NPTv6 Overview
This section describes
IPv6-to-IPv6 Network Prefix Translation (NPTv6)
and how to configure it. NPTv6 is defined in
RFC 6296. Palo Alto Networks
® does
not implement all functionality defined in the RFC, but is compliant
with the RFC in the functionality it has implemented.
NPTv6 performs stateless translation of one IPv6 prefix to another
IPv6 prefix. It is stateless, meaning that it does not keep track
of ports or sessions on the addresses translated. NPTv6 differs
from NAT66, which is stateful. Palo Alto Networks supports
NPTv6 RFC 6296 prefix translation; it
does not support NAT66.
With the limited addresses in the IPv4 space,
NAT was required
to translate private, non-routable IPv4 addresses to one or more
globally-routable IPv4 addresses. For organizations using IPv6 addressing,
there is no need to translate IPv6 addresses to IPv6 addresses due
to the abundance of IPv6 addresses. However, there are
Reasons to Use NPTv6 to translate
IPv6 prefixes at the firewall.
It is important to understand that NPTv6 does not provide
security. It general, stateless network address translation does
not provide any security; it provides an address translation function.
NPTv6 does not hide or translate port numbers. You must set up firewall
security policies correctly in each direction to ensure that traffic
is controlled as you intended.
NPTv6 translates the prefix portion of an IPv6 address but not
the host portion or the application port numbers. The host portion
is simply copied, and therefore remains the same on either side
of the firewall. The host portion also remains visible within the
packet header.
NPTv6 is supported on the following firewall models (NPTv6 with
hardware lookup but packets go through the CPU):
- PA-7000 Series firewalls
- PA-5400 Series firewalls
- PA-5200 Series firewalls
- PA-3200 Series firewalls
- PA-800 firewall
- PA-220 firewall
VM-Series firewalls support NPTv6, but with no ability to have
hardware perform a session lookup.
