> Source: [sk113175](https://support.checkpoint.com/results/sk/sk113175)

# sk113175 - Traffic from IPv6 host to IPv4 host is dropped by ClusterXL High Availability mode, instead of applying NAT64 rule

| Property | Value |
|----------|-------|
| Solution ID | sk113175 |
| Date Created | 2016-09-07 |
| Last Modified | 2017-06-21 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Traffic from IPv6 host to IPv4 host does not pass through ClusterXL High Availability mode.

  Topology:  

  \[IPv6 Client\] --\> (IPv6 NATed address of Server)\[ClusterXL\](NAT64 to Real IPv4 address of Server) --\> \[IPv4 Server\]  

  IPv6 Client communicates with IPv4 Server at IPv6 NATed IP address of the Server (need to allow IPv6 users to access IPv4 resources).
* Kernel debug ('`fw6 ctl zdebug + drop`') on ClusterXL Active member shows that the traffic sent from the IPv6 Client to the IPv6 NATed IP address of the Server is dropped:  

  `;fw_log_drop_ex: Packet proto=58 `*IPv6_of_Client*` -> `*IPv6_NATed_address_of_Server*` dropped by fwchain_reject_mtu Reason: rejected;`

* The same traffic passes as expected (undergoes NAT64) if ClusterXL HA mode is replaced by a single Security Gateway, or a VRRP cluster.

## Cause

By the current design, the 6to4 NAT translation is performed on the outbound traffic at the "Server" side:  
\[IPv6 Client\] --\> (NATed IPv6 of Server)\[ClusterXL\](6to4 NAT) --\> \[IPv4 Server\]

If there is no route for the original IPv6 destination, ClusterXL returns an unreachable error before passing the traffic through the outbound.  
For this reason, using an IPv6 from the "Client" side network as original destination would fail.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content