topic Re: IPV4 to IPV6 Internet not working in General Topics

IPV4 to IPV6 Internet not working

AhamadullahM — Fri, 25 Feb 2022 08:30:24 GMT

IPV4 to IPV6 Internet not working

We are facing an issue accessing the internet. we have an IPV6 internet connection. we want to access the IPV6 ISP link from the IPV4 LAN subnet. we have created the source NAT policy using NAT64. but unable to access the internet. pls, help.

thanks in advance

Re: IPV4 to IPV6 Internet not working

PavelK — Fri, 25 Feb 2022 22:41:40 GMT

Thank you for the post @AhamadullahM

The purpose of NAT64 is to enable IPv6 only clients to communicate with IPv4 only resources: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIFCA0 Based on what you have described, you have opposite scenario. You have IPv4 only client to access IPv6 only network. The NAT64 will unfortunately not work in this case.

Kind Regards

Pavel

Re: IPV4 to IPV6 Internet not working

kiwi — Mon, 28 Feb 2022 09:02:30 GMT

Hi @AhamadullahM ,

Is this the scenario you're looking for ?:

Configure NAT64 for IPv4-Initiated Communication

I hope it helps,

-Kiwi.

Re: IPV4 to IPV6 Internet not working

AhamadullahM — Mon, 28 Feb 2022 09:19:54 GMT

Thanks for the reply PaveIK,

Could you please let me know, any possible workaround for my scenario? we have to do the source NAT. LAN (IPV4)---to-- ISP(IPV6).

Re: IPV4 to IPV6 Internet not working

AhamadullahM — Mon, 28 Feb 2022 09:21:30 GMT

No, We have to look for NAT 46

Thanks for your reply

Re: IPV4 to IPV6 Internet not working

PavelK — Wed, 02 Mar 2022 06:06:15 GMT

Thank you for the reply @AhamadullahM

I am sorry, unfortunately I do not have any hands on experience with NAT46, but on best effort bases I would advice following. Since Palo Alto Firewall does not support NAT46, I would connect IPv6 only ISP link to a router that supports NAT46 (For example Cisco ISR router or Juniper SRX), then let this device do a routing + NAT. The Palo Alto would be connected behind this router for the rest of the functionality (Firewall Features).

If it is technically doable, I would consider dual stack to configure IPv6 between your Firewall and your hosts.

Kind Regards

Pavel