NAT and CGNAT
NAT configuration lives in the nat view. Public pools are keyed by name and apply on restart, because a pool index is boot-stable and embedded in every outstanding CGNAT block; the policy list that references them applies live.
Deterministic port blocks
Each inside address gets a fixed block of ports on a public address. Block size must be a power of two, and deterministic mode emits one compliance log per block per RFC 7422. Because blocks are deterministic, who held public IP X port Y at time T is answerable from a single self-contained record rather than a per-flow archive.
system-view
nat enable
nat conntrack-max 2097152
nat udp-mapping endpoint-independent
nat pool add pub1 203.0.113.10-203.0.113.20 \
ports 1024-65535 block 512 deterministic
nat policy add nat-rule 100.64.0.0/10 pool pub1
cgnat fragments mode cache
commit
save
Fragment handling
Non-first fragments carry no L4 header, so plain NAPT drops them and the datagram never reassembles — large-UDP applications freeze. Cache mode, the default, records the first fragment’s translation and applies the same IP rewrite to the trailing fragments (virtual reassembly per RFC 6888 REQ-11) with no physical reassembly cost. It requires all fragments of a datagram to reach the same worker, so hash IPv4 by the 2-tuple in NIC RSS.
cgnat fragments mode cache cgnat fragments timeout 30 show cgnat fragments
Destination NAT
DSTNAT is the outside-to-inside mirror of the policy list, so a service behind CGNAT can be reached from the Internet. Return traffic needs no rule: the first inbound packet creates a conntrack entry whose reply key is the inside-to-peer tuple. Ownership is enforced — the BNG verifies the inside subscriber genuinely owns that public address and port from its deterministic block, so one customer can never hijack another’s public address.
nat dstnat add 203.0.113.5 proto tcp dport 8080 \
to 100.64.0.9 to-port 80
commit
show nat dstnat
Diagnosing a one-way UDP freeze
When a subscriber’s TX drops to zero while RX stays high, show nat statistics splits the reason at the point a WAN reply is reverse-translated: translation misses, stale-mapping drops, expired-mapping hits, fragment-miss drops, and translation hits. If translation hits climb while TX is still zero, the loss is downstream of NAT. Clear the counters at the start of a freeze, let it run about 30 seconds, then read which one moved.
clear counters nat show nat statistics detail show nat session 100.64.0.9