Help configuring NAT64 on a BIG-IP LTM

Question

I have been trying to implement NAT64 in our network in order for IPv6 only clients can reach our IPv4 only servers.&nbsp; &nbsp;Ive create an IPv6 VIP and enabled the nat6to4 option and port and address translation are enabled.&nbsp;&nbsp;VIP: ipv6Pool: IPv4Snat: Auto map&nbsp;when i do&nbsp; #show sys connection cs-server-address 2a:66:x.x.x.xx&nbsp;client IPaddress&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;VIP ip address&nbsp; &nbsp; &nbsp;floating ip address&nbsp; &nbsp; node&nbsp;2a:45:33.xxx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;2a:66:x.x.x.xx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;any6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; any6&nbsp;&nbsp;I able to see the client IPv6 address reaching to the VIP. But the F5 is not loadbalancing to the backend server&nbsp;How can i make this to work&nbsp;&nbsp;Any help would be greatly appreciated.

mohamed_ahmed_kansoh · Answer

Hi @mj16othman,&nbsp;
Look Bigip LTM supports Dual stack without issues.&nbsp;
First you need to have a self-ip in IPv6 Scheme in the external VLAN also a self IP in IPv4 in server side for IPv4 pool members.This is my comment here, I tested it before and it worked:&nbsp;This a PCAP I took it in my lab :&nbsp;
&nbsp;

Please have a look in this article : The BIG-IP system automatically translates addresses between IPv4 and IPv6 when loadbalancing to pool members (f5.com)
&nbsp;

mj16othman · Answer

HI brother im able to see the connection in the connection table once i changed the type of the VIP from {standard} to { performance layer 4}.&nbsp;&nbsp;&nbsp;&nbsp;But unfortunately another issue appeared where the website is not loading. But im able to see the connection table&nbsp;&nbsp;client IPaddress&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;VIP ip address&nbsp; &nbsp; &nbsp;floating ip address&nbsp; &nbsp; node&nbsp;2a:45:33.xxx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;2a:66:x.x.x.xx&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;172.16.1.1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 172.16.2.3&nbsp;&nbsp;I thought the issue might be related to SSL certificate. If there a way i can assign ssl on the performance layer 4 VIP. i didnt find an option for assigning&nbsp; ssl certificate to it.&nbsp; &nbsp;&nbsp;

mohamed_ahmed_kansoh · Answer

Hey,&nbsp;
Performance l4 VS like the router , it just routs traffic from outside to inside,&nbsp;you can't assign a ssl profile in performance L4 because you haven't any L7 visibility to parse the http Traffic.&nbsp;
&nbsp;
have you added a IPv6 selfip address in the external VLAN ?&nbsp;Take a packet capture and show it to me and revert back to standard virtual server.
Review the Routing on F5 Bigip specially the back route for IPv6 Clients or enable "auto-last hop" feature in the virtual server.
seems you have a missing route in F5 Bigip so auto last hop can help in this.&nbsp;

Try it and let me know&nbsp;

Forum Discussion

Help configuring NAT64 on a BIG-IP LTM

Recent Discussions

R2600 device and tenant/partition configuration

FQDN resolve in non default domain name.

Inquiry About PayByPlate Integration with F5

APM - Capture Login sharepoint

APM : is VMware Workspace One supported as an Endpoint Management System?

Related Content

Re: Get Started with BIG-IP Virtual Edition (VE), BIG-IQ VE or BIG-IP Cloud Edition Trial

Zero-touch configuration of secure apps across BIG-IP tenants using CTS

NAT64 DNS64

BIG-IP Configuration Visualizer

Service discovery and registration with BIG-IP