The Stateful NAT64 feature provides a translation mechanism that translates IPv6 packets into IPv4 packets and vice versa.

Stateful NAT64 supports Internet Control Message Protocol (ICMP), TCP, and UDP traffic. Packets that are generated in an IPv6 network and are destined for an IPv4 network are routed within the IPv6 network towards the Stateful NAT64 translator. Stateful NAT64 translates the packets and forwards them as IPv4 packets through the IPv4 network. The process is reversed for traffic that is generated by hosts connected to the IPv4 network and destined for an IPv6 receiver.

The Stateful NAT64 translation is not symmetric, because the IPv6 address space is larger than the IPv4 address space and a one-to-one address mapping is not possible. Before it can perform an IPv6 to an IPv4 translation, Stateful NAT64 requires a state that binds the IPv6 address and the TCP/UDP port to the IPv4 address. The binding state is either statically configured or dynamically created when the first packet that flows from the IPv6 network to the IPv4 network is translated. After the binding state is created, packets flowing in both directions are translated. In dynamic binding, Stateful NAT64 supports communication initiated by the IPv6-only node toward an IPv4-only node. Static binding supports communication initiated by an IPv4-only node to an IPv6-only node and vice versa. Stateful NAT64 with port overloading provides a 1:n mapping between IPv4 and IPv6 addresses.

According to the Behavior Engineering for Hindrance Avoidance (BEHAVE) drafts about the framework for Stateful NAT64 standards, when an IPv6 node initiates traffic through Stateful NAT64, and the incoming packet does not have an existing state, the following events happen:

• The source IPv6 address (and the source port) is associated with an IPv4 configured pool address (and port, based on the configuration).

• The destination IPv6 address is translated mechanically based on the BEHAVE translation draft using either the configured NAT64 stateful prefix or the Well Known Prefix (WKP).

• The packet is translated from IPv6 to IPv4 and forwarded to the IPv4 network.

When an incoming packet is stateful (if a state exists for an incoming packet), NAT64 identifies the state and uses the state to translate the packet.

When Stateful NAT64 is configured on an interface, Virtual Fragmentation Reassembly (VFR) is configured automatically.

A set of bits at the start of an IPv6 address is called the format prefix. Prefix length is a decimal value that specifies how many of the leftmost contiguous bits of an address comprise the prefix.

When packets flow from the IPv6 to the IPv4 direction, the IPv4 host address is derived from the destination IP address of the IPv6 packet that uses the prefix length. When packets flow from the IPv4 to the IPv6 direction, the IPv4 host address is constructed using the stateful prefix.

According to the IETF address format BEHAVE draft, a u-bit (bit 70) defined in the IPv6 architecture should be set to zero. For more information on the u-bit usage, see RFC 2464. The reserved octet, also called u-octet, is reserved for compatibility with the host identifier format defined in the IPv6 addressing architecture. When constructing an IPv6 packet, the translator has to make sure that the u-bits are not tampered with and are set to the value suggested by RFC 2373. The suffix will be set to all zeros by the translator. IETF recommends that the 8 bits of the u-octet (bit range 64-71) be set to zero.

• Well Known Prefix

The packet flow of IPv4-initiated packets for Stateful NAT64 is as follows:

• The destination address is routed to a NAT Virtual Interface (NVI).

  A virtual interface is created when Stateful NAT64 is configured. For Stateful NAT64 translation to work, all packets must get routed to the NVI. When you configure an address pool, a route is automatically added to all IPv4 addresses in the pool. This route automatically points to the NVI.

• The IPv4-initiated packet hits static or dynamic binding.

  Dynamic address bindings are created by the Stateful NAT64 translator when you configure dynamic Stateful NAT64. A binding is dynamically created between an IPv6 and an IPv4 address pool. Dynamic binding is triggered by the IPv6-to-IPv4 traffic and the address is dynamically allocated. Based on your configuration, you can have static or dynamic binding.

• The IPv4-initiated packet is protocol-translated and the destination IP address of the packet is set to IPv6 based on static or dynamic binding. The Stateful NAT64 translator translates the source IP address to IPv6 by using the Stateful NAT64 prefix (if a stateful prefix is configured) or the Well Known Prefix (WKP) (if a stateful prefix is not configured).

• A session is created based on the translation information.

All subsequent IPv4-initiated packets are translated based on the previously created session.

The stateful IPv6-initiated packet flow is as follows:

• The first IPv6 packet is routed to the NAT Virtual Interface (NVI) based on the automatic routing setup that is configured for the stateful prefix. Stateful NAT64 performs a series of lookups to determine whether the IPv6 packet matches any of the configured mappings based on an access control list (ACL) lookup. Based on the mapping, an IPv4 address (and port) is associated with the IPv6 destination address. The IPv6 packet is translated and the IPv4 packet is formed by using the following methods:

  • Extracting the destination IPv4 address by stripping the prefix from the IPv6 address. The source address is replaced by the allocated IPv4 address (and port).
  • The rest of the fields are translated from IPv6-to-IPv4 to form a valid IPv4 packet.

  Note	This protocol translation is the same for stateless NAT64 and described in the BEHAVE RFC draft.

• A new NAT64 translation is created in the session database and in the bind database. The pool and port databases are updated depending on the configuration. The return traffic and the subsequent traffic of the IPv6 packet flow will use this session database entry for translation.

Stateful Network Address Translation 64 (NAT64) filters IPv6 and IPv4 packets. All IPv6 packets that are transmitted into the stateful translator are filtered because statefully translated IPv6 packets consume resources in the translator. These packets consume processor resources for packet processing, memory resources (always session memory) for static configuration, IPv4 address resources for dynamic configuration, and IPv4 address and port resources for Port Address Translation (PAT).

Stateful NAT64 utilizes configured access control lists (ACLs) and prefix lists to filter IPv6-initiated traffic flows that are allowed to create the NAT64 state. Filtering of IPv6 packets is done in the IPv6-to-IPv4 direction because dynamic allocation of mapping between an IPv6 host and an IPv4 address can be done only in this direction.

The table below displays the differences between Stateful NAT64 and Stateless NAT64.

Depending on your release, Stateful NAT64 supports high-speed logging (HSL). When HSL is configured, NAT64 provides a log of packets that flow through routing devices (similar to the Version 9 NetFlow-like records) to an external collector. Records are sent for each binding (binding is the address binding between the local address and the global address to which the local address is translated) and when sessions are created and destroyed. Session records contain the full 5-tuple of information (the source IP address, destination IP address, source port, destination port, and protocol). A tuple is an ordered list of elements. NAT64 also sends an HSL message when a NAT64 pool runs out of addresses (also called pool exhaustion). Because the pool exhaustion messages are rate limited, each packet that hits the pool exhaustion condition does not trigger an HSL message.

Configure the nat64 logging translations flow-export v9 udp destination command to enable NAT64 HSL logging.

The table below describes the templates for HSL bind and session create or destroy. These fields (in the order they are displayed in the log) describe how the log collector must interpret the bytes in HSL records. The value for some of the fields varies based on whether the session is being created, destroyed, or modified.

The table below describes the HSL pool exhaustion templates (in the order they are available in the template).

The FTP64 (or service FTP) application-level gateway (ALG) helps stateful Network Address Translation 64 (NAT64) to operate on Layer 7 data. FTP64 ALG translates IP addresses and the TCP port information embedded in the payload of an FTP control session.

NAT translates any TCP/UDP traffic that does not carry source and destination IP addresses in the application data stream. Protocols that embed the IP address information within the payload (or in the application data stream) require the support of an ALG. ALGs handle application data stream (Layer 7) protocol-specific services, such as translating embedded IP addresses and port numbers in the packet payload and extracting new connection or session information from control channels.

FTP64 is automatically enabled when Stateful NAT64 is enabled. Use the no nat64 service ftp command to disable the NAT64 FTP service.

Note	The FTP64 ALG is not supported in Stateless NAT64 translation.

Note	The FTP64 ALG does not support IPv4-compatible IPv6 addresses.

Based on IPv6-to-IPv4 translation FTP considerations draft-ietf-behave-ftp64-02 and RFC 2228, the FTP64 ALG must switch to transparent mode (a device in a transparent mode is invisible in the network; however, this device can act as a bridge and inspect or filter packets), when commands and responses flow between the FTP client and the FTP server. When a client issues the FTP AUTH command, the FTP64 ALG transparently forwards all data on the control channel in both (ingress and egress) directions, until the end of the control channel session. Similarly, during an AUTH negotiation, the ALG must be in transparent mode, whether the negotiation is successful or not.

Based on RFC 6384, the behavior of the FTP64 ALG during a client-server communication is different. During an IPv6-to-IPv4 translation, the FTP64 ALG must transparently copy data transmitted over the control channel so that the transport layer security (TLS) session works correctly. However, the client commands and server responses are hidden from the FTP64 ALG. To ensure a consistent behavior, as soon as the initial FTP AUTH command is issued by a client, the FTP64 ALG must stop translating commands and responses and start transparently copying TCP data that is sent by the server to the client and vice versa. The FTP64 ALG must ignore the AUTH command and not go into transparent mode if the server response is in the 4xx or 5xx ranges, which comprise FTP error/warning messages.

Prior to CSCtu37975, when an IPv6 FTP client issues an FTP AUTH command, irrespective of whether the IPv4 FTP server accepts or rejects that authorization negotiation, the FTP64 ALG moves the AUTH session to transparent mode (or bypass mode). When a session is in transparent mode, NAT cannot perform translation on the packets within the session. With CSCtu37975, during a client-server communication, the FTP64 ALG's behavior is compliant with RFC 6384.

Depending on your release, the FTP64 application-level gateway (ALG) adds high availability (HA) support for Stateful NAT64. The FTP64 NAT ALG Intrabox HA Support feature supports the stateful switchover between redundant Forward Processors (FPs) within a single chassis. The HA support provided by the FTP64 ALG is applicable to both intrabox HA and In-Service Software Upgrade (ISSU).

Use the no nat64 service ftp command to disable the NAT64 ALG service.

The FTP64 ALG synchronizes data when it receives the following messages:

• User authentication flag after 230 replies.
• ALG disable/enable flag after ALG ENABLE and ALG DISABLE messages are received.
• Fragment detection information after the first segmented packet is detected.
• Fragment detection information after the end of the segmentation is detected.

Note	Stateful NAT64 supports only intrabox HA in some releases. FTP64 ALG statistics and FTP64 debug logs are not synchronized to the standby device by the FTP64 ALG.

1.    enable

2.   configure terminal

3.   ipv6 unicast-routing

4.   interface type number

5.   description string

6.   ipv6 enable

7.   ipv6 address {ipv6-address/prefix-length | prefix-name sub-bits/prefix-length}

8.   nat64 enable

9.   exit

10.   interface type number

11.   description string

12.   ip address ip-address mask

13.   nat64 enable

14.   exit

15.   nat64 prefix stateful ipv6-prefix/length

16.   nat64 v6v4 static ipv6-address ipv4-address

17.   end

1.    enable

2.    configure terminal

3.    ipv6 unicast-routing

4.    interface type number

5.    description string

6.    ipv6 enable

7.    ipv6 {ipv6-address/prefix-length | prefix-name sub-bits/prefix-length}

8.    nat64 enable

9.    exit

10.    interface type number

11.    description string

12.    ip address ip-address mask

13.    nat64 enable

14.    exit

15.    ipv6 access-list access-list-name

16.    permit ipv6 ipv6-address any

17.    exit

18.    nat64 prefix stateful ipv6-prefix/length

19.    nat64 v4 pool pool-name start-ip-address end-ip-address

20.    nat64 v6v4 list access-list-name pool pool-name

21.    end

1.    enable

2.    configure terminal

3.    ipv6 unicast-routing

4.    interface type number

5.    description string

6.    ipv6 enable

7.    ipv6 {ipv6-address/prefix-length | prefix-name sub-bits/prefix-length}

8.    nat64 enable

9.    exit

10.    interface type number

11.    description string

12.    ip address ip-address mask

13.    nat64 enable

14.    exit

15.    ipv6 access-list access-list-name

16.    permit ipv6 ipv6-address any

17.    exit

18.    nat64 prefix stateful ipv6-prefix/length

19.    nat64 v4 pool pool-name start-ip-address end-ip-address

20.    nat64 v6v4 list access-list-name pool pool-name overload

21.    end

1.    show nat64 aliases [lower-address-range upper-address-range]

2.    show nat64 logging

3.    show nat64 prefix stateful {global | {interfaces | static-routes} [prefix ipv6-address/prefix-length]}

4.    show nat64 timeouts

Device# show nat64 aliases

Aliases configured: 1
Address   Table ID  Inserted   Flags   Send ARP   Reconcilable   Stale   Ref-Count
10.1.1.1  0         FALSE      0x0030  FALSE      TRUE           FALSE   1

Device# show nat64 logging

NAT64 Logging Type

Method       Protocol   Dst. Address   Dst. Port   Src. Port  
translation 
flow export  UDP        10.1.1.1       5000        60087

Device# show nat64 prefix stateful interfaces

Stateful Prefixes

Interface               NAT64   Enabled   Global Prefix
GigabitEthernet0/1/0    TRUE    TRUE      2001:DB8:1:1/96
GigabitEthernet0/1/3    TRUE    FALSE     2001:DB8:2:2/96

Device# show nat64 timeouts

NAT64 Timeout

Seconds    CLI Cfg    Uses 'All'    all flows
86400      FALSE      FALSE         udp
300        FALSE      TRUE          tcp
7200       FALSE      TRUE          tcp-transient
240        FALSE      FALSE         icmp
60         FALSE      TRUE