>
    Strata Copilot
    Deployments Supported
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma SD-WAN
    3. NAT Protocol Translation for IPv6 Address
    4. Deployments Supported
    Download PDF
    Prisma SD-WAN

    Deployments Supported

    Table of Contents

    Deployments Supported

    Learn about the different deployment scenarios supported by NAT Protocol Translations.
    The system supports the following deployments for traffic flows, addressing different client, operator, and server IP address family (AF) combinations.

    LAN-to-WAN Flows

    Supported Deployments
    ClientOperator AFServer AFBehavior
    IPv4 ClientIPv4 Operator AFIPv4 Server AFDirect communication is supported.
    IPv4 ClientIPv6 Operator AFIPv4 Server AFThis is a 464 use case. The ION encodes the IPv4 address using the Well Known Prefix (64:ff9b::/96). The NAT box strips the prefix and forwards the IPv4 packet.
    IPv4 ClientIPv4 Operator AFIPv6 Server AFTransparent to the ION device; the operator is responsible for an IPv4 equivalent address for the IPv6 server.
    IPv4 ClientIPv6 Operator AFIPv6 Server AFThe ION employs the Well Known Prefix (64:ff9b::/96) for IPv4 address encoding. The ION converts the IPv4 destination to an IPv6 encoded IP for routing.
    IPv6 ClientIPv4 Operator AFIPv4 Server AFDNS64 is utilized. When the operator provides DNS64, it responds with an IPv6 address containing the 64:ff9b::/96 prefix. The ION strips the prefix and sends the IPv4 packet.
    IPv6 ClientIPv6 Operator AFIPv4 Server AFThis scenario is transparent to ION; the operator needs an IPv4-mapped IPv6 address.
    IPv6 ClientIPv4 Operator AFIPv6 Server AFPackets are dropped.
    IPv6 ClientIPv6 Operator AFIPv6 Server AFNAT66 is supported using 6wind.
    Dual-stack ClientIPv4 Operator AFIPv4 Server AFThe client uses its IPv4 address for the connection.
    Dual-stack ClientIPv6 Operator AFIPv6 Server AFThe client uses its IPv6 address for the connection.
    IPv4 ClientIPv6 Operator AFDual-stack Server AFThe ION uses the Well Known Prefix (64:ff9b::/96) for IPv4 address encoding. The system handles DNS and address mapping to send packets to the dual-stack server.
    IPv6 ClientIPv4 Operator AFDual-stack Server AFThis requires DNS interception and will be supported in releases beyond 6.4.2. The system maps the IPv6 AAAA record to an IPv4 A record for the client.

    © 2025 Palo Alto Networks, Inc. All rights reserved.