Microsoft extends Windows 11 464XLAT support to include fixed-line networks
New phase in changeover from IPv4 to IPv6 requires appropriate transition mechanisms
New phase in changeover from IPv4 to IPv6 requires appropriate transition mechanisms
Microsoft has announced plans to extend support for the 464XLAT transition mechanism in Windows 11. At present, Windows 11 supports only CLAT for mobile networks, but a future version will also provide support for other network interfaces. It will then be possible to enable 464XLAT on fixed-line networks as well.
Generic support for 464XLAT is important now that we appear to have passed a critical tipping point in the transition from IPv4 to IPv6. The reason being that, having passed peak IPv4, we need to make use of a different type of transition mechanism. Until now, IPv4 has been taken as the basis, and IPv6 has been superimposed or enabled alongside IPv4. However, such 'first-generation' transition mechanisms are no longer appropriate and should be regarded as legacy.
IPv6 should now form the starting point, with access to IPv4-only hosts enabled as an IPv6-based service. Applying that principle in combination with the NSA's security recommendations, only 3 transition mechanisms should be considered for access networks: NAT64, DNS64 and 464XLAT.
NAT64 is a NAT technology that enables IPv6-only clients behind a NAT64 gateway to communicate with IPv4-only systems on the internet. To do so, the clients behind the gateway use a special IPv6 prefix in combination with the IPv4 destination address. The resulting packets are internally routed to the NAT64 gateway, which then establishes an IPv4 connection to the outside world for the client.
DNS64 supplements the NAT64 mechanism. If a caching resolver with DNS64 support receives a request for the AAAA-records for a domain name, but only A records are available, the server creates a (synthetic) AAAA resource record set for the NAT64 configuration. The combination of NAT64 and DNS64 yields a complete transition mechanism, for which no modifications to individual IPv6-only systems are required.
Finally, 464XLAT works in much the same way as DNS64, but the NAT64 destination address is compiled by the CLAT function in the network stack on the client. Applications therefore see both an IPv6 interface and an IPv4 interface (as with a dual-stack), meaning that 464XLAT also works with protocols that include IPv4 literals.
Although a DNS64 server isn't necessarily required for 464XLAT, one can still be used for traffic that definitely does not contain literals (i.e. for applications that don't use them). The advantage of 464XLAT is that the client doesn't need a (routable) IPv4 address, but IPv4 literals continue to work. The latter feature is vital for applications that don't send AAAA queries [Signal desktop].
464XLAT has traditionally been used on mobile networks because it enables large numbers of end users to be connected. However, as explained above, the transition mechanism should now be the norm on fixed-line networks as well. Guidance on the use of NAT64, DNS64 and 464XLAT on operator and enterprise networks is provided in RFC 8683.
Microsoft's announcement refers to implementation of the CLAT function in the network stack for fixed-line connections, and setting corresponding options on the stub resolver and the DHCP client. Apple's macOS desktop operating system has supported 464XLAT for some time now, [1] and the clatd daemon is available for Linux.
For detailed information about NAT64, DNS64 and 464XLAT, see our IPv6 FAQs.