NAT-PT for Cisco software was designed using RFC 2766 and RFC 2765 as a migration tool to help customers transition their IPv4 networks to IPv6 networks. Using a protocol translator between IPv6 and IPv4 allows direct communication between hosts speaking a different network protocol. Users can use either static definitions or IPv4-mapped definitions for NAT-PT operation.

The figure below shows that NAT-PT runs on a router between an IPv6 network and an IPv4 network to connect an IPv6-only node with an IPv4-only node.

Figure 1

NAT-PT Basic Operation

Although IPv6 solves addressing issues for customers, a long transition period is likely before customers move to an exclusive IPv6 network environment. During the transition period, any new IPv6-only networks will need to continue to communicate with existing IPv4 networks. NAT-PT is designed to be deployed to allow direct communication between IPv6-only networks and IPv4-only networks. For a service provider customer, an example could be an IPv6-only client trying to access an IPv4-only web server. Enterprise customers will also migrate to IPv6 in stages, and many of their IPv4-only networks will be operational for several years. Dual-stack networks may have some IPv6-only hosts configured to take advantage of the IPv6 autoconfiguration, global addressing, and simpler management, and these hosts can use NAT-PT to communicate with existing IPv4-only networks in the same organization.

One of the benefits of NAT-PT is that no changes are required to existing hosts, because all the NAT-PT configurations are performed at the NAT-PT router. Customers with existing stable IPv4 networks can introduce an IPv6 network and use NAT-PT to allow communication without disrupting the existing network. To further illustrate the seamless transition, File Transfer Protocol (FTP) can be used between IPv4 and IPv6 networks, just as within an IPv4 network. Packet fragmentation is enabled by default when IPv6 is configured, allowing IPv6 and IPv4 networks to resolve fragmentation problems between the networks. Without the ability to resolve fragmentation, connectivity could become intermittent when fragmented packets might be dropped or improperly interpreted.

Cisco has developed other transition techniques including dual stack, IPv6 over MPLS, and tunneling. NAT-PT should not be used when other native communication techniques exist. If a host is configured as a dual-stack host with both IPv4 and IPv6, we do not recommend using NAT-PT to communicate between the dual-stack host and an IPv6-only or IPv4-only host. NAT-PT is not recommended for a scenario in which an IPv6-only network is trying to communicate to another IPv6-only network via an IPv4 backbone or vice versa, because NAT-PT would require a double translation to be performed. In this scenario, tunneling techniques are recommended.

The following sections describe the operations that may be used to configure NAT-PT. Users have the option to use one of the following operations for NAT-PT operation, but not all four.

Static NAT-PT uses static translation rules to map one IPv6 address to one IPv4 address. IPv6 network nodes communicate with IPv4 network nodes using an IPv6 mapping of the IPv4 address configured on the NAT-PT router.

The figure below shows how the IPv6-only node named A can communicate with the IPv4-only node named C using NAT-PT. The NAT-PT device is configured to map the source IPv6 address for node A of 2001:DB8:bbbb:1::1 to the IPv4 address 192.168.99.2. NAT-PT is also configured to map the source address of IPv4 node C, 192.168.30.1 to 2001:DB8::a. When packets with a source IPv6 address of node A are received at the NAT-PT router, they are translated to have a destination address to match node C in the IPv4-only network. NAT-PT can also be configured to match a source IPv4 address and translate the packet to an IPv6 destination address to allow an IPv4-only host communicate with an IPv6-only host.

If you have multiple IPv6-only or IPv4-only hosts that need to communicate, you may need to configure many static NAT-PT mappings. Static NAT-PT is useful when applications or servers require access to a stable IPv4 address, such as accessing an external IPv4 DNS server.

Figure 2

Static NAT-PT Operation

Dynamic NAT-PT allows multiple NAT-PT mappings by allocating addresses from a pool. NAT-PT is configured with a pool of IPv6 and/or IPv4 addresses. At the start of a NAT-PT session a temporary address is dynamically allocated from the pool. The number of addresses available in the address pool determines the maximum number of concurrent sessions. The NAT-PT device records each mapping between addresses in a dynamic state table.

The figure below shows how dynamic NAT-PT operates. The IPv6-only node B can communicate with the IPv4-only node D using dynamic NAT-PT. The NAT-PT device is configured with an IPv6 access list, prefix list, or route map to determine which packets are to be translated by NAT-PT. A pool of IPv4 addresses--10.21.8.1 to 10.21.8.10 in the figure -- is also configured. When an IPv6 packet to be translated is identified, NAT-PT uses the configured mapping rules and assigns a temporary IPv4 address from the configured pool of IPv4 addresses.

Figure 3

Dynamic NAT-PT Operation

Dynamic NAT-PT translation operation requires at least one static mapping for the IPv4 DNS server.

After the IPv6 to IPv4 connection is established, the reply packets going from IPv4 to IPv6 take advantage of the previously established dynamic mapping to translate back from IPv4 to IPv6. If the connection is initiated by an IPv4-only host, then the explanation is reversed.

Port Address Translation (PA T), also known as Overload, allows a single IPv4 address to be used among multiple sessions by multiplexing on the port number to associate several IPv6 users with a single IPv4 address. PAT can be accomplished through a specific interface or through a pool of addresses. The figure below shows multiple IPv6 addresses from the IPv6 network linked to a single IPv4 interface into the IPv4 network.

Figure 4

Port Address Translation

Customers can also send traffic from their IPv6 network to an IPv4 network without configuring IPv6 destination address mapping. A packet arriving at an interface is checked to discover if it has a NAT-PT prefix that was configured with the ipv6 nat prefix v4-mapped command. If the prefix matches, then an access-list check is performed to discover if the source address matches the access list or prefix list. If the prefix does not match, the packet is dropped.

If the prefix matches, source address translation is performed. If a rule has been configured for the source address translation, the last 32 bits of the destination IPv6 address is used as the IPv4 destination and a flow entry is created.

With an IPv4-mapping configuration on the router, when the DNS ALG IPv4 address is converted to an IPv6 address, the IPv6 address is processed and the DNS packets from IPv4 network get their ALGs translated into the IPv6 network.

1.    enable

2.    configure terminal

3.    ipv6 nat prefix ipv6-prefix / prefix-length

4.    interface type number

5.    ipv6 address ipv6-address {/prefix-length | link-local}

6.    ipv6 nat

7.    exit

8.    interface type number

9.    ip address ip-address mask [secondary]

10.    ipv6 nat

1.    enable

2.    configure terminal

3.    interface type number

4.    ipv6 nat prefix ipv6-prefix v4-mapped {access-list-name | ipv6-prefix}

1.    enable

2.    configure terminal

3.   Do one of the following:

4.    ipv6 nat v6v4 pool name start-ipv4 end-ipv4 prefix-length prefix-length

5.    ipv6 nat translation [max-entries number] {timeout | udp-timeout | dns-timeout| tcp-timeout| finrst-timeout| icmp-timeout} {seconds| never}

6.    ipv6 access-list access-list-name

7.    permit protocol {source-ipv6-prefix / prefix-length| any| host source-ipv6-address}[operator [port-number]] {destination-ipv6-prefix / prefix-length| any| host destination-ipv6-address}

8.    exit

9.    show ipv6 nat translations [icmp| tcp| udp] [verbose]

10.    show ipv6 nat statistics

1.    enable

2.    configure terminal

3.   Do one of the following:

4.    ipv6 nat v4v6 pool name start-ipv6 end-ipv6 prefix-length prefix-length

5.    access-list {access-list-name| number}{deny| permit} [source source-wildcard] [log]

1.    enable

2.    configure terminal

3.   Do one of the following:

4.    ipv6 nat v6v4 pool name start-ipv4 end-ipv4 prefix-length prefix-length

5.    ipv6 nat translation [max-entries number] {timeout | udp-timeout | dns-timeout| tcp-timeout| finrst-timeout| icmp-timeout} {seconds| never}

6.    ipv6 access-list access-list-name

7.    permit protocol {source-ipv6-prefix / prefix-length| any| host source-ipv6-address}[operator [port-number]] {destination-ipv6-prefix / prefix-length| any| host destination-ipv6-address}

1.    clear ipv6 nat translation *

2.    enable

3.    debug ipv6 nat [detailed| port]

• Examples

The following example configures the NAT-PT prefix globally, enables NAT-PT on two interfaces, and configures one static NAT-PT mapping (used, for example, to access a DNS server). A dynamic NAT-PT mapping is also configured to map IPv4 addresses to IPv6 addresses using a pool of IPv6 addresses named v6pool. The packets to be translated by NAT-PT are filtered using an access list named pt-list2. Ethernet interface 3/1 is configured as IPv6 only, and Ethernet interface 3/3 is configured as IPv4 only.

interface Ethernet3/1 
 ipv6 address 2001:DB8:bbbb:1::9/64 
 ipv6 enable 
 ipv6 nat 
! 
interface Ethernet3/3 
 ip address 192.168.30.9 255.255.255.0 
 ipv6 nat 
! 
ipv6 nat v4v6 source list 72 pool v6pool 
ipv6 nat v4v6 pool v6pool 2001:DB8:0::1 2001:DB8:0::2 prefix-length 128 
ipv6 nat v6v4 source 2001:DB8:bbbb:1::1 10.21.8.0 
ipv6 nat prefix 2001:DB8:0::/96 
! 
access-list 72 permit 192.168.30.0 0.0.0.255