Thursday, January 31, 2013

NAT64 on a hairpin interface with cisco ios 15.X

Okay if you followed my earlier post, that I  posted just last night from my notes of previous NAT and ipv6 setups. I got to thinking;

Can we conduct a NAT64 on a hairpin interface? Will I found the answer after investing about 1hr of playin around. 1st Let's  look at the design;

ipv6-lan = 2001:470:C021:1::/64
ipv4-lan =
NAT4_address =
NAT6_address = 2001:179:179::1 

Router =3825ISR
IOScode= ADVENTERPRISEK9-M Version 15.1(4)M4

Here's a graphical representation of the design;

The goal here; "was to do all of the  NAT on a single interface". We are using a  cisco3825 for the NAT64. It's connected to a layer2 switch with a ipv4 and ipv6 host on the same layer2 lan segment. The single gige interface, will handle both ipv6 and ipv4 traffic.

The cfg ( 3825 gig0/0 intf ) ;


interface GigabitEthernet0/0
 description this is a single dual/stacked interface both ipv4/v6

 ip address

 ip flow ingress

 ip flow egress

 duplex auto

 speed auto

 media-type rj45

 ipv6 address 2001:470:C021:1::1/64

 ipv6 enable

 ipv6 nat


Okay now let's look at the simple ipv6v4 nat cfg.

1st I had problems using a  source-list and pool, so I revert my cfg to a static nat for this example. I will continue into look at the issues with regards to the source list and nat pool. Once I figured that out, I will post an update, and another post on my  blog, so stay tuned.

Here's my nat rules, I left some of the old cfg in place and comment it out for your reference and pleasure ;

ipv6 nat translation icmp-timeout 5

ipv6 nat v4v6 source 2001:179:179::1
! the following line is one method I tried that failed, don't why but one packet was entering

! ipv6 nat v6v4 source list myv6 pool nat6 overload

ipv6 nat v6v4 source 2001:470:C021:1:21F:5BFF:FEEA:AFA
! the follow line below didn't work either during my testing

! ipv6 nat v6v4 pool nat6 prefix-length 30

ipv6 nat prefix 2001:179:179::/96

Okay here's what the  debug ipv6 nat shows;

Feb  1 01:37:30.943: IP: tableid=0, s= (FastEthernet0/0), d= (FastEthernet0/0), routed via RIB

*Feb  1 01:37:30.943: IP: s= (FastEthernet0/0), d= (FastEthernet0/0), len 36, rcvd 3

*Feb  1 01:37:30.947:     ICMP type=8, code=0

*Feb  1 01:37:30.947: IP: tableid=0, s= (local), d= (FastEthernet0/0), routed via FIB

*Feb  1 01:37:30.947: IP: s= (local), d= (FastEthernet0/0), len 36, sending

*Feb  1 01:37:30.947:     ICMP type=0, code=0

and our nat translation table as seen on the single NAT hairpin interface;

router3825#sh ipv6 nat tr ver

Prot  IPv4 source              IPv6 source

      IPv4 destination         IPv6 destination

---   ---                      ---                  2001:179:179::1

      create 00:20:42, use 00:00:03,

tcp,61837            2001:470:C021:1:21F:5BFF:FEEA:AFA,61837,22               2001:179:179::1,22

      create 00:00:03, use 00:00:00, left 23:59:59,

---                  2001:470:C021:1:21F:5BFF:FEEA:AFA

      ---                      ---

      create 00:01:07, use 00:00:03,

and our ipv6 nat table;

router3825>show ipv6 nat statistics
Total active translations: 4 (2 static, 2 dynamic; 2 extended)
NAT-PT interfaces:

Hits: 10  Misses: 0
Expired translations: 36

And here's  the cisco1841 device that I configured for my ipv4 host & for testings;

ccie02#show ip int fas 0/0  | i add

  Internet address is

  Broadcast address is

  Helper address is not set

  Network address translation is disabled


And when we finally had things working, we could ping and ssh from my macosx host  ( ipv6) to the cisco (ipv4) and on a hair-pinned interface.

Ken-Felixs-MacBook:~ root# ping6 2001:179:179::1
PING6(56=40+8+8 bytes) 2001:470:c021:1:21f:5bff:feea:afa --> 2001:179:179::1
Request timeout for icmp_seq=0
Request timeout for icmp_seq=1
16 bytes from 2001:179:179::1, icmp_seq=2 hlim=253 time=1.719 ms
16 bytes from 2001:179:179::1, icmp_seq=3 hlim=253 time=1.568 ms
Request timeout for icmp_seq=4
16 bytes from 2001:179:179::1, icmp_seq=5 hlim=253 time=1.579 ms
16 bytes from 2001:179:179::1, icmp_seq=6 hlim=253 time=1.617 ms
16 bytes from 2001:179:179::1, icmp_seq=7 hlim=253 time=1.599 ms
16 bytes from 2001:179:179::1, icmp_seq

And we validate on the cisco1841with a cli cmd  show user after executing a ssh -6 to this device from my  macbook.

ccie02#sh user

    Line       User       Host(s)              Idle       Location

*  0 con 0                idle                 00:00:00

 194 vty 0     cisco      idle                 00:00:52

  Interface    User               Mode         Idle     Peer Address

So what this means,  " If  you on a lan segment that must handle ipv4 traffic, but you don't have another interface nor want to enable a sub-vlan-interface,  you can hairpin on a dual-stacked and addressed cisco router interface."

So for example, you have ipv6-only hosts and maybe a ipv4-only host ( i.e printer ), you want to integrated this into your existing layer2 segment and allow ipv6 machines to asssociated and use the printer for print function, with nat64 on a hairpin, you can easily conduct this without wasting any  Physical or Virtual-interfaces.

I hope you find this posting useful, within your ipv4-2-ipv6 migrations.

Ken Felix
Freelance Network & Security Engineer, Specialized with ipv6 migration designs and planning

kfelix "@" hyperfeed  "dot" com

No comments:

Post a Comment