Technical Tip: NAT64 Packet Flow Overview with FortiGate as DNS64 Provider

Diagram for the flow of traffic:

NAT64 communication flow where a FortiGate is providing DNS64 + NAT64 services between an IPv6 client network and an IPv4 server.

1. IPv6 Client Initiates Request (Left Side).

• The client exists in an IPv6-only network. (2001:FD8:220C:1::100)
• Client wants to access a destination using a domain name (server.manila.com).
• Client sends a DNS query to FortiGate (FortiGate V6 Address 2001:fd8:220c:1::1/64)

2. DNS64 Resolution (FortiGate – Middle).

• FortiGate DNS64 queries the real DNS server.
• If the destination is IPv4-only (A record only):
  • DNS64 synthesizes a fake AAAA record.
  • This AAAA contains:
    • NAT64 prefix (ex: 64:ff9b::/96). In this case, it was given a synthesized AAA value of 64:ff9b::a2f:22c.
    • Embedded IPv4 address of server. (where 0a:2f:02:2c is equal to 10.47.2.44).

The following is the NATed traffic on the port 80 request towards the v4 server:

The IPv6 session list appears as follows:

Configuration:

DNS64 in FortiGate:

VIP6 configuration for the IPv6 prefix. 

Firewall Policy: