NAT64 allows IPv6-only clients to communicate with IPv4-only servers by translating IPv6 addresses to IPv4 addresses. This is particularly useful in environments transitioning to IPv6 while still needing access to IPv4 resources.
64:ff9b::/96
as defined in RFC 6052. A DNS64 server synthesizes AAAA records from A records, embedding the IPv4 address into the IPv6 address.
NAT64 enables IPv6-only clients to communicate with IPv4-only servers by translating IPv6 addresses to IPv4 addresses. For this translation to work seamlessly, clients need to know the NAT64 prefix used for synthesizing IPv6 addresses from IPv4 addresses. This is where a DHCP server becomes essential.
The DHCP server can provide clients with the NAT64 prefix through specific DHCP options. This allows clients to construct appropriate IPv6 addresses that the NAT64 gateway can translate to reach IPv4 destinations.
The Neighbor Discovery Protocol (NDP) is essential in IPv6 networks, performing functions similar to ARP in IPv4. It facilitates address resolution, router discovery, and neighbor reachability detection. However, in certain scenarios, especially when using Network Prefix Translation for IPv6 (NPTv6), the standard NDP behavior is insufficient. This is where NDP Proxy comes into play.
NDP Proxy allows a device, such as a firewall, to respond to Neighbor Solicitation (NS) messages on behalf of another device. This means the proxy device replies with its own MAC address when an NS is received for an IPv6 address that it represents. This functionality is crucial in environments where direct Layer 2 communication between devices is not possible.
Imagine you're trying to send a letter to a friend who lives in a gated community. You know their address, but you can't deliver the letter directly because you don't have access beyond the gate. Instead, you hand the letter to the security guard at the entrance, who knows everyone inside and ensures the letter reaches your friend.
In this analogy:
In IPv6 networks, devices use the Neighbor Discovery Protocol (NDP) to find each other's hardware addresses (like MAC addresses) to communicate on the same local network. However, when devices are on different networks (like external and internal networks separated by a firewall), they can't directly discover each other's addresses.
This is where the NDP Proxy comes in. The firewall, acting as an NDP Proxy, responds to address discovery requests on behalf of the internal devices. It tells the external device, "I can take your message to the intended recipient." This allows seamless communication between devices on different networks without exposing the internal network's structure.
Without the NDP Proxy, the external device wouldn't know how to reach the internal device, and communication would fail. The NDP Proxy ensures that devices can find and talk to each other, even across network boundaries.
NPTv6 provides a stateless translation between internal and external IPv6 prefixes, allowing organizations to change their ISP-assigned prefixes without renumbering internal networks.
In this example, we aim to configure Network Prefix Translation for IPv6 (NPTv6) on a Palo Alto Networks firewall. The goal is to translate internal Unique Local Addresses (ULAs) to globally routable IPv6 addresses, facilitating communication with external networks.
fd00:1:2:3::/64
2001:db8:1:2::/64
fd00:1:2:3::1/64
for internal,
2001:db8:1:2::1/64
for external).
NPTv6-BiDirectional
.
NPTv6
.
trust
.
untrust
.
fd00:1:2:3::/64
.
Static IP
.
2001:db8:1:2::/64
.
2001:db8:1:2::/64
prefix.
sequenceDiagram
participant Client as Internal Client (fd00:1:2:3::10)
participant Firewall as Palo Alto Firewall (NPTv6 Enabled)
participant Server as External Server (2001:db8:1:2::20)
Note over Client,Server: Outbound Traffic Flow
Client->>Firewall: Sends packet to 2001:db8:1:2::20
Note right of Firewall: Translates source address fd00:1:2:3::10 → 2001:db8:1:2::10
Firewall->>Server: Forwards packet with translated source address
Server-->>Firewall: Sends response to 2001:db8:1:2::10
Note left of Firewall: Translates destination address 2001:db8:1:2::10 → fd00:1:2:3::10
Firewall-->>Client: Forwards response to internal client
Note over Client,Server: Inbound Traffic Flow
Server->>Firewall: Initiates connection to 2001:db8:1:2::10
Note left of Firewall: Translates destination address 2001:db8:1:2::10 → fd00:1:2:3::10
Firewall->>Client: Forwards packet to internal client
Client-->>Firewall: Sends response to Server
Note right of Firewall: Translates source address fd00:1:2:3::10 → 2001:db8:1:2::10
Firewall-->>Server: Forwards response to external server