FortiGate NAT64 for IPv4 Internet Access

 Problem

In this scenario, IPv6 is already used internally. So that the whole Internet is available - also websites without IPv6 address.

Solution

A NAT64 - translation from IPv6 to IPv4 - is performed on the FortiGate unit. We assume that the IPv6 configuration has already been done (otherwise check the following post:asdf).

Thus, we focus on the NAT64 configuration and look at it in more detail.

The idea

All IPv6 addresses from the DMZ2 Network (2001:db8:211:5c:4000::/64) subnet will be translated to the 195.157.52.0/24 IPv4 Subnet.

For this the following configuration is needed:

config system settings
    set gui-nat46-64 enable
end

• gui-nat-46-64: enable the GUI features for NAT64 and NAT64 feature

Next, we need a IP-Pool object. This defines the actual translation as we know it from a classic virtual-IP object.

config firewall ippool
    edit exit-pool4
        set startip 195.157.52.25
        set endip 195.157.52.200
    next
end

HINT: You can also use just one IP-address in the Pool.

As usual with the FortiGate we need a firewall policy to allow the traffic.

config firewall address6
    edit internal-net6
        set ip6 2001:db8:211:5c:4000::/64
    next
end
config firewall policy64
    edit 0
        set srcintf DMZ2
        set srcaddr internal-net6
        set dstintf wan1
        set dstaddr all
        set action accept
        set schedule always
        set service ALL
        set ippool enable
        set poolname exit-pool4
    next
end

• ippool: enable the NAT with an ip-pool object
• poolname: define the ip-pool object

The last thing to do is to enable the global NAT64 feature. With this, every DNS AAAA request is intercepted by the FortiGate DNS proxy and the client is given an IP address from the nat64 prefix range.

Thus, the client sends the IPv6 traffic to the firewall, which performs a NAT to an IPv4 address and sends it to the Internet.

config system nat64
    set status enable
    set nat64-prefix 64:ff9b::/96
    set always-synthesize-aaaa-record enable
end

• status: enable the nat64 feature
• nat64-prefix: define the nat64 internal prefix, which range should use to intercepted DNS Requests (default is: 64:ff9b::/96)
• always-synthesize-aaaa-record: the DNS proxy does not check for AAAA records but rather synthesizes AAAA records.

Verify