topic Re: nat64 error in General Topics

nat64 error

PanIst — Tue, 03 Nov 2015 20:54:25 GMT

Hello

I'm trying to do a NAT from ipv6 to ipv4.

On commit I have an error

"Nat64 needs an ipv4 in the rule for dest xlat"

Rule : from untrust to untrust , destination ip is ipv6 and translated address is ipv4 destination NAT

Thanks.

Re: nat64 error

kiwi — Wed, 04 Nov 2015 09:57:53 GMT

You don't need IPv4 destination NAT for this scenario (IPv6 to IPv4) :

Source IP : Any IPv6 address

Destination IP : NAT64 IPv6 prefix with RFC 6052 compliant netmask

Source translation : Dynamic IP and port mode using IPv4 address

Destination translation : None (this is extracted from the destination IPv6 address)

Note that this implementation requires a DNS64 server that the IPv6 client can communicate with to synthesize AAAA records from A records.

Have a look also at the following document that has a configuration example on how to NAT64 IPv6 to IPv4 :

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-NAT64-on-Palo-Alto-Firewalls-IPv6-to-IPv4/ta-p/60249

Regards,

-Kim.

Re: nat64 error

PiankaMariusz — Fri, 27 Mar 2020 20:05:57 GMT

Hi Guys,

I am struggling with the destination NAT here.

I have a challenge where I want the IPv6 initiated host (any - internet) to be NATTED so that it can reach Private IP address port 443.

https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/networking/nat64/configure-nat64/ipv6-initiated-communication.html#iddb41c324-5690-4ca3-b54a-6ec24ed3f57d

Article clearly says, IPv6 initiated traffic.

[...] Configure the destination IPv6 address as either the Well-Known Prefix or the NSP that the DNS64 server uses. (You do not configure the full IPv6 destination address in the rule.)[...]

I mean, what ?

I already have IPv6 on external interface on the firewall that can be reached from IPv6 network

I merely want not traffic that arrives at that interface on specific port to be NATTED behind some ipv4 address I can create and be forwarded to local IP address on the LAN, that seems to be impossible to do.
his is extracted from the destination IPv6 address"
How does the IPv4 of LAN suppose to be extracted from the destination IPv6 address where IPv6 address is of something entirely different( here its Palo Alto external internet facing firewall)

Re: nat64 error

shubhamG — Sat, 10 Apr 2021 13:52:16 GMT

@PiankaMariusz

How did you achieve your configuration then?

I also have the same exact requirement,can you please help..

Thanks in advance mate.