 24

!
! IPv6 NAT prefix
!
ipv6 nat prefix 2000::/96 

!
! The traffic eligible for NAT-PT
!
ipv6 access-list NAT_TRAFFIC
   permit ipv6 any 2000::/96

All right. But what if we want to allow the IPv6 domain to access ANY arbitrary IPv4 host? We will need some automated translation logic to do that. We need to map every host under the IPv4 address space to a host under our IPv6 NAT prefix, since we can’t provide manual mapping to each and every IPv4 host. The most obvious way to achieve this is to take the last 32 bits of the IPv6 destination address and use them as the corresponding IPv4 address. For example, the IPv6 address 2000::960b:0202 corresponds to 150.11.2.2 under this interpretation (960b:0202 = 150.11.2.2). Using this approach, we fully utilize the IPv6 /96 NAT prefix address space. However, we need to make sure all IPv6 hosts are aware of that logic using some mechanism external to IPv6. Here is a configuration example:

R3:
!
! Enable NAT-PT on the interfaces
!
interface FastEthernet 0/0
 ipv6 nat
!
interface FastEthernet 0/1
 ipv6 nat

!
! Dynamic NAT for IPv6 to IPv4 traffic
!
ipv6 nat v6v4 source list NAT_TRAFFIC pool IPV6_TO_IPV4

!
! Dynamic NAT IPv4 pool
!
ipv6 nat v6v4 pool IPV6_TO_IPV4 150.11.3.128 150.11.3.254 prefix-length 24

!
! IPv6 NAT prefix with v4-mapped flag
! the access-list specifies IPv6 traffic eligible to
! access the IPv4 mapped addresses
!
ipv6 nat prefix 2000::/96 v4-mapped NAT_TRAFFIC
!
ipv6 access-list NAT_TRAFFIC
   permit ipv6 any 2000::/96

Verification

Rack11R1#ping 2000::960B:202 source loopback 100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2000::960B:202, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/8/8 ms
Rack11R1#

Rack11R3#debug ipv6 nat detailed
IPv6           more_flags = 0
IPv6 NAT: icmp src (3001:11:0:1::1) -> (150.11.3.128), dst (2000::960B:202) -> (150.11.2.2)
IPv6 NAT: ipv6nat_find_entry_v4tov6:
	 ref_count = 1,
                                usecount = 0, flags = 2, rt_flags = 0,
                                more_flags = 0

Note that a proper NAT-PT implementation requires a number of specific ALG (application level gateways) to be used along with NAT. The purpose of ALGs is to resolve application-level issues that arise from the IP address change (e.g. fix up FTP PORT command, etc). Currently, the Cisco IOS supports only a limited number of ALGs, compared to an IPv4 NAT implementation.

To summarize:

- IPv6 NAT-PT translates addresses both ways
- IPv6 NAT-PT requires an IPv6 NAT /96 prefix
- IPv6 NAT-PT could be configured using static bi-directional entries
- IPv6 NAT-PT dynamic translations use IPv4 address pool to map many IPv6 addresses to a small group of IPv4 addresses
- IPv6 NAT-PT allows IPv4 address mapping inside IPv6 NAT prefix

About Petr Lapukhov, 4xCCIE/CCDE:

Petr Lapukhov's career in IT begain in 1988 with a focus on computer programming, and progressed into networking with his first exposure to Novell NetWare in 1991. Initially involved with Kazan State University's campus network support and UNIX system administration, he went through the path of becoming a networking consultant, taking part in many network deployment projects. Petr currently has over 12 years of experience working in the Cisco networking field, and is the only person in the world to have obtained four CCIEs in under two years, passing each on his first attempt. Petr is an exceptional case in that he has been working with all of the technologies covered in his four CCIE tracks (R&S, Security, SP, and Voice) on a daily basis for many years. When not actively teaching classes, developing self-paced products, studying for the CCDE Practical & the CCIE Storage Lab Exam, and completing his PhD in Applied Mathematics.

Find all posts by Petr Lapukhov, 4xCCIE/CCDE | Visit Website


You can leave a response, or trackback from your own site.

21 Responses to “Understanding IPv6 NAT-PT”

 
  1. Atif says:

    Thanks! Nice article!

  2. Ian Perrett says:

    Hello,

    Thanks for this, I was wondering however if there is any way to do simple IPv6 to IPv6 NAT or PAT?

    Currently a lot of businesses use private addressing for the security aspect of it, so the internet cannot directly access their devices – is there any way to do this in IPv6 or do you require the use of firewalls / ACL’s?

    Thanks

  3. to: Ian Perrett

    Well they invented IPv6 just so that you won’t need to do any NAT ;)

    Actually, even NAT-PT is considered as a historic transition mechanism, because of it’s poor scalability and application layer issues.

    If you want access restrictions use IPv6 firewalls, and if you use site-local IPv6 addressing either deploy a global IPv6 addressing or use application level proxies..

    Remember, NAT is a hack, and you’d better avoid it at any cost :)

  4. Patrick NDA, CCNP says:

    to : Petr Lapukhov

    Within your example you used, your IPV6 access-list macthed the IPV6 nat prefix in stead of matching the source address of incoming packets. Is this correct or just a mistyped command ?

    Regards

  5. To: Patrick NDA, CCNP

    If you look at the list closely, you would see that the source is actually “any” and 2000::/96 (the NAT prefix) is the destinaiton. Therefore the access-list matches any IPv6 traffic destined to IPv6 NAT prefix.

  6. Patrick NDA, CCNP says:

    To : Petr Lapukhov

    Thanks. I’ve done some practices based on your example. It’s all fine. I have a better understanding of NAT-PT now.

    BR

  7. Gary says:

    Hi Petr,

    The article is good~

    But about the routing issue, if we are not allowed to use static routes, how can we make R1 aware of the route 2000::/96 and R2 knows the route 150.11.3.0/24 ?

    Gary

  8. Tk says:

    to : Petr Lapukhov

    when i use below command
    ipv6 nat v6v4 source 3001:11:0:1::1 150.11.3.1

    ios give me msg that “150.11.3.1 already use in attached network”

    i am trying same configuration as above with two pc and 1 router ( 1 interface in ipv4 and other in ipv6)

    also not able to ping from ipv4 to ipv6 and vice-versa. Getting msg “dest host unreacheable”

    Any idea? am i doing something wrong?

    please update

  9. Hi
    Command used below for v4tov6 nat not found
    ipv6 nat v4v6 source static

    I can only see ipv4 address list command but source static

    I am using this in dynamips with 3640 ios 12.4

    Thanks

  10. Ashutosh Pateirya says:

    Hi Petr,
    Thanks for this nice article.
    I am just wondering if there is any possibility to implement multicast in this scenario. For example Source at IPv6 side and Receiver at IPv4 side.

    Thanks and Regards,
    Ashutosh

  11. kamlesh sharma says:

    hi,

    ipv6 nat v4v6 source static 150.1.2.2 2000::960b:0202

    even without v4v6 static my NAT-PT works and it works for all the ip address. it is natting them in nat prefix range.
    R3#sh ipv nat translations
    Prot IPv4 source IPv6 source
    IPv4 destination IPv6 destination
    — — —
    10.1.23.2 2000::A01:1702
    — 150.1.3.1 3001:1:0:1::1
    10.1.23.2 2000::A01:1702
    — 150.1.3.1 3001:1:0:1::1
    — —
    R3#sh run | in ipv6 nat
    ipv6 nat v6v4 source 3001:1:0:1::1 150.1.3.1
    ipv6 nat prefix 2000::/96

  12. jonbov CCIE#25493 says:

    Any CCIE should probably read RFC4966
    Reasons to Move the Network Address Translator – Protocol Translator (NAT-PT) to Historic Status

    A good listing of problems with this feature and reasons for making it obsolete.

    A few notes on IOS implementation:
    -Will not work with CEF, disable CEF globally
    -With fast-switching removed from 12.4(20)T all packets would be process-switched.

    But it is listed in R&S Blueprint…

  13. [...] NAT-PT VN:F [1.8.3_1051]please wait…Rating: 0.0/10 (0 votes cast)VN:F [1.8.3_1051]Rating: 0 (from 0 votes) Network none [...]

  14. sandeep says:

    Very Nice artical, can you please send me the difference between ISATAP and NAT-PT on my given mail ID:
    sandeep_dhakad@yahoo.com

    Thanks

  15. Paulo Roque says:

    Hi,

    Just to help you all to avoid some time waste when experimenting this.

    Disable IP CEF first. I forgot to disable it and got only half of the icmp packect being translated.

    Paulo Roque

  16. Carles says:

    Hello,

    Correct me if I’m wrong, please, but isn’t the “private” IPv4 addressing implemented in IPv6 with first two bytes beggining by FE80:…?

    Thanks,
    Carles

  17. [...] these tables and giving packets new addresses on the fly. In addition, NAT-PT also requires ALGs to resolve application-level issues that arise from those IP address [...]

  18. rachit says:

    static nat-pt is not working..
    please write all the configuration of r1,R2,r3..
    please its a request..

  19. x says:

    static nap-pt is working but nat-pt pool not :/

  20. [...] Understanding IPv6 NAT-PT [...]

 

Leave a Reply

Categories

CCIE Bloggers