Configuring Dynamic NAT64 Mapping

Procedure

1. Access the system view.

   system-view

2. Access the interface view.

   interface interface-type { interface-number | interface-number.subinterface-number }

   The interface in this command is the interface that connects the FW to the IPv6 network.

3. Enable the NAT64 function on the interface.

   nat64 enable

4. Return to the system view.

   quit

5. Configure a NAT address pool. NAT64 translates a source IPv6 address into a source IPv4 address listed in the specified address pool. If NAT64 based on easy IP is used, skip this step because there is no need to configure a NAT address pool.
   1. Access the NAT address pool view.

      nat address-group group-name [ group-number ]

   2. Set an address pool mode. The address pool mode varies with the Source NAT type.

      mode { pat | full-cone { global | local } [ no-reverse ] }

   3. Set IP address ranges.

      section [ id ] start-ipv4 [ end-ipv4 ]

6. Create a NAT policy and access the NAT policy view.

   nat-policy

7. Create a NAT rule and access the NAT rule view.

   rule name rule_name

8. Set the NAT policy type to NAT64.

   nat-type nat64

9. Configure NAT64 matching rules.

   By default, all matching rules are "any." Only traffic that meets all configured rules can match the NAT64 policy.

   Table 1 NAT64 matching rules

   Action	Command
   Specify a source IPv6 address.	source-address { address-set address-set-name &<1-6> | ipv4-address [ ipv4-mask-length | mask mask-address ] | ipv6-address ipv6-prefix-length | range { ipv4-start-address ipv4-end-address | ipv6-start-address ipv6-end-address } | mac-address &<1-6> | any }
   Specify a destination IPv6 address.	destination-address { address-set address-set-name &<1-6> | ipv4-address [ ipv4-mask-length | mask mask-address ] | ipv6-address ipv6-prefix-length | range { ipv4-start-address ipv4-end-address | ipv6-start-address ipv6-end-address } | mac-address &<1-6> | any }
   Specify the source security zone to which an IPv6 intranet belongs.	source-zone { zone-name &<1-6> | any }
   Specify the destination security zone to which an IPv4 network belongs.	destination-zone zone-name
   Specify the type of service (ToS). The ToS field is carried in an IP header and describes the service type of a packet.	service { service-name &<1-6> | any }

10. Perform either of the following operations to specify a NAT64 translation mode:

    • To enable NAT64 translation in address pool mode, run:

      action source-nat address-group address-group-name

    • To enable NAT64 translation in easy IP mode, run:

      action source-nat easy-ip

11. Return to the NAT policy view.

    quit

12. Return to the system view.

    quit

13. (Optional) Enable Endpoint-independent filtering.

    firewall endpoint-independent filter enable

    After the function is enabled, packets from IPv4 users to IPv6 users can match the destination server-map table. The FW performs NAT based on the destination server-map table and directly forwards the packets without querying security policies. If the function is disabled, the device applies the interzone packet filtering rules to filter the packets that pass the device.