NAT66, NAT46, NAT64, and DNS64

NAT66, NAT46, NAT64, and DNS64 each offer their own distinct strategies and solutions to tackle the obstacles encountered during the transition from IPv4 to IPv6. This section provides a concise overview of these methods.

Method	Overview
NAT66	NAT66 is used for translating an IPv6 source or destination address to a different IPv6 source or destination address. Not a common method, since most IPv6 networks do not require NAT66.
NAT46	NAT46 is used to translate IPv4 addresses to IPv6 addresses. Enable a client on an IPv4 network to communicate transparently with a server on an IPv6 network.
NAT64 and DNS64	NAT64 is used to translate IPv6 addresses to IPv4 addresses. Enable a client on an IPv6 network to communicate transparently with a server on an IPv4 network. Typically used when networks are being transitioned from IPv4 to IPv6. NAT64 is typically employed in tandem with DNS64. DNS64 is responsible for synthesizing AAAA records from A records.

Note that these are broad use cases and the specific use of each type of NAT can vary depending on the network configuration and requirement.

Multiple NAT46 and NAT64 related objects are consolidated into regular objects. A per-VDOM virtual interface, naf.<vdom>, is automatically added to process NAT46 and NAT64 traffic. The features include:

• vip46 and vip64 settings are consolidated in vip and vip6 configurations.

• policy46 and policy64 settings are consolidated in firewall policy settings.

• nat46 and nat64 are included in firewall policy settings.

• ippool and ippool6 support NAT46 and NAT64 (when enabled, the IP pool should match a subnet).

• Central SNAT supports NAT46 and NAT64.

• add-nat46-route in ippool6 and add-nat64-route in ippool are enabled by default. The FortiGate generates a static route that matches the IP range in ippool6 or ippool for the naf tunnel interface.

Automatic processing of the naf tunnel interface is not supported in security policies.

To configure NAT46 or NAT64 translation, use the standard vip or vip6 setting, apply it in a firewall policy, enable NAT46 or NAT64, and enter the IP pool to complete the configuration.

The external IP address cannot be the same as the external interface IP address.