Athena NGFW (Next-Generation Firewall)

Athena NGFW (previously known as Network Secure) provides comprehensive protection for every network perimeter, ensuring the safety of your valuable assets, data, and users from emerging threats.
{{ $t('productDocDetail.guideClickSwitch') }}
{{ $t('productDocDetail.know') }}
{{ $t('productDocDetail.dontRemind') }}
8.0.95
{{sendMatomoQuery("Athena NGFW (Next-Generation Firewall)","IPv4 to IPv6 NAT")}}

IPv4 to IPv6 NAT

{{ $t('productDocDetail.updateTime') }}: 2025-12-25

To translate the protocol request to access the IPv4 address into the IPv6 address for communication. It allows access from the IPv4 protocol to the IPv6 protocol.

6.1.3.1.1.1Configuration Example

The LAN of an enterprise is an IPv6 network, the IP address of the LAN server is 2003::1/128, the WAN is an IPv4 network, and the IP address of the ETH1 interface in Network Secure is 1.2.1.1/24. If you need to use the LAN server to publish web services to the IPv4 network, IPv4 network users can access the LAN server by visiting http://1.2.1.1. The detailed topology is shown in the following figure.

A blue rectangular object with black text

Description automatically generated

Step 1.Define LAN and WAN zones. Before you add an SNAT policy, navigate to Network > Zones, and select the zone to which the interface belongs on the Zones page. Then, navigate to Objects > Network Objects and select the IP Group to which the LAN segment belongs. In this example, select WAN for the ETH1 interface and LAN for the ETH2 interface. See the figure below.

A screenshot of a computer

Description automatically generated

Step 2.Add an IPv4 to the IPv6 NAT policy. Navigate to Policies > NAT > NAT64, click Add, and select Add NAT Policy (IPv4 to IPv6). In the Add NAT Policy (IPv4 to IPv6) dialog box, enter the name in the Name field.

Src Zone: Select WAN.

Src Address: Select All.

Destination: Enter 1.2.1.1/32.

Services: Select http (TCP:80).

Translate Src IP To: Set the IPv6 address to the IP address of the ETH2 interface, 2003::2.

Translation Dst IP To: Set the IPv6 address of the LAN server to 2003::1/128.

Translate Dst Port To: Set if the destination port is required to change.

By default, Allow matching packets, no application control policy applied is selected. See the figure below.

A screenshot of a computer

Description automatically generated

Step 3.Save the configuration. Finally, click Save. Then, the configuration of the IPv4 to IPv6 NAT policy is complete. See the figure below.

A close-up of a computer screen

Description automatically generated

Step 4.WAN users can access the LAN server by visiting http://1.2.1.1/.