Create an NPTv6 Policy
Perform this task when you want to configure a NAT NPTv6 policy to translate one IPv6 prefix to another IPv6 prefix. The prerequisites for this task are:
- Enable IPv6. Select. ClickDeviceSetupSessionEditand selectIPv6 Firewalling.
- Configure a Layer 3 Ethernet interface with a valid IPv6 address and with IPv6 enabled. Select, select an interface, and on theNetworkInterfacesEthernetIPv6tab, selectEnable IPv6 on the interface.
- Create network security policies, because NPTv6 does not provide security.
- Decide whether you want source translation, destination translation, or both.
- Identify the zones to which you want to apply the NPTv6 policy.
- Identify your original and translated IPv6 prefixes.
- Create a new NPTv6 policy.
- Selectand clickPoliciesNATAdd.
- On theGeneraltab, enter a descriptiveNamefor the NPTv6 policy rule.
- (Optional) Enter aDescriptionandTag.
- ForNAT Type, selectNPTv6.
- Specify the match criteria for incoming packets; packets that match all of the criteria are subject to the NPTv6 translation.Zones are required for both types of translation.
- On theOriginal Packettab, forSource Zone, leaveAnyorAddthe source zone to which the policy applies.
- Enter theDestination Zoneto which the policy applies.
- (Optional) Select aDestination Interface.
- (Optional) Select aServiceto restrict what type of packets are translated.
- If you are doing source translation, enter aSource Addressor selectAny. The address could be an address object. The following constraints apply toSource AddressandDestination Address:
- Prefixes ofSource AddressandDestination Addressfor theOriginal PacketandTranslated Packetmust be in the format xxxx:xxxx::/yy, although leading zeros in the prefix can be dropped.
- The IPv6 address cannot have an interface identifier (host) portion defined.
- The range of supported prefix lengths is /32 to /64.
- TheSource AddressandDestination Addresscannot both be set toAny.
- If you are doing source translation, you can optionally enter aDestination Address. If you are doing destination translation, theDestination Addressis required. The destination address (an address object is allowed) must be a netmask, not just an IPv6 address and not a range. The prefix length must be a value from /32 to /64, inclusive. For example, 2001:db8::/32.
- Specify the translated packet.
- On theTranslated Packettab, if you want to do source translation, in the Source Address Translation section, forTranslation Type, selectStatic IP. If you do not want to do source translation, selectNone.
- If you choseStatic IP, theTranslated Addressfield appears. Enter the translated IPv6 prefix or address object. See the constraints listed in the prior step.It is a best practice to configure yourTranslated Addressto be the prefix of the untrust interface address of your firewall. For example, if your untrust interface has the address 2001:1a:1b:1::99/64, make yourTranslated Address2001:1a:1b:1::0/64.
- (Optional) SelectBi-directionalif you want the firewall to create a corresponding NPTv6 translation in the opposite direction of the translation you configure.If you enableBi-directionaltranslation, it is very important to make sure you have Security policy rules in place to control the traffic in both directions. Without such policy rules,Bi-directionaltranslation allows packets to be automatically translated in both directions, which you might not want.
- If you want to do destination translation, selectDestination Address Translation. In theTranslated Addressfield, choose an address object from the drop-down or enter your internal destination address.
- Configure NDP Proxy.When you configure the firewall to act as an NDP Proxy for addresses, it allows the firewall to send Neighbor Discovery (ND) advertisements and respond to ND solicitations from peers that are asking for MAC addresses of IPv6 prefixes assigned to devices behind the firewall.
- Selectand select an interface.NetworkInterfacesEthernet
- On thetab, selectAdvancedNDP ProxyEnable NDP Proxyand clickAdd.
- Enter theIP Address(es)for which NDP Proxy is enabled. It can be an address, a range of addresses, or a prefix and prefix length. The order of IP addresses does not matter. These addresses are ideally the same as the Translated Addresses that you configured in an NPTv6 policy.If the address is a subnet, the NDP Proxy will respond to all addresses in the subnet, so you should list the neighbors in that subnet withNegateselected, as described in the next step.
- (Optional) Enter one or more addresses for which you do not want NDP Proxy enabled, and selectNegate. For example, from an IP address range or prefix range configured in the prior step, you could negate a smaller subset of addresses. It is recommended that you negate the addresses of the neighbors of the firewall.
- Commit the configuration.ClickOKandCommit.
How NPTv6 Works
How NPTv6 Works When you configure a policy for NPTv6, the Palo Alto Networks firewall performs a static, one-to-one IPv6 translation in both directions. The ...
NAT Translated Packet Tab
NAT Translated Packet Tab Policy > NAT > Translated Packet Select the Translated Packet tab to determine, for Source Address Translation, the type of translation ...
NDP Proxy Neighbor Discovery Protocol (NDP) for IPv6 performs functions similar to those provided by Address Resolution Protocol (ARP) for IPv4. RFC 4861 defines Neighbor ...
The NPTv6 Translation in NPTv6 Example
The NPTv6 Translation in NPTv6 Example In this example, the Original Packet is configured with a Source Address of FDD4:7A3E::0 and a Destination of Any ...
Configure NAT64 for IPv4-Initiated Communication with Port ...
Configure NAT64 for IPv4-Initiated Communication with Port Translation This task builds on the task to Configure NAT64 for IPv4-Initiated Communication , but the organization controlling ...
Configure NAT64 for IPv4-Initiated Communication
Configure NAT64 for IPv4-Initiated Communication IPv4-initiated communication to an IPv6 server is similar to destination NAT in an IPv4 topology. The destination IPv4 address maps ...
NPTv6 and NDP Proxy Example
NPTv6 and NDP Proxy Example The following figure illustrates how NPTv6 and NDP Proxy function together. The ND Cache in NPTv6 Example The NDP Proxy ...
NPTv6 IPv6-to-IPv6 Network Prefix Translation (NPTv6) performs a stateless, static translation of one IPv6 prefix to another IPv6 prefix (port numbers are not changed). There ...
NAT This section describes Network Address Translation (NAT) and how to configure the firewall for NAT. NAT allows you to translate private, non-routable IPv4 addresses ...