Networking · Topic 7 of 8
IPv6 Transition Mechanisms
Describe NAT44, carrier grade NAT, NAT64, MAP-T and DS-Lite, and compare how each helps a provider keep IPv4 services running as the network moves to IPv6.
- 5 min
- Includes a diagram
- NAT44 translates IPv4 to IPv4. CGNAT does it in the provider for many subscribers.
- NAT444 means a home NAT followed by a carrier NAT.
- The shared address space for CGNAT is
100.64.0.0/10.
What it is
IPv6 transition techniques let providers keep serving IPv4 content while their networks move to IPv6.
IPv4 addresses are scarce, so providers cannot give every subscriber a public IPv4 address. The techniques differ in where the IPv4 service is kept alive and what the access network carries.
How it works
Each technique solves a different problem, so match the technique to the scenario.
NAT44 and CGNAT
NAT44 translates IPv4 addresses to other IPv4 addresses. A home router uses it to share one public address among private hosts, usually with port translation.
CGNAT (carrier grade NAT) moves that translation into the provider. Many subscribers share a small pool of public addresses. When the home router also does NAT, the result is called NAT444: private, then shared, then public.
The shared address space 100.64.0.0/10 is reserved for the link between the home router and the CGN. A CGN keeps state for every flow, so the provider has to plan for capacity and for logging. It also breaks some applications that expect a unique public address.
NAT64 and DNS64
NAT64 lets IPv6 only clients reach IPv4 only servers. The translator converts the packet header between the two versions.
DNS64 works with it. When a server has only an A record, DNS64 builds an AAAA answer by placing the IPv4 address inside an IPv6 prefix. The well known prefix is 64:ff9b::/96.
| Item | Role |
|---|---|
| IPv6 client | Asks for the name and gets a synthetic AAAA |
| DNS64 | Creates the AAAA from the A record |
| NAT64 | Translates the packet to IPv4 and back |
Stateful NAT64 maps many IPv6 hosts to a few IPv4 addresses and ports. Stateless NAT64 maps one IPv6 address to one IPv4 address.
Router(config)# nat64 prefix stateful 64:FF9B::/96
Router(config)# interface GigabitEthernet0/0/0
Router(config-if)# nat64 enable
Router(config)# interface GigabitEthernet0/0/1
Router(config-if)# nat64 enableThat is an IOS XE example, and the platform and release decide the exact support. A stateful setup also needs a pool of IPv4 addresses and a list of the IPv6 hosts allowed to translate, and show nat64 translations shows the result.
DS-Lite
Dual stack lite keeps the access network IPv6 only. The home router, called the B4, carries IPv4 traffic inside an IPv6 tunnel to a carrier device, called the AFTR.
The NAT44 happens at the AFTR, not at the home. The home router does not translate. Subscribers can even use the same private IPv4 addresses, because the tunnel keeps them apart.
MAP-T
MAP is a stateless way to give IPv4 service over an IPv6 network. MAP-T uses translation. MAP-E uses encapsulation.
In MAP-T, the IPv4 address and a range of ports are encoded into the subscriber's IPv6 prefix, using mapping rules. The home router (the CE) does NAT44 for its hosts, then translates the IPv4 packet into IPv6. A border relay at the edge of the domain translates it back.
Because the mapping is carried in the address, the provider needs no per subscriber state and no flow logging in the middle. That is the main advantage over CGNAT and DS-Lite.
Comparing the techniques
| Technique | Purpose | Provider state | Access network |
|---|---|---|---|
| CGNAT | Share IPv4 addresses | Per flow | IPv4 |
| NAT64 | IPv6 clients reach IPv4 servers | Per flow, if stateful | IPv6 |
| DS-Lite | IPv4 over IPv6 with central NAT | Per flow, at the AFTR | IPv6, with a tunnel |
| MAP-T | IPv4 over IPv6 with translation | Stateless | IPv6 |
What to remember for the exam
Seven facts cover most questions on this topic.
- NAT44 translates IPv4 to IPv4. CGNAT does it in the provider for many subscribers.
- NAT444 means a home NAT followed by a carrier NAT.
- The shared address space for CGNAT is
100.64.0.0/10. - NAT64 lets IPv6 only clients reach IPv4 servers, and DNS64 builds the AAAA answer.
- The well known NAT64 prefix is
64:ff9b::/96. - DS-Lite tunnels IPv4 in IPv6 from the B4 to the AFTR, where NAT44 is done.
- MAP-T is stateless and translates, while MAP-E encapsulates.
If a question stresses no per subscriber state in the provider, the answer is MAP.
Common mistakes
These four mistakes appear often.
Confusing NAT64 with NAT44. NAT64 changes the IP version. NAT44 keeps IPv4 on both sides.
Forgetting DNS64. Without synthetic AAAA answers, an IPv6 only client has no address to connect to.
Thinking DS-Lite translates at home. The home router only tunnels. The translation happens at the AFTR.
Treating MAP-T like MAP-E. MAP-T translates headers, and MAP-E wraps the packet in an IPv6 tunnel.
CGNAT shares one public address among many subscribers, so providers need to log translations if they must trace traffic.
Check yourself
Work through these three questions.
Which technique lets an IPv6 only client reach an IPv4 only server?
NAT64, together with DNS64, which creates the AAAA answer.
Where does DS-Lite perform NAT44?
At the AFTR in the provider network, not on the home router.
Why does MAP-T need no per subscriber state?
The IPv4 address and port range are encoded in the subscriber IPv6 prefix, so the mapping is stateless.
Topic 7 of 8 in Networking
Test yourself on Networking
The full Cisco CCNP 350-501 SPCOR question bank has 738 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.