Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual download pdf (Page 29)

ServerIron ADX NAT64 Configuration Guide 17

53-1002444-02

Advanced stateful NAT64 configuration

DRAFT: BROCADE CONFIDENTIAL

Host: foo.com\r\n

…

Connection: Keep-Alive\r\n

X-Forwarded-For: 2001:db8::6401:101\r\n

\r\n

NOTE

Client IP address insertion must be enabled for the port handling HTTP traffic. The ServerIron ADX

will not automatically detect HTTP traffic on any port.

NOTE

A client IP address will only be inserted for the first HTTP request in a TCP connection. This means

that for a keep-alive or pipelined request, the client IP address header is inserted for the first request

but not for subsequent requests.

Syntax: [no] nat64 http-client-ip-insertion {port <port> | acl <acl-name>} <header-string>

The port option enables client IP insertion for the <port> specified.

The acl option enables you to direct client IP insertion as defined by the ACL specified in the

<acl-name> variable.

The <header-string> variable enables you to specify a customized header. If no header is specified,

the default header of “X-Forwarded-For” is used.

To specify a different header name, enter a command such as the following:

ServerIron ADX(config)# nat64 http-client-ip-insertion port 80 “NAT64-CLIENT-IP”

In the example, the ServerIron ADX is configured to insert “NAT64-CLIENT-IP” as the header in

requests to an IPv4 server rather than the default header of “X-Forwarded-For”.

Configuring NAT64 packet fragmentation options

Reverse packets from the IPv4 server to the IPv6 client can be too large and must be split into two

IPv6 packets. The following describes the criteria for judging that packets are too large:

• Regular packets: IP packet total length greater than 1480 bytes

• Fragmented packets: IP packet total length greater than 1480 + 8 bytes

If the packets exceed these limitations, one of the following actions will be taken:

1. If the ipv6 frag-full-4to6 command is configured, the packet will be split and no further actions

will be performed.

2. If the condition in step 1 is not met, and the DF bit is set at the server, the “fragmentation

needed” ICMP error message will be sent.

3. If the conditions in steps 1 and 2 are not met, the packet will be split.

The ipv6 frag-full-4to6 command is configured as shown in the following example.

ServerIronADX(config)# ipv6 frag-full-4to6

Syntax: [no] ipv6 frag-full-4to6

1 2 ... 24 25 26 27 28 29 30 31 32 33 34 ... 148 149

No comments

Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 29