About NPTv6
Learn more about IPv6-to-IPv6 Network Prefix Translation
(NPTv6) for your managed firewalls.
| Where Can I Use
This? | What Do I Need? |
|---|
NPTv6 performs stateless translation of one IPv6 prefix to another IPv6 prefix. It’s stateless,
meaning that it doesn’t keep track of ports or sessions on the addresses translated.
NPTv6 differs from NAT66, which is stateful. Palo Alto Networks supports
NPTv6
RFC 6296 prefix translation; it doesn’t support NAT66.
With the limited addresses in the IPv4 space, NAT was required to translate private and
nonroutable IPv4 addresses to one or more globally routable IPv4 addresses. For
organizations using IPv6 addressing, there’s no need to translate IPv6 addresses to IPv6
addresses due to the abundance of IPv6 addresses.
NPTv6 translates the prefix portion of an IPv6 address but not the host portion or the
application port numbers. The host portion is copied, and therefore remains the same on
either side of the firewall. The host portion also remains visible within the packet
header.
NPTv6 is supported on the following firewall models (NPTv6 with
hardware lookup but packets go through the CPU):
PA-7000 Series firewalls
PA-5200 Series firewalls
PA-3200 Series firewalls
PA-800 firewall
PA-220 firewall
Unique Local Addresses
RFC
4193, Unique Local IPv6 Unicast Addresses, defines unique local addresses
(ULAs), which are IPv6 unicast addresses. They can be considered IPv6 equivalents of
the private IPv4 addresses identified in
RFC 1918, Address Allocation for Private Internets, which can’t be
routed globally.
A ULA is globally unique, but not expected to be globally routable. It’s intended for local
communications and to be routable in a limited area such as a site, or among a small
number of sites. Palo Alto Networks doesn’t recommend that you assign ULAs, but a
firewall configured with NPTv6 will translate prefixes sent to it, including
ULAs.
Reasons to Use IPv6
Although there’s no shortage of public, globally routable IPv6 addresses, there are reasons you
might want to translate IPv6 addresses. It’s important to understand that NPTv6
doesn’t provide security. In general, stateless network address translation doesn’t
provide any security; it provides an address translation function. NPTv6 doesn’t
hide or translate port numbers. Set up firewall Security policies correctly in each
direction to ensure that traffic is controlled as you intended.
Prevents asymmetrical routing—Asymmetric routing can occur if a Provider Independent
address space (/48, for example) is advertised by multiple data centers to
the global internet. By using NPTv6, you can advertise more specific routes
from regional firewalls, and the return traffic will arrive at the same
firewall where the source IP address was translated by the translator.
Provides address independence—You need not change the IPv6 prefixes used inside your local
network if the global prefixes are changed (for example, by an ISP or as a
result of merging organizations). Conversely, you can change the inside
addresses at will without disrupting the addresses that are used to access
services in the private network from the internet. In either case, you
update a NAT rule rather than reassign network addresses.
Translates ULAs for routing—You can have
Unique Local Addresses assigned within your private network,
and have the firewall translate them to globally routable addresses.
Thus, you have the convenience of private addressing and the functionality
of translated, routable addresses.
Reduces explore to IPv6 prefixes—IPv6 prefixes are less exposed than if you didn’t
translate network prefixes, however, NPTv6 isn’t a security measure. The
interface identifier portion of each IPv6 address isn’t translated; it
remains the same on each side of the firewall and visible to anyone who can
see the packet header. Additionally, the prefixes aren’t secure; they can be
determined by others.
