Skip to main content
vrajendran
Staff
vrajendran
Staff
June 10, 2015

Technical Tip: How to set up Internet access with NAT64 and DNS64

  • June 10, 2015
  • 0 replies
  • 14451 views
Description This article describes how to setup Internet access with NAT64 and DNS64.
NAT64 must be used in conjunction with DNS64 in order to translate IPv4 records (A) to IPv6 records (AAAA).
Scope FortiGate.
Solution
Diagram

IPV6-Network diagram.png

 



CLI Configuration (only relevant parts):
  1. Interfaces.
config system interface
    edit "port1"
        set vdom "root"
        set ip 10.9.11.81 255.255.240.0
        set allowaccess ping https ssh http telnet
        set type physical
        set snmp-index 1
    next    
    edit "port4"
        set vdom "root"
        set allowaccess ping https
        set type physical
        set alias "LAN"
        set snmp-index 4
    config ipv6
        set ip6-address 2001:db8::1/64
        set ip6-allowaccess ping
        set ip6-send-adv enable
        set ip6-manage-flag enable
        set ip6-other-flag enable
        end
    next
end
 
  1. Enable DNS64 globally (note that the default prefix for DNS64 is 64:ff9b::/96).
 

config system dns64

    set status enable

    set dns64-prefix 64:ff9b::/96

    set always-synthesize-aaaa-record enable

end
  1. Enable recursive DNS server on FortiGate for DNS64 feature (A to AAAA record translation).

config system dns-server
    edit "port4"
        set mode forward-only
    next
end
 
  1. Create IPv4 Pool for outgoing IPv4 translation.
Note: This must be different from the public IP but in the same subnet, otherwise it will cause connectivity issue as explained in this article.
 
config firewall ippool
       edit "IPpool"
          set startip 10.9.11.80 <- Different from WAN IP address.
          set endip 10.9.11.80
          set nat64 enable
      next
end
  1. Create a VIP6.
 
config firewall vip6
    edit "IPv6"
      set extip 64:ff9b::-64:ff9b::ffff:ffff  <- This must be exactly the same.
      set nat66 disable
      set nat64 enable
      set embedded-ipv4-address enable
    next
end
  1. Create the firewall policy.
 
config firewall policy
    edit 1
        set name "LAN6_to_WAN4"
        set srcintf "port4"
        set dstintf "port1"
        set action accept
        set nat64 enable
        set srcaddr "all"
        set dstaddr "all"
        set srcaddr6 "all"
        set dstaddr6 "IPv6"
        set schedule "always"
        set service "ALL"
        set ippool enable
        set poolname "IPpool"
    next
end
 
Configuration on the client:
 
It is important that the DNS server on the client is the FortiGate Interface IP address because FortiGate intercepts the DNS query and it translates the AAAA record to A record and vice-versa, using DNS-Proxy. In the example, the DNS server is the FortiGate interface IP as shown below. 
 
DNS-Ipv6.png

 

Verification:

From the host, initiate a ping to a public website such as google.com for testing.

ping6.PNG
Run a sniffer on the FortiGate to confirm the address translation.

sniffer6.PNG
Related article: 
    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.