Policy & Objects : Managing policies : NAT64 Policy
 
NAT64 Policy
Use NAT64 policies to perform network address translation (NAT) between an internal IPv6 network and an external IPv4 network. The NAT64 Policy tab allows you to create, edit, delete, and clone NAT64 policies.
 
Select Display Options in the Policy & Objects tab, and toggle the NAT64 Policy switch to display this option in the Policy Package tab bar.
To create a NAT64 policy:
1. Select the ADOM from the drop-down list in the toolbar.
2. Select the policy package where you are creating the new NAT64 policy from the tree menu.
3. Select NAT64 Policy in the policy toolbar.
4. Right-click on the sequence number of a current policy, or in an empty area of the content pane and select Create New from the pop-up menu.
The Create New Policy dialog box opens.
Figure 215: NAT 64 Policy
5. Configure the following settings:
Source Interface
Select the source interface from the drop-down list.
Source Address
Select the source address from the drop-down list. You can select to create a new address or address group in the Source Address dialog box.
Destination Interface
Select the destination interface from the drop-down list.
Destination Address
Select the destination address from the drop-down list. You can create a new address or address group in the Add Destination Address dialog box.
Schedule
Select a schedule or schedules for the policy. Schedules can also be created by selecting Create New in the dialog box. See “Create a new object” for more information.
Service
Select the service from the drop-down list. You can create a new service or service group in the Add Service dialog box.
Action
Select an action for the policy to take, whether ACCEPT or DENY. When Action is set to Accept, you can configure NAT and Traffic Shaping.
Log Allowed Traffic
Log Violation Traffic
Select to log allowed traffic/violation traffic.
This setting is dependent on the Action setting.
NAT
NAT is enabled by default for this policy type.
 
Use Destination Interface Access
Select to use the destination interface address.
 
Fixed Port
Select to enable fixed port.
 
Dynamic IP Pool
Select to enable dynamic IP pool and select the dynamic IP pool from the drop-down list.
Traffic Shaping
Select to enable traffic shaping and select a default or custom traffic shaper object from the drop-down list.
 
Reverse Direction Traffic Shaping
Select to enable reverse direction traffic shaping and select a default or custom traffic shaper object from the drop-down list.
Per-IP Traffic Shaping
Select to enable per-IP traffic shaping and select the related object from the drop-down list.
Tags
You can add tags for tag management. Enter a tag in the text field and select the plus (+) icon to apply the tag to the policy.
Comments
Enter optional comments for the policy.
6. Select OK to save the policy.
Edit the policy schedule:
1. Select NAT64 Policy in the policy toolbar.
2. Select the policy in the table and right-click the Schedule column and select Edit in the menu.
The Edit Recurring Schedule dialog box is displayed.
Figure 216: Edit Recurring Schedule
3. Configure the following settings:
Name
Edit the schedule name as required.
Color
Select the icon to select an custom icon to display next to the schedule name.
Day
Select the days of the week for the custom schedule.
Start
Select the schedule start time.
End
Select the schedule end time.
4. Select OK to save the schedule. The custom schedule will be added to Objects > Firewall Objects > Schedule.
Edit the policy service:
1. Select NAT64 Policy in the policy toolbar.
2. Select the policy in the table and right-click the Service column and select Edit in the menu.
The Edit Service dialog box is displayed.
Figure 217: Edit Service
3. Configure the following settings:
Name
Edit the service name as required.
Comments
Enter an optional comment.
Color
Select the icon to select an custom icon to display next to the service name.
Protocol
Select the protocol from the drop-down list. Select one of the following: TCP/UDP/SCTP, ICMP, ICMP6, or IP.
IP/FQDN
Enter the IP or FQDN.
Note: This menu item is available when Protocol is set to TCP/UDP/SCTP. You can then define the protocol, source port and destination port in the table.
Type
Enter the type in the text field.
Note: This menu item is available when Protocol is set to ICMP and ICMP6.
Code
Enter the code in the text field.
Note: This menu item is available when Protocol is set to ICMP and ICMP6.
Protocol Number
Enter the protocol number in the text field.
Note: This menu item is available when Protocol is set to IP.
Advanced Options
For more information on advanced option, see the FortiOS 5.0 CLI Reference.
 
check-reset-range
Configure ICMP error message verification.
• disable — The FortiGate unit does not validate ICMP error messages.
• strict — If the FortiGate unit receives an ICMP error packet that contains an embedded IP(A,B) | TCP(C,D) header, then if FortiOS can locate the A:C->B:D session it checks to make sure that the sequence number in the TCP header is within the range recorded in the session. If the sequence number is not in range then the ICMP packet is dropped. If is enabled the FortiGate unit logs that the ICMP packet was dropped. Strict checking also affects how the anti-replay option checks packets.
• default — Use the global setting defined in system global.
Note: This field is available when protocol is TCP/UDP/SCTP.
Note: This field is not available if explicit-proxy is enabled.
 
session-ttl
Enter the default session timeout in seconds. The valid range is from 300 - 604 800 seconds. Enter 0 to use either the per-policy session-ttl or per-VDOM session-ttl, as applicable.
Note: This is available when protocol is TCP/UDP/SCTP
 
tcp-halfclose-timer
Enter how many seconds the FortiGate unit should wait to close a session after one peer has sent a FIN packet but the other has not responded. The valid range is from 1 to 86400 seconds.
Enter 0 to use the global setting defined in system global.
Note: This is available when protocol is TCP/UDP/SCTP.
 
tcp-halfopen-timer
Enter how many seconds the FortiGate unit should wait to close a session after one peer has sent an open session packet but the other has not responded. The valid range is from 1 to 86400 seconds.
Enter 0 to use the global setting defined in system global.
Note: This is available when protocol is TCP/UDP/SCTP.
 
tcp-timewait-timer
Set the length of the TCP TIME-WAIT state in seconds. As described in RFC 793, the “TIME-WAIT state represents waiting for enough time to pass to be sure the remote TCP received the acknowledgment of its connection termination request”.
Reducing the time of the TIME-WAIT state means the FortiGate unit can close terminated sessions faster which means more new sessions can be opened before the session limit is reached.
The valid range is 0 to 300 seconds. A value of 0 sets the TCP TIME-WAIT to 0 seconds.
Enter 0 to use the global setting defined in system global.
Note: This is available when protocol is TCP/UDP/SCTP.
 
udp-idle-timer
Enter the number of seconds before an idle UDP connection times out. The valid range is from 1 to 86400 seconds.
Enter 0 to use the global setting defined in system global.
Note: This is available when protocol is TCP/UDP/SCTP.
4. Select OK to save the service. The custom service will be added to Objects > Firewall Objects > Service.
To edit the policy action:
1. Select NAT64 Policy in the policy toolbar.
2. Select the policy in the table and right-click the Action column.
3. Select either Accept or Deny in the menu.
To edit policy logging:
1. Select NAT64 Policy in the policy toolbar.
2. Select the policy in the table and right-click the Log column.
3. You can select to enable or disable logging in the menu.
To edit the installation target:
1. Select NAT64 Policy in the policy toolbar.
2. Select the policy in the table and right-click the Install On column and select Add Object(s) in the menu.
The Add Install On dialog box is displayed.
Figure 218: Add Install On
3. Select the installation targets from the list and select OK. To edit the installation targets, select the Installation tab in the Policy Package tab bar and select Edit Targets in the toolbar.