cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
6115
Views
0
Helpful
5
Replies

6to4 NAT-PT not working

danny itza
Level 1
Level 1

Hi,

I want my computer with an IPv6 Address of the block 2800:410:890:1::/64, reach both IPv4 and IPv6 address ( I don't want to use an ipv4 address on my cumputer). I configured and enable NAT_PT for IPv6 on my router.  I cannot ping 2800:410:890:1::1 when I configure ipv6 nat on interface FastEthernet0/0.890.

Any help is highly appreciated.    

Regards,

Danny

Configuration I am using.

interface FastEthernet0/0.11

encapsulation dot1Q 11

ip address 200.32.198.121 255.255.255.248

ipv6 nat

no cdp enable

interface FastEthernet0/0.890

description ***6 to 4 Test Block ***

encapsulation dot1Q 890

ipv6 address 2800:410:890:1::1/64

ipv6 enable

ipv6 nat

no cdp enable

!

ipv6 nat v6v4 source list ptv6-list1 pool v4pool

ipv6 nat v6v4 pool v4pool 200.32.198.123 200.32.198.126 prefix-length 29

ipv6 nat prefix 2800:410:890:1::/96

!

ipv6 access-list ptv6-list1

permit ipv6 2800:410:890:1::/64 any

sequence 30 permit ipv6 any any

!

5 Replies 5

Phillip Remaker
Cisco Employee
Cisco Employee

Before you go much further with this, consider the fact that NAT-PT is deprecated by IETF in RFC 4966 (http://tools.ietf.org/html/rfc4966) and that there are arguments in IETF to make 6to4 historical as well: http://tools.ietf.org/html/draft-troan-v6ops-6to4-to-historic-00.

Although an interesting academic exercise, what are you really hoping to accomplish?  A pure IPv6 endpoint?

What is the address of the IPv6 PC that cannot ping, and where is it attached?

Phillip,

Yes I want a Pure IPV6 Endpoint,   So that I can reach both the IPV6 and IPv4 sites.   I know that Nat should be avoided at all times but,  I just want to test if this works,  so that we can use pure iv6 computers and stop using NAT until everyone is IPv6 ready, but while this change is in process we can still reach the ipv4 address.

I have a 3550 catalyst switch connected to port FastEthernet0/0 on my 3745 router which has a tunnel for my IPv6 conenction.   From my computer connected to the switch on port 2 with vlan 890 I can Ping 2800:410:890:1::1, the 3745 router but as soon as I configure IPv6 NAT on 3745 router sub interface FastEthernet0/0.890 I cannot reach the ipv6 address 2800:410:890:1::1 which is the router. I think I have a NAT configuration problem.  thanks for your help.

danny

Configuration on my switch.

vlan 890

name link to 3745 Router

interface FastEthernet0/1

description **Uplink to 3745 router**

switchport mode trunk

speed 100

duplex full

!

interface FastEthernet0/2

description *to IPv6 computer *

switchport access vlan 890

switchport mode access

speed 100

duplex full

!

This is the configuration on my router

interface FastEthernet0/0.12

encapsulation dot1Q 12

ip address 200.32.198.121 255.255.255.248

ipv6 nat

no cdp enable

!

interface FastEthernet0/0.890

description ***6 to 4 Test Block ***

encapsulation dot1Q 890

ipv6 address 2800:410:890:1::1/64

ipv6 enable

ipv6 nat

no cdp enable

!

ipv6 nat v6v4 source list ptv6-list1 pool v4pool

ipv6 nat v6v4 pool v4pool 200.32.198.123 200.32.198.126 prefix-length 29

ipv6 nat prefix 2800:410:890:1::/96

!

ipv6 access-list ptv6-list1

permit ipv6 2800:410:890:1::/64 any

!

interface Tunnel10

description Hurricane Electric IPv6 Tunnel

no ip address

ipv6 address 2001:470:13:85::2/64

ipv6 enable

ipv6 cef

tunnel source 200.32.250.29

tunnel destination 216.66.70.2

tunnel mode ipv6ip

!

ipv6 route 2800:410::/32 Null0

ipv6 route ::/0 Tunnel10

Seems like the NAT prefix and router address overlap. (all zero, even though the NAT bas a longer mask)

Can you make one of the other an non-overlapping prefix?

Like, maybe

ipv6 nat prefix 2800:410:890:1:A::/96

Just a guess.

m.bratina
Level 1
Level 1

Hi Danny.

your IPv6 nat prefix is the same as your network prefix and it should be different.

interface FastEthernet0/0.890

ipv6 address 2800:410:890:1::1/64

!

ipv6 nat prefix 2800:410:890:1::/96

!

Change your nat prefix to a different one, for example:ipv6 nat prefix 3800::/96. It always has to be /96.

When you ping an IPv4 host you have to put the IPv4 in HEX format in the last 32 bits of the IPv6 (right after the /96)

To ping IP 1.1.1.1 you should execute:

ping 3800::0101:0101

Deepak Ambotkar
Level 1
Level 1

Danny,

Good that you are trying to configure this however to update you this feature has been deprecated.

Please see below:-

Network Address Translation/Protocol Translation (or simply NAT-PT) is defined in RFC 2766 but due to numerous problems, it has been obsoleted by RFC 4966 and deprecated to historic status. It is typically used in conjunction with a

DNS application-level gateway (DNS-ALG) implementation.

Ref- http://en.wikipedia.org/wiki/IPv6_transition_mechanisms

Alternatively you can use 6to4 tunneling mechanisms or have dual stack implemented.

regards,

deepak

Review Cisco Networking for a $25 gift card