Configure NAT64 for IPv6-Initiated Communication

1. Enable IPv6 to operate on the firewall.

   1. Select DeviceSetupSession and edit the Session Settings.
   2. Select Enable IPv6 Firewalling.
   3. Click OK.
2. Configure the interface with IPv6 addressing.

   1. Select NetworkInterfaces and select the interface that performs NAT.
   2. Select the IPv6 tab.
   3. Select Enable IPv6 address on interface.
   4. Add your private IPv6 prefix.
   5. Add the well-known prefix 64:ff9b::/96.
   6. Click OK.

3. Create an address object for the IPv6 destination address (pre-translation).

   1. Select ObjectsAddresses and click Add.
   2. Enter a Name for the object, for example, nat64-IPv4 Server.
   3. For Type, select IP Netmask and enter the IPv6 prefix with a netmask that is compliant with RFC 6052 (/32, /40, /48, /56, /64, or /96). This is either the Well-Known Prefix or your Network-Specific Prefix that is configured on the DNS64 Server.

      For this example, enter 64:FF9B::/96.

      The source and destination must have the same netmask (prefix length).

      (You don’t enter a full destination address because, based on the prefix length, the firewall extracts the encoded IPv4 address from the original destination IPv6 address in the incoming packet. In this example, the prefix in the incoming packet is encoded with C633:6401 in hexadecimal, which is the IPv4 destination address 198.51.100.1.)
   4. Click OK.
4. (Optional) Create an address object for the IPv6 source address (pre-translation).

   1. Select ObjectsAddresses and click Add.
   2. Enter a Name for the object.
   3. For Type, select IP Netmask and enter the address of the IPv6 host, in this example, 2001:DB8::5/96.
   4. Click OK.
5. (Optional) Create an address object for the IPv4 source address (translated).

   1. Select ObjectsAddresses and click Add.
   2. Enter a Name for the object.
   3. For Type, select IP Netmask and enter the IPv4 address of the firewall’s egress interface, in this example, 192.0.2.1.
   4. Click OK.
6. Create the NAT64 rule.

   1. Select PoliciesNAT and click Add.
   2. On the General tab, enter a Name for the NAT64 rule, for example, nat64_ipv6_init.
   3. (Optional) Enter a Description.
   4. For NAT Type, select nat64.
7. Specify the original source and destination information.

   1. For the Original Packet, Add the Source Zone, likely a trusted zone.
   2. Select the Destination Zone, in this example, the Untrust zone.
   3. (Optional) Select a Destination Interface or the default (any).
   4. For Source Address, select Anyor Add the address object you created for the IPv6 host.
   5. For Destination Address, Add the address object you created for the IPv6 destination address, in this example, nat64-IPv4 Server.
   6. (Optional) For Service, select any.
8. Specify the translated packet information.

   1. For the Translated Packet, in Source Address Translation, for regular DIPP, for Translation Type, select Dynamic IP and Port. For persistent DIPP in PAN-OS 11.0 and earlier releases, select Dynamic IP and Port. For persistent DIPP in releases after PAN-OS 11.0, select Persistent Dynamic IP and Port.

   2. For Address Type, do one of the following:

      • Select Translated Address and Add the address object you created for the IPv4 source address.
      • Select Interface Address, in which case the translated source address is the IP address and netmask of the firewall’s egress interface. For this choice, select an Interface and optionally an IP Address if the interface has more than one IP address.
   3. Leave Destination Address Translation unselected. (The firewall extracts the IPv4 address from the IPv6 prefix in the incoming packet, based on the prefix length specified in the original destination of the NAT64 rule.)
   4. Click OK to save the NAT64 policy rule.
9. Configure a tunnel interface to emulate a loopback interface with a netmask other than 128.

   1. Select NetworkInterfacesTunnel and Add a tunnel.
   2. For Interface Name, enter a numeric suffix, such as .2.
   3. On the Config tab, select the Virtual Router where you are configuring NAT64.
   4. For Security Zone, select the destination zone associated with the IPv4 server destination (Untrust zone).
   5. On the IPv6 tab, select Enable IPv6 on the interface.
   6. Click Add and for the Address, select New Address.
   7. Enter a Name for the address.
   8. (Optional) Enter a Description for the tunnel address.
   9. For Type, select IP Netmask and enter your IPv6 prefix and prefix length, in this example, 64:FF9B::/96.
   10. Click OK.
   11. Select Enable address on interface and click OK.
   12. Click OK.
   13. Click OK to save the tunnel.
10. Create a security policy to allow NAT traffic from the trust zone.

    1. Select PoliciesSecurity and Add a rule Name.
    2. Select Source and Add a Source Zone; select Trust.
    3. For Source Address, select Any.
    4. Select Destination and Add a Destination Zone; select Untrust.
    5. For Application, select Any.
    6. For Actions, select Allow.
    7. Click OK.
11. Commit your changes.

    Click Commit.
12. (To enable persistent DIPP in PAN-OS 11.1.0 and earlier releases only) Enable persistent NAT for DIPP.

    1. Access the CLI.
    2. >set system setting persistent-dipp enable yes
    3. >request restart system
    4. If you have HA configured, repeat this step on the other HA peer.
13. Troubleshoot or view a NAT64 session.

    > show session id <session-id>