STATEFUL NAT64

[Siddique]

My LAN side running IPV6 and WAN side IPV4. I want to access internet from my IPV6-only host. 

I have attached my topology. If need i can change the topology. 

ip route 0.0.0.0 0.0.0.0 192.168.1.1 // To R2 For internet
!
interface Ethernet0/1
ip address 192.168.1.2 255.255.255.252
nat64 enable
!
interface Ethernet0/3
no ip address
nat64 enable
ipv6 address 2001:DB8:BEEF:2::1/64
ipv6 enable
!
!
ipv6 access-list NAT64-ACL
sequence 20 permit ipv6 2001:DB8:BEEF:2::/64 any
!
nat64 prefix stateful 2001:DB8:FACE::/96
nat64 v4 pool AFRINIC 192.168.1.11 192.168.1.12
nat64 v6v4 list NAT64-ACL pool AFRINIC overload
!

[Harold Ritter]

Hi @Siddique ,

The configuration looks good, except that you are missing the command "ipv6 unicast-routing", which is required if you want the device to act as an IPv6 router.

Also, you will need to configure a DNS64 if you want the IPv6 host to access the Internet (both IPv4 and IPv6). There are some publicly available DNS64 servers out there if you do not have or don't want to configure your own.

https://developers.google.com/speed/public-dns/docs/dns64?hl=en

Regards, 

[Siddique]

Dear @Harold Ritter 

After post this query, I am able to "ping 2001:1::8.8.8.8" from my lab pc. But it can not resolve the domain name. If i do "ping 2001:1::google.com" the ping not successful. Now what I need to do for resolve domain name from my host PC. 

Many many thanks for your valuable suggestion. I am confusing about DNS64( how to configure it, Should I configure it on Linux, and how it will communicate and etc.) If possible please share documents or link to know how it implement in real world. 

Thanks.

[Harold Ritter]

Hi @Siddique ,

In Linux, you can just add the Google public DNS64 servers to the /etc/resolv.conf file.

nameserver 2001:4860:4860::6464

nameserver 2001:4860:4860::64

Regards,

[Siddique]

Dear @Harold Ritter 

Thanks again for your instant reply.  I have add those two command in ubuntu. Screenshot attached. 

[Siddique]

Dear @Harold Ritter 

I have attached my topology. Here I have query:::

Query 1: Should I need  to set 2001:db8:beef:2::3 as my pc DNS IPV6 address?

If not so what will be my PC DNS address or it will be blank?

[Siddique]

Here is my topology

[Harold Ritter]

Hi @Siddique ,

You need to select the "Use the following DNS server addresses:" option and enter 2001:4860:4860::64 and 2001:4860:4860::6464 as the DNS server addresses.

Were you able to resolve hostnames to IPv6 addresses on the Linux workstation after updating the /etc/resolv.conf? You should probably remove "nameserver 127.0.0.53", as your Linux is IPv6 only. 

Regards,

[Siddique]

Dear Sir, 

Sorry for late reply. Hope you well

I have attached 2 screenshot of my full topology including windows machine and Linux server settings. 

Second screenshot taken from windows machine that can ping "2001:db8:1::8.8.8.8 but can not ping google.com"

I have configured ip name-server 8.8.8.8, ip name-server 8.8.4.4, ip name-server 2001:4860:4860::6464, ip name-server 2001:4860:4860::64 in my NAT64 Router (R3)

[Harold Ritter · Accepted solution]

Hi @Siddique ,

> can ping "2001:db8:1::8.8.8.8 but can not ping google.com"

The principle of NAT64 is that traffic to IPv4 destinations will be natted using the registered IPv4 addresses towards the Internet. The traffic to IPv6 destinations will not be natted though. The IPv6 addresses used in your setup should be registered IPv6 addresses. You need to have proper IPv6 connectivity to the Internet for this to work. Without this IPv6 connectivity to the Internet, you will not have access to the IPv6 DNS servers and this just won't work.

Regards,