Thanks. I’ve done some practices based on your example. It’s all fine. I have a better understanding of NAT-PT now.

BR

If you look at the list closely, you would see that the source is actually “any” and 2000::/96 (the NAT prefix) is the destinaiton. Therefore the access-list matches any IPv6 traffic destined to IPv6 NAT prefix.

Within your example you used, your IPV6 access-list macthed the IPV6 nat prefix in stead of matching the source address of incoming packets. Is this correct or just a mistyped command ?

Regards

Well they invented IPv6 just so that you won’t need to do any NAT

Actually, even NAT-PT is considered as a historic transition mechanism, because of it’s poor scalability and application layer issues.

If you want access restrictions use IPv6 firewalls, and if you use site-local IPv6 addressing either deploy a global IPv6 addressing or use application level proxies..

Remember, NAT is a hack, and you’d better avoid it at any cost

Thanks for this, I was wondering however if there is any way to do simple IPv6 to IPv6 NAT or PAT?

Currently a lot of businesses use private addressing for the security aspect of it, so the internet cannot directly access their devices - is there any way to do this in IPv6 or do you require the use of firewalls / ACL’s?

Thanks