Create an NPTv6 Policy

Create a new NPTv6 policy.
Select
Policies
NAT
and click
Add
.
On the
General
tab, enter a descriptive
Name
for the NPTv6 policy rule.
(
Optional
) Enter a
Description
and
Tag
.
For
NAT Type
, select
NPTv6
.
Specify the match criteria for incoming packets; packets that match all of the criteria are subject to the NPTv6 translation.
Zones are required for both types of translation.
On the
Original Packet
tab, for
Source Zone
, leave
Any
or
Add
the source zone to which the policy applies.
Enter the
Destination Zone
to which the policy applies.
(
Optional
) Select a
Destination Interface
.
(
Optional
) Select a
Service
to restrict what type of packets are translated.
If you are doing source translation, enter a
Source Address
or select
Any
. The address could be an address object. The following constraints apply to
Source Address
and
Destination Address
:
Prefixes of
Source Address
and
Destination Address
for the
Original Packet
and
Translated Packet
must be in the format xxxx:xxxx::/yy, although leading zeros in the prefix can be dropped.
The IPv6 address cannot have an interface identifier (host) portion defined.
The range of supported prefix lengths is /32 to /64.
The
Source Address
and
Destination Address
cannot both be set to
Any
.
If you are doing source translation, you can optionally enter a
Destination Address
. If you are doing destination translation, the
Destination Address
is required. The destination address (an address object is allowed) must be a netmask, not just an IPv6 address and not a range. The prefix length must be a value from /32 to /64, inclusive. For example, 2001:db8::/32.
Specify the translated packet.
On the
Translated Packet
tab, if you want to do source translation, in the Source Address Translation section, for
Translation Type
, select
Static IP
. If you do not want to do source translation, select
None
.
If you chose
Static IP
, the
Translated Address
field appears. Enter the translated IPv6 prefix or address object. See the constraints listed in the prior step.
It is a best practice to configure your
Translated Address
to be the prefix of the untrust interface address of your firewall. For example, if your untrust interface has the address 2001:1a:1b:1::99/64, make your
Translated Address
2001:1a:1b:1::0/64.
(
Optional
) Select
Bi-directional
if you want the firewall to create a corresponding NPTv6 translation in the opposite direction of the translation you configure.
If you enable
Bi-directional
translation, it is very important to make sure you have Security policy rules in place to control the traffic in both directions. Without such policy rules,
Bi-directional
translation allows packets to be automatically translated in both directions, which you might not want.
If you want to do destination translation, select
Destination Address Translation
. In the
Translated Address
field, choose an address object or enter your internal destination address.
Click
OK
.
Configure NDP Proxy.
When you configure the firewall to act as an NDP Proxy for addresses, it allows the firewall to send Neighbor Discovery (ND) advertisements and respond to ND solicitations from peers that are asking for MAC addresses of IPv6 prefixes assigned to devices behind the firewall.
Select
Network
Interfaces
Ethernet
and select an interface.
On the
Advanced
NDP Proxy
tab, select
Enable NDP Proxy
and click
Add
.
Enter the
IP Address(es)
for which NDP Proxy is enabled. It can be an address, a range of addresses, or a prefix and prefix length. The order of IP addresses does not matter. These addresses are ideally the same as the Translated Addresses that you configured in an NPTv6 policy.
If the address is a subnet, the NDP Proxy will respond to all addresses in the subnet, so you should list the neighbors in that subnet with
Negate
selected, as described in the next step.
(
Optional
) Enter one or more addresses for which you do not want NDP Proxy enabled, and select
Negate
. For example, from an IP address range or prefix range configured in the prior step, you could negate a smaller subset of addresses. It is recommended that you negate the addresses of the neighbors of the firewall.
Commit the configuration.
Click
OK
and
Commit
.