HP VPN Firewall Appliances NAT and ALG Configuration Guide

40
Ste
p
Command Remarks
2. Configure a NAT-PT
address pool.
natpt address-group group-number start-ipv4-address
end-ipv4-address
Skip this step if you use
policy 2 or policy 4.
You cannot configure a
NAT-PT address pool
and an AFT address
pool with the same
number at the same
time.
3. Configure a dynamic
IPv4/IPv6 address
mapping policy on
the IPv6 side.
• Associate an IPv6 ACL with an address pool:
natpt v6bound dynamic acl6 number acl-number
address-group address-group [ no-pat ]
• Associate an IPv6 ACL with an interface address:
natpt v6bound dynamic acl6 number acl-number
interface interface-type interface-number
• Associate a NAT-PT prefix with an address pool:
natpt v6bound dynamic prefix natpt-prefix
address-group address-group [ no-pat ]
• Associate a NAT-PT prefix with an interface
address:
natpt v6bound dynamic prefix natpt-prefix
interface interface-type interface-number
Use one of the
commands.
The NAT-PT prefix referenced in a natpt v6bound dynamic command must have been configured with the
natpt prefix command.
If the no-pat keyword is specified, dynamic mapping policies are used for NAT-PT. If this keyword is not
specified, the NAPT-PT mechanism is used to translate between IPv4 addresses and IPv6 addresses, and
the end IPv4 address in the address pool is used for NAPT-PT.
Configuring IPv4/IPv6 address mappings on the
IPv4 side
IPv4/IPv6 address mappings on the IPv4 side can be static or dynamic.
Configuring a static mapping on the IPv4 side
A static IPv4/IPv6 address mapping on the IPv4 side shows the one-to-one correspondence between an
IPv4 address and an IPv6 address:
• If the source IPv4 address in a packet sent from an IPv4 host to an IPv6 host matches a static
IPv4/IPv6 address mapping, the source IPv4 address is translated into the corresponding IPv6
address.
• If the destination IPv6 address in a packet sent from an IPv6 host to an IPv4 host matches a static
IPv4/IPv6 address mapping, the destination IPv6 address is translated into the corresponding IPv4
address.
To configure a static IPv4/IPv6 address mapping on the IPv4 side: