Hi,
I am checking NAT64 function on M and MX series.
Below is the configuration set up with interface-style and next-hop style:
Interface style
==========
# show interfaces ge-1/1/0 unit 140
vlan-id 140;
family inet {
address 192.168.140.1/24;
}
# show interfaces ge-1/1/0 unit 141
vlan-id 141;
family inet {
inactive: address 192.168.141.1/24;
}
family inet6 {
service {
input {
service-set nat64;
}
output {
service-set nat64;
}
}
address 2001:db8:0:1:0:0:c0a8:8d01/128;
}
# show interfaces sp-1/3/0 unit 142
family inet;
family inet6;
# show services nat pool src-pool-142
address 192.168.142.0/24;
port {
automatic;
}
# show services nat rule nat64
match-direction input;
term t1 {
from {
source-address {
2001:db8::0/96;
}
destination-address {
64:ff9b::/96;
}
}
then {
translated {
source-pool src-pool-nj;
destination-prefix 64:ff9b::/96;
translation-type {
stateful-nat64;
}
}
}
}
# show services service-set nat64
syslog {
host M10i {
services any;
log-prefix XXXSVC-SETYYY;
}
}
nat-rules nat64;
interface-service {
service-interface sp-1/3/0.142;
}
Interface-style
==========
# show interfaces ge-1/1/0 unit 140
vlan-id 140;
family inet {
address 192.168.140.1/24;
}
# show interfaces ge-1/1/0 unit 141
vlan-id 141;
family inet {
inactive: address 192.168.141.1/24;
}
family inet6 {
address 2001:db8:0:1:0:0:c0a8:8d01/128;
}
# show interfaces sp-1/3/0 unit 142
family inet;
family inet6;
service-domain inside;
# show interfaces sp-1/3/0 unit 140
family inet;
service-domain outside;
# show routing-instances SFW-vr-nj-140
instance-type virtual-router;
interface ge-1/1/0.140;
interface sp-1/3/0.140;
routing-options {
static {
route 0.0.0.0/0 next-hop sp-1/3/0.140;
}
}
# show routing-instances SFW-vr-nj-141
instance-type virtual-router;
interface ge-1/1/0.141;
interface sp-1/3/0.142;
routing-options {
rib SFW-vr-nj-141.inet6.0 {
static {
route ::/0 next-hop sp-1/3/0.142;
}
}
static {
route 0.0.0.0/0 next-hop sp-1/3/0.141;
}
}
# show services stateful-firewall rule 140-rule
match-direction input-output;
term ACCEPT_ALL {
then {
accept;
}
}
# show services nat pool src-pool-142
address 192.168.142.0/24;
port {
automatic;
}
# show services nat rule nat64
match-direction input;
term t1 {
from {
source-address {
2001:db8::0/96;
}
destination-address {
64:ff9b::/96;
}
}
then {
translated {
source-pool src-pool-nj;
destination-prefix 64:ff9b::/96;
translation-type {
stateful-nat64;
}
}
}
}
# show services service-set nat64
syslog {
host M10i {
services any;
log-prefix XXXSVC-SETYYY;
}
}
nat-rules nat64;
interface-service {
service-interface sp-1/3/0.142;
}
# show services service-set nat64_nh
stateful-firewall-rules narjess140-rule;
nat-rules nat64;
next-hop-service {
inside-service-interface sp-1/3/0.142;
outside-service-interface sp-1/3/0.140;
}
Results:
======
# run show services stateful-firewall flows
Interface: sp-1/3/0, Service set: nat64_nh
Flow State Dir Frm count
ICMPV62001:db8:0:1::c0a8:8d0a->64:ff9b::c0a8:8c0a Drop O 0
# run show services stateful-firewall flows
Interface: sp-1/3/0, Service set: nat64_nh
Flow State Dir Frm count
TCP 2001:db8:0:1::c0a8:8d0a:49412 ->64:ff9b::c0a8:8c64:80 Drop I 0
Do you see anything that goes wrong with this configuration?
Best Regards,
