NAT64 and DNS64 is not working properly

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 271627

Description

This article describes how to solve the layer 3 connectivity issue when NAT64 and DNS64 are configured.

Scope

FortiOS 7.0.11, 7.0.12, 7.2.5 and 7.4.0.

Solution

When NAT64 and DNS 64 are configured, there must be an IP pool for the policy.

Firewall policy:

If the IP pool external IP range has the same IP address as the FortiGate WAN interface IP, it will cause a connectivity issue.

The reply is not forwarded to the source.

Considering this, the NAT64 does not allow to use the WAN interface IP address as the external IP range for the IP pool. It is imperative to use an available IP address of the public range. For example, the WAN interface IP address is 192.168.1.3, therefore, the IP pool can have an available IP address within that range.

Having done this, Layer 3 connectivity is working.

Output from FortiGate sniffer CLI command.

The request and reply are routed properly.

Note-Do enable arp-reply when using ippool

config firewall ippool
edit "xyz"
set type overload
set startip x.x.x.x
set endip x.x.x.z
set arp-reply enable <-----
end

1023

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Troubleshooting Tip: NAT64 and DNS64 is not working properly

You are leaving our website