1. An IPv6 client in a branch site attempts to access Cisco SD-WAN Manager in a data center on the transport side of the network (VPN 0).

2. The Cisco IOS XE Catalyst SD-WAN device routes the IPv6 address from the service VPN (VPN 1) to the next-hop transport VPN (VPN 0), which is the WAN side of the network.

3. A NAT66 translator performs an IPv6-to-IPv6 prefix translation. Dynamic Host Configuration Protocol version 6 (DHCPv6) requires a source IPv6 prefix in the IPv6 prefix range for prefix delegation.

   NAT66 conversion occurs in the transport VPN interface.

   DHCPv6 prefix delegation allows an ISP to automate the process of assigning prefixes to a customer for use within the customer's network. Prefix delegation occurs between a provider edge (PE) device and customer premises equipment (CPE) using the DHCPv6 prefix delegation option. After an ISP has delegated prefixes to a customer, the customer can further divide the network and assign prefixes to the links in the customer's network.

4. When traffic is returned from Cisco SD-WAN Manager, the Cisco IOS XE Catalyst SD-WAN device looks up the NAT66 entry in the DIA route table and forwards the packet to the client's IPv6 address.

Configure NAT66 DIA Using Stateless DHCP

From Cisco IOS XE Catalyst SD-WAN Release 17.13.1a, you can autoconfigure an IPv6 address on a WAN interface by using Stateless Address Autoconfiguration (SLAAC) with a Router Advertisement (RA) prefix. Stateless DHCPv6 is a combination of SLAAC and DHCPv6. The device sends an RA with the O bit set but does not set the M bit. This is known as Stateless DHCPv6 because the DHCPv6 server does not have to track the client address bindings. The RA prefix is available for use with NAT66 for IPv6 DIA of the service side traffic. Once configured, the same source prefix can be matched with different outside interfaces.

Before you begin, ensure that you have configured DHCPv6 and SLAAC. For more information, see Information About DHCPv6.

Note	Ensure that the RA prefix that are used in the SLAAC interface is different from the outside prefix that is used in the static NAT66 mapping rules.

When the mapping rule is configured and the flow match occurs, traffic flows from inside to outside. NAT66 maintains a bind table for sharing the RA prefix with service side hosts. When an IPv6 packet from the service side interface flows through the DIA path, a bind is created for the original source and the translated source address using the RA prefix. The same bind is used to translate back the packets. NAT66 maintains the bind entries for a specified time. The default timeout value is 5 minutes.

The prefix translation rule for an interface is effective only when the packet goes through that interface and there is no need to specify the egress interface when you’ve configured the prefix translation rule with RA.

When you configure the Translated Source Prefix as the system default, the SLAAC feature automatically provides the RA prefix (outside). Otherwise, you must configure the outside prefix in the translation rule.

You can configure NAT66 DIA Using Stateless DHCP by using the Cisco Catalyst SD-WAN Manager or the CLI:

• Configure NAT66 DIA Using Stateless DHCP Through Cisco Catalyst SD-WAN Manager

• Configure DIA Using Stateless DHCP using CLI

Minimum supported releases: Cisco IOS XE Catalyst SD-WAN Release 17.13.1a and Cisco Catalyst SD-WAN Manager Release 20.13.1

You can use the nat use-vpn 0 command to configure a NAT66 DIA route using a centralized data policy on Cisco IOS XE Catalyst SD-WAN devices so that data traffic is NATed before entering the overlay tunnel that is located in the transport VPN. Based on the policy match criteria, matching IPv6 traffic is forwarded via DIA circuits after the source IP address is translated. The IPv6 traffic is forwarded after NAT66 on destination address via DIA circuits based on the centralized policy match criteria on source IPv6 prefix, prefix lists, or destination IPv6 prefix or Prefix-lists.

To configure NAT66 on the service-side of a device, you configure a NAT66 interface within a service VPN on the device, and then you configure a centralized data policy on the Cisco Catalyst SD-WAN Controller. The policy directs data traffic with the desired prefixes to the service-side NAT.

You can configure NAT for data that enters or exits the service-side of the network. The service-side NAT translates data traffic, of inside and outside host addresses, that match a configured centralized data policy.

If the DIA route is not available, traffic will drop if a fallback option is not configured. The NAT66 fallback feature provides a routing-based mechanism for all traffic that is sent to the DIA route to use an alternative route when required.This feature is supported this froms both service and from tunnel.

• Supports local IPv6 internet traffic to exit directly to the internet from the service-side VPN through the transport VPN

• Allows you to redirect or forward packets from one network to another in an IPv6 environment

• Enables good application performance

• Contributes to reduced bandwidth consumption and latency

• Contributes to lower bandwidth cost

• Enables improved branch office user experience by providing DIA at remote site locations

• Supports cellular and dialer interfaces from Cisco IOS XE Catalyst SD-WAN Release 17.14.x

Minimum supported releases: Cisco IOS XE Catalyst SD-WAN Release 17.14.1a and Cisco Catalyst SD-WAN Manager Release 20.14.1

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

2. Click Feature Templates.

3. Click Add Template.

4. Under Select Devices, choose the device for which you are creating the template.

5. Under Select Template, scroll down to the OTHER TEMPLATES section, and click Cisco BGP.

6. In the Template Name field, enter a name for the feature template.

7. In the Description field, enter a description for the feature template.

8. Click UNICAST ADDRESS FAMILY.

9. Click IPv6.

10. Click New Redistribute.

11. In the Protocol drop-down list, choose NAT.

12. Click Add.

13. Click Save.

Minimum supported releases: Cisco IOS XE Catalyst SD-WAN Release 17.14.1a and Cisco Catalyst SD-WAN Manager Release 20.14.1

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

2. Click Feature Templates.

3. Click Add Template.

4. Under Select Devices, choose the device for which you are creating the template.

5. Under Select Template, scroll down to the OTHER TEMPLATES section, and click Cisco OSPFv3.

6. In the Template Name field, enter a name for the feature template.

7. In the Description field, enter a description for the feature template.

8. Click IPv6.

9. In the Redistribute tab, click New Redistribute.

10. In the Protocol drop-down list, choose nat-route.

11. Click Add.

12. Click Save.

Minimum supported releases: Cisco IOS XE Catalyst SD-WAN Release 17.14.1a and Cisco Catalyst SD-WAN Manager Release 20.14.1

1. From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.

2. Click Add CLI based Configuration Group.

3. Enter a name for the CLI based configuration group.

4. In the Solution drop-down list, choose sdwan.

5. In the Description field, enter a description for the CLI based configuration group.

6. Click Next.

7. Enter the CLI based configuration in the field.

   1. Configure a BGP routing process, and enter the router configuration mode for the specified routing process. Use the autonomous-system-number argument to specify an integer, from 0 and 65534, that identifies the device to other BGP speakers:

      router bgp autonomous-system-number 

   2. Configure the router ID as the identifier of the local device running BGP. Use the ip-address argument to specify a router IP address within the network:

      bgp router-id ip-address 

   3. Specify the IPv6 address family and enter the address family configuration mode:

      address-family ipv6 unicast vrf vrf-name 

   4. Add the IP address of the neighbor in the specified AS to the IPv6 multiprotocol BGP neighbor table of the local device:

      neighbor ip-address remote-as autonomous-system-number 

   5. Enable the neighbor to exchange prefixes for the IPv6 unicast address family with the local device:

      neighbor ip-address activate 

   6. Redistribute NAT route:

      redistribute nat-route 
      

   7. Exit address family configuration mode and return to privileged EXEC mode:

      exit-address-family 

8. Click Save.

router bgp 15
bgp router-id 10.1.1.1
address-family ipv6 unicast vrf 1
  neighbor 2001:a14:18::64 remote-as 2
  neighbor 2001:a14:18::64 activate
  redistribute nat-route
  exit-address-family
!

Minimum supported releases: Cisco IOS XE Catalyst SD-WAN Release 17.14.1a and Cisco Catalyst SD-WAN Manager Release 20.14.1

1. From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.

2. Click Add CLI based Configuration Group.

3. Enter a name for the CLI based configuration group.

4. In the Solution drop-down list, choose sdwan.

5. In the Description field, enter a description for the CLI based configuration group.

6. Click Next.

7. Enter the CLI based configuration in the field.

   1. Configure an interface:

      interface interface-name 

   2. Provide the OSPFv3 process ID, and specify point-to-point as the network type to which the interface is to connect:

      ospfv3 process-id network point-to-point 

   3. Configure the OSPFv3 area for the IPv6 address family:

      ospfv3 process-id ipv6 area area-id 

   4. Enter the router configuration mode and provide the OSPFv3 process ID:

      router ospfv3 process-id 

   5. Configure the router ID as the identifier of the local device running OSPFv3. Use the ip-address argument to specify a router IP address within the network:

      router-id ip-address 

   6. Specify the IPv6 address family and enter the address family configuration mode:

      address-family ipv6 unicast 

   7. Configure the device to send a syslog message when an OSPFv3 neighbor goes up or down:

      log-adjacency-changes
       

   8. Redistribute the connected routes into OSPFv3:

      redistribute connected 

   9. Redistribute NAT route:

      redistribute nat-route 
      

   10. Exit address family configuration mode and return to privileged EXEC mode:

       exit-address-family 

8. Click Save.

interface GigabitEthernet5
ospfv3 1 network point-to-point
ospfv3 1 ipv6 area 0
    router ospfv3 1
    router-id 10.1.1.1
address-family ipv6 unicast
  log-adjacency-changes
  redistribute connected
  redistribute nat-route
  exit-address-family
!

• Allows physical interfaces to take on different characteristics based on incoming or outgoing call requirements

• Supports route-based as well as data-policy-based configuration with NAT66 DIA

Minimum support release: Cisco IOS XE Catalyst SD-WAN Release 17.14.1a and Cisco Catalyst SD-WAN Manager Release 20.14.1

1. From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.

   For more information about creating a configuration group, see Configuration Group Workflows.

2. Under Transport and Management Profile, click … adjacent to an interface under the VPN 0 feature.

3. Click Add Sub Feature and select the one of the following dialer interfaces from the drop-down list:

   • DSL PPPoE

   • DSL PPPoA

4. Configure the options for DSL PPPoE or DSL PPPoA.

   For more information, see the sections DSL PPPoE or DSL PPPoA in Transport and Management Profile.

5. Click Save.

Minimum support release: Cisco IOS XE Catalyst SD-WAN Release 17.14.1a and Cisco Catalyst SD-WAN Manager Release 20.14.1

For more information on using CLI templates, see CLI Templates and CLI Add-On Feature Templates.

1. Configure a PPPoE dialer interface with NAT66 DIA enabled.

   interface interface-type-number
    pppoe enable group global
    pppoe-client dial-pool-number dialer-pool-number
   !
   interface Dialer dialer-number
    mtu bytes
    ipv6 address negotiated
    ipv6 mtu bytes
    nat66 outside
    encapsulation encapsulation-type
    ipv6 tcp adjust-mss bytes
    dialer pool dialer-pool-number
    dialer down-with-vInterface
    ppp chap hostname hostname
    ppp chap password password
    ppp authentication chap callin
    ppp ipcp route default
    service-policy output shape_Dialer dialer-number

2. Enable nat66 outside over a dialer interface.

   
   nat66 outside
   nat66 prefix inside ipv6-address outside interface Dialer interface name vrf Sevice VPN number
   nat66 prefix inside ipv6-address outside interface Dialer interface name

3. Configure a NAT66 DIA route for a service-side VPN.

   For more information on configuring a NAT DIA route for a service-side VPN, see Configure a NAT DIA Route.

   or

   Configure a NAT66 DIA route for a service-side VPN using a centralized data policy.

   nat66 route vrf vrf-id route-prefix prefix-mask global

Note

Deleting the dialer interface in the same transaction as NAT66 Mapping with Pool-overload-config, generates an extra no NAT66 configuration. Remove each NAT66 configuration separately using different transactions as folllows: Device(config)# no nat66 inside source list global-list pool natpool-Dialer100-0 overload egress-interface Dialer100 Device(config)# commit Device(config)# no interface Dialer100 Device(config)# commit

interface Dialer100
 mtu 1492
 ipv6 address negotiated
 nat66 outside
 encapsulation ppp
 ipv6 tcp adjust-mss 1452
 dialer pool 100
 dialer down-with-vInterface
 endpoint-tracker tracker-google 
 ppp authentication chap callin
 ppp chap hostname branch1.ppp1
 ppp chap password 7 01100F175804
 ppp ipcp route default
 service-policy output shape_GigabitEthernet0/0/1
!
interface GigabitEthernet0/0/1
 no ipv6 redirects
 pppoe enable group global
 pppoe-client dial-pool-number 100
!
sdwan
 interface Dialer100
  tunnel-interface
   encapsulation ipsec weight 1
   color mpls restrict
  exit
 exit
nat66 prefix inside 2001:A14:18::/80 outside interface Dialer100 vrf 100
nat66 route vrf 100 ::/0 global