FortiGate NAT64 internal Subnet

 Problem

Sometimes it is not necessary to convert the complete internal or external IPv6 traffic to IPv4. What must be done if only individual IP addresses are translated?

Solution

For translating individual IPv6 from IPv4, the configuration is very similar to when all IP is to be translated.

In detail the following configuration is necessary:

config system nat64
    set always-synthesize-aaaa-record disable
end

• always-synthesize-aaaa-record: the DNS proxy does not check for AAAA records but rather synthesizes AAAA records.

We need a virtual IPv6 address from the DMZ2 Range. With that we are able to define the Virtual-IP object.

config firewall vip64
    edit "nat64_Server"
        set extip 2001:db8:211:5c:4000::2
        set mappedip 172.16.51.12
        set portforward enable
        set extport 443
        set mappedport 443
    next
end

• extip: The virtual IPv6 address
• mappedip: the real IPv4 address

As usual by FortiGate, at the end we need a firewall policy to allow the traffic:

config firewall policy64
    edit 1
        set name "DMZ2 to Server"
        set srcintf "DMZ"
        set dstintf "lan1"
        set srcaddr "all"
        set dstaddr "nat64_Server"
        set action accept
        set schedule "always"
        set service "ALL_ICMP" "HTTPS"
        set logtraffic enable
    next
end

• dstaddr: use the predefined Virtual-IP object

DNS Server

The IPv6 address is very hard to remember and cannot be entered easily in most browsers.

To test the functionality, I created a DNS server on the FortiGate, which resolves a URL to the virtual IPv6.

The following settings are necessary for this:

Enable the DNS Server on the DMZ2 (the IPv6 Subnet Interface).

config system dns-server
    edit "DMZ2"
    next
end

As next, we have to configure the DNS Zone:

config system dns-database
    edit "lab.com"
        set domain "lab.com"
        set view shadow
        config dns-entry
            edit 1
                set type AAAA
                set hostname "server"
                set ipv6 2001:db8:211:5c:4000::2
            next
            edit 2
                set hostname "server"
                set ip 172.16.51.12
            next
        end
    next
end

• view: define as shadow otherwise the zone is not resolvable in recursive port setting.
• domain: Define the Domainname in your LAB 
• type: AAAA is the A-Record in the IPv6 world
• ipv6: the virtual-IP as we define earlier
• ip: the real IPv4 of the server (needed to resolve the hostname in other subnet)

Verify

; <<>> DiG 9.16.15-Ubuntu <<>> AAAA server.lab.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37453
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;fac.hq.shadow.lab.		IN	AAAA

;; ANSWER SECTION:
fac.hq.shadow.lab.	6956	IN	AAAA	2001:db8:211:6c:4000::2

;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Di Dez 21 22:11:06 CET 2021
;; MSG SIZE  rcvd: 74