NPTv6
Overview
This section describes
IPv6-to-IPv6 Network Prefix Translation (NPTv6)
and how to configure it. NPTv6 is defined in
RFC 6296. Palo Alto Networks does
not implement all functionality defined in the RFC, but is compliant
with the RFC in the functionality it has implemented.
NPTv6 performs stateless translation of one IPv6 prefix to another
IPv6 prefix. It is stateless, meaning that it does not keep track
of ports or sessions on the addresses translated. NPTv6 differs
from NAT66, which is stateful. Palo Alto Networks supports
NPTv6 RFC 6296 prefix translation;
it does not support NAT66.
With the limited addresses in the IPv4 space,
NAT was
required to translate private, non-routable IPv4 addresses to one
or more globally-routable IPv4 addresses.
For organizations using IPv6 addressing, there is no need to
translate IPv6 addresses to IPv6 addresses due to the abundance
of IPv6 addresses. However, there are
Reasons to Use NPTv6 to
translate IPv6 prefixes at the firewall.
NPTv6 translates the prefix portion of an IPv6 address but not
the host portion or the application port numbers. The host portion
is simply copied, and therefore remains the same on either side
of the firewall. The host portion also remains visible within the
packet header.
