Systems and methods for translating IPV6 packets for DIA in an SD-WAN environment
In one embodiment, a method includes determining, by a router, a common prefix pool from a transport interface associated with a transport virtual private network (VPN). The method also includes identifying, by the router, a prefix associated with a service VPN and generating, by the router, an IPv6-to-IPv6 Network Address Translation (NAT66) prefix translation using the common prefix pool and the prefix. The NAT66 prefix translation includes a predetermined prefix length. The method further includes automatically installing, by the router, the NAT66 prefix translation into a translation table.
1. A router comprising one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors and including instructions that, when executed by the one or more processors, cause the router to perform operations comprising:
determining a common prefix pool from a transport interface associated with a transport virtual private network (VPN);
identifying a prefix associated with a service VPN;
generating an IPv6-to-IPv6 Network Address Translation (NAT66) prefix translation using the common prefix pool and the prefix, wherein the NAT66 prefix translation comprises a predetermined prefix length;
automatically installing the NAT66 prefix translation into a translation table;
receiving an IPv6 Internet Control Message Protocol (ICMPv6) packet from a branch router, wherein the ICMPv6 packet comprises the prefix associated with the service VPN;
translating the prefix using the NAT66 prefix translation;
supporting IPv6 Path Maximum Transmission Unit (IPv6 PMTU) Discovery natively; and
performing an inside-to-outside and an outside-to-inside translation for a payload of the ICMPv6 packet.
2. The router of claim 1 , the operations further comprising:
refreshing a predetermined session time period associated with the NAT66 prefix translation each time a packet is translated using the NAT66 prefix translation within the predetermined session time period;
expiring the NAT66 prefix translation after in response to inactivity of the NAT66 prefix translation for the predetermined session time period; and
reusing an entry for the NAT66 prefix translation after a predetermined expiration time period.
3. The router of claim 1 , the operations further comprising dynamically embedding an identifier of the service VPN into a header of the NAT66 prefix translation.
4. The router of claim 1 , the operations further comprising directing incoming traffic to the transport interface in accordance with a centralized data policy.
5. The router of claim 1 , the operations further comprising:
assigning an IPv6 address prefix to the transport interface using an IPv6 generic prefix from an IPv6 neighbor discovery (ND) advertisement; and
performing IPv6 duplicate address detection (DAD).
6. The router of claim 1 , further comprising dynamically updating an address associated with the transport interface, the common prefix pool, and the translation table.
7. A method, comprising:
determining, by a router, a common prefix pool from a transport interface associated with a transport virtual private network (VPN);
identifying, by the router, a prefix associated with a service VPN;
generating, by the router, an IPv6-to-IPv6 Network Address Translation (NAT66) prefix translation using the common prefix pool and the prefix, wherein the NAT66 prefix translation comprises a predetermined prefix length;
automatically installing, by the router, the NAT66 prefix translation into a translation table;
receiving, by the router, an IPv6 Internet Control Message Protocol (ICMPv6) packet from a branch router, wherein the ICMPv6 packet comprises the prefix associated with the service VPN;
translating, by the router, the prefix using the NAT66 prefix translation;
supporting, by the router, IPv6 Path Maximum Transmission Unit (IPv6 PMTU) Discovery natively; and
performing an inside-to-outside and an outside-to-inside translation for a payload of the ICMPv6 packet.
8. The method of claim 7 , further comprising:
refreshing, by the router, a predetermined session time period associated with the NAT66 prefix translation each time a packet is translated using the NAT66 prefix translation within the predetermined session time period;
expiring, by the router, the NAT66 prefix translation after in response to inactivity of the NAT66 prefix translation for the predetermined session time period; and
reusing, by the router, an entry for the NAT66 prefix translation after a predetermined expiration time period.
9. The method of claim 7 , further comprising dynamically embedding an identifier of the service VPN into a header of the NAT66 prefix translation.
10. The method of claim 7 , further comprising directing, by the router, incoming traffic to the transport interface in accordance with a centralized data policy.
11. The method of claim 7 , further comprising:
assigning, by the router, an IPv6 address prefix to the transport interface using an IPv6 generic prefix from an IPv6 neighbor discovery (ND) advertisement; and
performing, by the router, IPv6 duplicate address detection (DAD).
12. The method of claim 7 , further comprising dynamically updating, by the router, an address associated with the transport interface, the common prefix pool, and the translation table.
13. One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause the processor to perform operations comprising:
determining a common prefix pool from a transport interface associated with a transport virtual private network (VPN);
identifying a prefix associated with a service VPN;
generating an IPv6-to-IPv6 Network Address Translation (NAT66) prefix translation using the common prefix pool and the prefix, wherein the NAT66 prefix translation comprises a predetermined prefix length;
automatically installing the NAT66 prefix translation into a translation table;
receiving an IPv6 Internet Control Message Protocol (ICMPv6) packet from a branch router, wherein the ICMPv6 packet comprises the prefix associated with the service VPN;
translating the prefix using the NAT66 prefix translation;
supporting IPv6 Path Maximum Transmission Unit (IPv6 PMTU) Discovery natively; and
performing an inside-to-outside and an outside-to-inside translation for a payload of the ICMPv6 packet.
14. The one or more computer-readable non-transitory storage media of claim 13 , the operations further comprising:
refreshing a predetermined session time period associated with the NAT66 prefix translation each time a packet is translated using the NAT66 prefix translation within the predetermined session time period;
expiring the NAT66 prefix translation after in response to inactivity of the NAT66 prefix translation for the predetermined session time period; and
reusing an entry for the NAT66 prefix translation after a predetermined expiration time period.
15. The one or more computer-readable non-transitory storage media of claim 13 , the operations further comprising dynamically embedding an identifier of the service VPN into a header of the NAT66 prefix translation.
16. The one or more computer-readable non-transitory storage media of claim 13 , the operations further comprising directing incoming traffic to the transport interface in accordance with a centralized data policy.
17. The one or more computer-readable non-transitory storage media of claim 13 , the operations further comprising:
assigning an IPv6 address prefix to the transport interface using an IPv6 generic prefix from an IPv6 neighbor discovery (ND) advertisement; and
performing IPv6 duplicate address detection (DAD).