Configuring 464XLAT Provider-Side Translator for IPv4 Connectivity Across IPv6-Only Network for Next Gen Services
Configuring the Source Pool for 464XLAT
To configure the source pool for 464XLAT:
- Create a source NAT pool that is used to translate source
IPv6 addresses to source public IPv4 addresses on PLAT.
user@host# edit services nat source pool nat-pool-name
- Define the addresses or subnets to which source addresses
are translated.
[edit services nat source pool nat-pool-name] user@host# set address address-prefix
- If you want to allocate a block of ports for each subscriber
to use, configure port-block allocation:
- Configure the number of ports in a block. The range is
1 through 64,512 and the default is 128.
[edit services nat source pool nat-pool-name port] user@host# set block-allocation block-size block-size
- Configure the interval, in seconds, for which the block
is active. After the timeout, a new block is allocated, even if ports
are available in the active block. If you set the timeout to 0, port
blocks are filled completely before a new port block is allocated,
and the last port block remains active indefinitely. The range is
0 through 86,400, and the default is 0.
[edit services nat source pool nat-pool-name port block-allocation] user@host# set active-block-timeout timeout-interval
- Specify the timeout period for address-pooling paired
mappings that use the NAT pool. The range is 120 through 86,400 seconds,
and the default is 300. Mappings that are inactive for this amount
of time are dropped.
[edit services nat source pool nat-pool-name] user@host# set mapping-timeout mapping-timeout
If you do not configure
ei-mapping-timeoutfor endpoint independent translations, then themapping-timeoutvalue is used for endpoint independent translations. - Configure the maximum number of blocks that can be allocated
to a user address. The range is 1 through 512, and the default is
8.
[edit services nat source pool nat-pool-name port block-allocation] user@host# set maximum-blocks-per-host maximum-block-number
- Specify how often to send interim system logs for active
port blocks and for inactive port blocks with live sessions. This
increases the reliability of system logs, which are UDP-based and
can get lost in the network. The range is 1800 through 86,400 seconds,
and the default is 0 (interim logs are disabled).
[edit services nat source pool nat-pool-name port block-allocation] user@host# set interim-logging-interval timeout-interval
- Configure the number of ports in a block. The range is
1 through 64,512 and the default is 128.
- Specify the timeout period for endpoint independent translations
that use the specified NAT pool. Mappings that are inactive for this
amount of time are dropped. The range is 120 through 86,400 seconds.
If you do not configure
ei-mapping-timeout, then themapping-timeoutvalue is used for endpoint independent translations.[edit services nat source pool nat-pool-name] user@host# set ei-mapping-timeout ei-mapping-timeout
- Specify the timeout period for address-pooling paired
mappings that use the NAT pool. The range is 120 through 86,400 seconds,
and the default is 300. Mappings that are inactive for this amount
of time are dropped.
[edit services nat source pool nat-pool-name] user@host# set mapping-timeout mapping-timeout
If you do not configure
ei-mapping-timeoutfor endpoint independent translations, then themapping-timeoutvalue is used for endpoint independent translations.
Configuring the NAT Rules for 464XLAT
For 464XLAT, you must configure a source rule and a destination rule. To configure the NAT rules for 464XLAT:
- Configure the source NAT rule name.
[edit services nat source] user@host# set rule-set rule-set-name rule rule-name
- Specify the traffic direction to which the NAT rule set
applies.
[edit services nat source rule-set rule-set-name] user@host# set match-direction (in | out | in-out)
- Specify the CLAT IPv6 source prefix.
[edit services nat source rule-set rule-set-name rule rule-name] user@host# set then source-nat clat-prefix clat-prefix
- Configure the IPv6 source address prefix to match. This
is the IPv4 source address embedded in IPv6 by using the CLAT prefix.
[edit services nat source rule-set rule-set-name rule rule-name] user@host# set match source-address address
- Specify the NAT source pool that the PLAT uses for converting
the IPv6 source address to a public IPv4 address.
[edit services nat source rule-set rule-set-name rule rule-name] user@host# set then source-nat pool nat-pool-name
- If you want to ensure that the same external address and
port are assigned to all connections from a given host, configure
endpoint-independent mapping:
- Configure the mapping type as endpoint independent.
[edit services nat source rule-set rule-set-name rule rule-name then source-nat] user@host# set mapping-type endpoint-independent
- Specify prefix lists that contain the hosts that are allowed
to establish inbound connections using the endpoint-independent mapping.
(Prefix lists are configured at the
[edit policy-options]hierarchy level.)[edit services nat source rule-set rule-set-name rule rule-name then source-nat] user@host# set filtering-type endpoint-independent prefix-list [allowed-host] except [denied-host]
- Specify the maximum number of inbound flows allowed simultaneously
on an endpoint-independent mapping.
[edit services nat source rule-set rule-set-name rule rule-name then source-nat] user@host# set secure-nat-mapping eif-flow-limit number-of-flows
- Specify the direction in which active endpoint-independent
mapping is refreshed. By default, mapping is refreshed for both inbound
and outbound active flows.
[edit services nat source rule-set rule-set-name rule rule-name then source-nat] user@host# set secure-nat-mapping mapping-refresh (inbound | inbound-outbound | outbound)
- Configure the address-pooling
paired feature if you want to ensure assignment of the same external
IP address for all sessions originating from the same internal host.
[edit services nat source rule-set rule-set-name rule rule-name then source-nat mapping-type] user@host# set address-pooling-paired
- Specify the timeout period for
address-pooling-pairedmappings that use the NAT pool. The range is 120 through 86,400 seconds, and the default is 300. Mappings that are inactive for this amount of time are dropped.[edit services nat source pool nat-pool-name] user@host# set mapping-timeout mapping-timeout
If you do not configure
ei-mapping-timeoutfor endpoint independent translations, then themapping-timeoutvalue is used for endpoint independent translations. - Configure the generation of a syslog when traffic matches
the NAT rule conditions.
[edit services nat source rule-set rule-set-name rule rule-name then] user@host# set syslog
- Configure the mapping type as endpoint independent.
- Configure the destination NAT rule name.
[edit services nat destination] user@host# set rule-set rule-set-name rule rule-name
- Specify the traffic direction to which the destination
NAT rule set applies.
[edit services nat destination rule-set rule-set-name] user@host# set match-direction (in | out | in-out)
- Configure the IPv6 source address prefix to match. Use
the same value that you used for the NAT source rule.
[edit services nat destination rule-set rule-set-name rule rule-name] user@host# set match source-address address
- Configure the PLAT destination IPv6 prefix.
[edit services nat destination rule-set rule-set-name rule rule-name] user@host# set then destination-nat destination-prefix address
- Configure the IPv6 destination address to match. This
is the IPv4 destination address embedded in IPv6 by using the PLAT
destination prefix.
[edit services nat destination rule-set rule-set-name rule rule-name] user@host# set match destination-address address
Configuring the Service Set for 464XLAT
To configure the service set for 464XLAT:
- Define the service set.
[edit services] user@host# edit service-set service-set-name
- Configure either an interface service, which requires
a single service interface, or a next-hop service, which requires
an inside and outside service interface.
[edit services service-set service-set-name] user@host# set interface-service service-interface interface-name
or
[edit services service-set service-set-name] user@host# set next-hop-service inside-service-interface interface-name outside-service-interface interface-name
- Specify the NAT rule sets to be used with the service
set.
[edit services service-set service-set-name] user@host# set nat-rule-sets rule-set-name
Clearing the Don’t Fragment Bit
Specify that the don’t fragment (DF) bit for IPv4 packet headers is cleared when the packet length is less than 1280 bytes.
[edit services nat natv6v4] user@host# set clear-dont-fragment-bit
This prevents unnecessary creation of an IPv6 fragmentation header when translating IPv4 packets that are less than 1280 bytes.