Article Detail

Description

This article describes how to configure communication (NAT46) from an IPv4 host to an IPv6 host on SRX devices by using an example.

Symptoms

Topology

alt

The above setup sends a ping from the IPv4 host port ixia 6/10 to IPv6 host port 6/15.

SRX240H-r015 is a transient Internet router in this setup.

Solution

SRX1 (SRX240H-r004)

labroot@SRX240# show interfaces 
ge-0/0/1 {
    unit 0 {
        family inet {
            address 20.20.20.1/24;
        }
    }
}
ge-0/0/2 {
    unit 0 {
        family inet {
            address 10.10.10.2/24;
        }
    }
}
ge-0/0/3 {
    unit 0 {
        family inet {
            address 192.168.0.1/24;
        }
    }
}

Internet (SRX240H-r015)

labroot@s14-37# show interfaces 
ge-0/0/1 {
    unit 0 {
        family inet {
            address 20.20.20.2/24;
        }
    }
}
ge-0/0/2 {
    unit 0 {
        family inet {
            address 30.30.30.1/24;
        }
    }
}

SRX2 (SRX240H-r016)

labroot@s07-45# show interfaces 
ge-0/0/1 {
    unit 0 {
        family inet {
            address 40.40.40.2/24;
        }
        family inet6 {
            address 2001:aad8::2/64;
        }
    }
}
ge-0/0/2 {
    unit 0 {
        family inet {
            address 30.30.30.2/24;
        }
    }
}

For pinging from the host1 IPv4 address to the host2 IPv6 address, we need a fictitious IP address on the same subnet as the ingress interface (ge-0/0/2) on SRX2 because the IPv4 host cannot directly ping the IPv6 address. In this example, we consider 30.30.30.3 as the fictitious IPv4 destination address that is to be pinged from host1.

On SRX2 (SRX240H-r016), the following configurations are needed for the ping to work:

Configure proxy-arp because we are configuring a fictitious IP address:

labroot@s07-45#set security nat proxy-arp interface ge-0/0/2.0 address 30.30.30.3/32

Configure static NAT to change the destination IP address to IPv6:

labroot@s07-45# set security nat static rule-set nat46 from zone test
labroot@s07-45# set security nat static rule-set nat46 rule 1 match source-address 10.10.10.1/32
labroot@s07-45# set security nat static rule-set nat46 rule 1 match destination-address 30.30.30.3/32
labroot@s07-45# set security nat static rule-set nat46 rule 1 then static-nat prefix 2001:aad8::1/128

The destination IP address is now changed to IPv6.

Now the source address must also be changed to IPv6. There are two ways to do this:

Create a source NAT by using the source NAT pool:

labroot@s07-45# set security nat proxy-ndp interface ge-0/0/1.0 address 2001:aad8::3/128
labroot@s07-45# set security nat source pool nat46 address 2001:aad8::3/128
labroot@s07-45# set security nat source rule-set nat46 from zone test
labroot@s07-45# set security nat source rule-set nat46 to zone trust
labroot@s07-45# set security nat source rule-set nat46 rule nat46 match source-address 10.10.10.1/32
labroot@s07-45# set security nat source rule-set nat46 rule nat46 match destination-address 2001:aad8::1/128
labroot@s07-45# set security nat source rule-set nat46 rule nat46 then source-nat pool nat46

Create a source NAT by using the source NAT interface:

labroot@s07-45# set security nat source rule-set nat46 from zone test
labroot@s07-45# set security nat source rule-set nat46 to zone trust
labroot@s07-45# set security nat source rule-set nat46 rule nat46 match source-address 10.10.10.1/32
labroot@s07-45# set security nat source rule-set nat46 rule nat46 match destination-address 2001:aad8::1/128
labroot@s07-45# set security nat source rule-set nat46 rule nat46 then source-nat interface

Verification

Flow session on SRX1 (SRX240H-r004)

root@s14-36# run ping 30.30.30.3 
PING 30.30.30.3 (30.30.30.3): 56 data bytes
64 bytes from 30.30.30.3: icmp_seq=1 ttl=61 time=8.781 ms
64 bytes from 30.30.30.3: icmp_seq=2 ttl=61 time=8.260 ms
64 bytes from 30.30.30.3: icmp_seq=3 ttl=61 time=7.438 ms
64 bytes from 30.30.30.3: icmp_seq=4 ttl=61 time=8.317 ms
64 bytes from 30.30.30.3: icmp_seq=5 ttl=61 time=6.789 ms
64 bytes from 30.30.30.3: icmp_seq=6 ttl=61 time=6.746 ms

root@s14-36# run show security flow session destination-prefix 30.30.30.3

Session ID: 2814, Policy name: default-policy-logical-system-00/2, Timeout: 2, Valid
  In: 10.10.10.1/5 --> 30.30.30.3/17375;icmp, If: ge-0/0/2.0, Pkts: 1, Bytes: 84
  Out: 30.30.30.3/17375 --> 10.10.10.1/5;icmp, If: ge-0/0/1.0, Pkts: 1, Bytes: 84

Flow session on SRX2 (SRX240H-r016):

labroot@s07-45# run show security flow session destination-prefix 30.30.30.3 

Session ID: 2523, Policy name: default-policy-00/2, Timeout: 2, Valid
  In: 10.10.10.1/55 --> 30.30.30.3/17375;icmp, If: ge-0/0/2.0, Pkts: 1, Bytes: 84
  Out: 2001:aad8::1/17375 --> 2001:aad8::3/27349;icmp6, If: ge-0/0/1.0, Pkts: 1, Bytes: 104