cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1357
Views
3
Helpful
9
Replies

STATEFUL NAT64

Siddique
Level 1
Level 1

My LAN side running IPV6 and WAN side IPV4. I want to access internet from my IPV6-only host. 

I have attached my topology. If need i can change the topology. 

ip route 0.0.0.0 0.0.0.0 192.168.1.1 // To R2 For internet
!
interface Ethernet0/1
ip address 192.168.1.2 255.255.255.252
nat64 enable
!
interface Ethernet0/3
no ip address
nat64 enable
ipv6 address 2001:DB8:BEEF:2::1/64
ipv6 enable
!
!
ipv6 access-list NAT64-ACL
sequence 20 permit ipv6 2001:DB8:BEEF:2::/64 any
!
nat64 prefix stateful 2001:DB8:FACE::/96
nat64 v4 pool AFRINIC 192.168.1.11 192.168.1.12
nat64 v6v4 list NAT64-ACL pool AFRINIC overload
!

 

1 Accepted Solution

Accepted Solutions

Hi @Siddique ,

can ping "2001:db8:1::8.8.8.8 but can not ping google.com"

The principle of NAT64 is that traffic to IPv4 destinations will be natted using the registered IPv4 addresses towards the Internet. The traffic to IPv6 destinations will not be natted though. The IPv6 addresses used in your setup should be registered IPv6 addresses. You need to have proper IPv6 connectivity to the Internet for this to work. Without this IPv6 connectivity to the Internet, you will not have access to the IPv6 DNS servers and this just won't work.

Regards,

Harold Ritter
Sr Technical Leader
CCIE 4168 (R&S, SP)
harold@cisco.com
México móvil: +52 1 55 8312 4915
Cisco México
Paseo de la Reforma 222
Piso 19
Cuauhtémoc, Juárez
Ciudad de México, 06600
México

View solution in original post

9 Replies 9

Harold Ritter
Cisco Employee
Cisco Employee

Hi @Siddique ,

The configuration looks good, except that you are missing the command "ipv6 unicast-routing", which is required if you want the device to act as an IPv6 router.

Also, you will need to configure a DNS64 if you want the IPv6 host to access the Internet (both IPv4 and IPv6). There are some publicly available DNS64 servers out there if you do not have or don't want to configure your own.

https://developers.google.com/speed/public-dns/docs/dns64?hl=en

Regards, 

Harold Ritter
Sr Technical Leader
CCIE 4168 (R&S, SP)
harold@cisco.com
México móvil: +52 1 55 8312 4915
Cisco México
Paseo de la Reforma 222
Piso 19
Cuauhtémoc, Juárez
Ciudad de México, 06600
México

Dear @Harold Ritter 

After post this query, I am able to "ping 2001:1::8.8.8.8" from my lab pc. But it can not resolve the domain name. If i do "ping 2001:1::google.com" the ping not successful. Now what I need to do for resolve domain name from my host PC. 

Many many thanks for your valuable suggestion. I am confusing about DNS64( how to configure it, Should I configure it on Linux, and how it will communicate and etc.) If possible please share documents or link to know how it implement in real world. 

 

 

Thanks.

Hi @Siddique ,

In Linux, you can just add the Google public DNS64 servers to the /etc/resolv.conf file.

nameserver 2001:4860:4860::6464

nameserver 2001:4860:4860::64

Regards,

Harold Ritter
Sr Technical Leader
CCIE 4168 (R&S, SP)
harold@cisco.com
México móvil: +52 1 55 8312 4915
Cisco México
Paseo de la Reforma 222
Piso 19
Cuauhtémoc, Juárez
Ciudad de México, 06600
México

Dear @Harold Ritter 

Thanks again for your instant reply.  I have add those two command in ubuntu. Screenshot attached. 

Dear @Harold Ritter 

I have attached my topology. Here I have query:::

Query 1: Should I need  to set 2001:db8:beef:2::3 as my pc DNS IPV6 address?

If not so what will be my PC DNS address or it will be blank?

seddeeq4_0-1692903307733.png

 

Here is my topology

Hi @Siddique ,

You need to select the "Use the following DNS server addresses:" option and enter 2001:4860:4860::64 and 2001:4860:4860::6464 as the DNS server addresses.

Were you able to resolve hostnames to IPv6 addresses on the Linux workstation after updating the /etc/resolv.conf? You should probably remove "nameserver 127.0.0.53", as your Linux is IPv6 only. 

Regards,

Harold Ritter
Sr Technical Leader
CCIE 4168 (R&S, SP)
harold@cisco.com
México móvil: +52 1 55 8312 4915
Cisco México
Paseo de la Reforma 222
Piso 19
Cuauhtémoc, Juárez
Ciudad de México, 06600
México

Dear Sir, 

Sorry for late reply. Hope you well

I have attached 2 screenshot of my full topology including windows machine and Linux server settings. 

Second screenshot taken from windows machine that can ping "2001:db8:1::8.8.8.8 but can not ping google.com"

I have configured ip name-server 8.8.8.8, ip name-server 8.8.4.4, ip name-server 2001:4860:4860::6464, ip name-server 2001:4860:4860::64 in my NAT64 Router (R3)

Hi @Siddique ,

can ping "2001:db8:1::8.8.8.8 but can not ping google.com"

The principle of NAT64 is that traffic to IPv4 destinations will be natted using the registered IPv4 addresses towards the Internet. The traffic to IPv6 destinations will not be natted though. The IPv6 addresses used in your setup should be registered IPv6 addresses. You need to have proper IPv6 connectivity to the Internet for this to work. Without this IPv6 connectivity to the Internet, you will not have access to the IPv6 DNS servers and this just won't work.

Regards,

Harold Ritter
Sr Technical Leader
CCIE 4168 (R&S, SP)
harold@cisco.com
México móvil: +52 1 55 8312 4915
Cisco México
Paseo de la Reforma 222
Piso 19
Cuauhtémoc, Juárez
Ciudad de México, 06600
México