Showing results for 
Search instead for 
Did you mean: 

DNS64 Solutions

I currently have a dual-stacked network behind a Cisco ASA 5512-X. We have both IPv4 and IPv6 internet connectivity. The goal is to be able to get rid of the IPv4 internal network altogether and only use IPv6 internally. In order to do this, we need to configure NAT64 and DNS64. I understand how to configure NAT64 on the Cisco ASA 5512-X. What I don't understand is how to successfully deploy DNS64 within the office network. We can't simply use online DNS64 servers like the ones Google provides, because internal hosts need to be able to resolve AD domain queries, like This leaves me with my main question: How can I deploy a DNS64 solution on my internal IPv6 network? Can I somehow do this on the Cisco ASA (doubt it), can I do this on my Windows AD servers (All I see online are solutions using DirectAccess, which I don't want to use), can I use a Linux DNS64 server with BIND? 

The overall goal is this:

- My host queries for

- If an AAAA record exists, it is returned to the host.

- If an AAAA record does not exist, and an A record exists, the A record is returned.

- The A record is converted to an AAAA record (By the ASA or by the DNS64 server, I'm not sure how this would work exactly)

- The host gets the converted AAAA record

- The host browses to the simulated IPv6 address.

- The Cisco ASA uses NAT64 to connect the IPv6 host to the IPv4 Internet server.

Most solutions I see online incorporate the same device handling both NAT64 and DNS64. Does this have to be the case? Can the ASA not handle NAT64, while a separate server on the internal network handles DNS64 services?

Philip D'Ath

Can't you just point your clients at your AD controllers, and then point the AD controllers (their forwarders configuration) to the Google DNS64 servers?

You know what? That might work. And it's so simple that if it does, I will kick myself, lol. I'll give that a try and reply with my findings.

It also means you can configure conditional forwarders if you find some domains that are 
"plain broken" so you can override them.

Hello AJWatsonLCT ,

I will be happy to know your findings


Content for Community-Ad
This widget could not be displayed.