CGNAT Configuration

Configure CGNAT

To deploy CGNAT functionalities in an RBFS device, you must complete the following configurations:

  • NAT Profile

  • NAT Pool

  • NAT Service Profile Configuration

  • Enable NAT Service Profile on the Access Interface

The following sections provide the commands to configure RBFS CGNAT. For more information about CGNAT configuration, see CGNAT Configuration Guide.

NAT Profile Configuration

Run the following commands to configure NAT profile. A NAT profile defines how the NAT device has to perform the IPv4 address translation. You can create NAT profile for an RBFS instance using the 'instance' option. Also, it allows you to define the TCP or UDP traffic type for the profile.

set forwarding-options address-translation profile NAT_PROFILE
set forwarding-options address-translation profile NAT_PROFILE pool NAT_POOL
set forwarding-options address-translation profile NAT_PROFILE max-rules 2048
set forwarding-options address-translation profile NAT_PROFILE deterministic true
set forwarding-options address-translation profile NAT_PROFILE ip-protocol tcp ageing-timeout 200
set forwarding-options address-translation profile NAT_PROFILE ip-protocol tcp control-plane-ageing-timeout 10
set forwarding-options address-translation profile NAT_PROFILE ip-protocol udp ageing-timeout 200
set forwarding-options address-translation profile NAT_PROFILE ip-protocol udp control-plane-ageing-timeout 30
set forwarding-options address-translation profile NAT_PROFILE ip-protocol other ageing-timeout 300

NAT profile configuration is shown below:

supervisor@rtbrick: op> show config forwarding-options address-translation profile
{
  "rtbrick-config:profile": [
    {
      "profile": "NAT_PROFILE",
      "pool": "NAT_POOL",
      "max-rules": "2048",
      "deterministic": "true",
      "ip-protocol": {
        "tcp": {
          "ageing-timeout": 200,
          "control-plane-ageing-timeout": 10
        },
        "udp": {
          "ageing-timeout": 200,
          "control-plane-ageing-timeout": 30
        },
        "other": {
          "ageing-timeout": 300
        }
      }
    }
  ]
}

NAT Pool Configuration

Run the following commands to create IPv4 address pools. A pool includes a range of public IPv4 addresses. You can define the group of public IPs belonging to that pool by specifying the lowest and highest IP addresses for the pool. The default port block size is 32, which cannot be changed.

set forwarding-options address-translation pool NAT_POOL
set forwarding-options address-translation pool NAT_POOL ipv4-address low 198.51.100.201
set forwarding-options address-translation pool NAT_POOL ipv4-address high 198.51.100.220

NAT Pool configuration is shown below:

supervisor@rtbrick: op> show config forwarding-options address-translation pool
{
  "rtbrick-config:pool": [
    {
      "pool-name": "NAT_POOL",
      "ipv4-address": {
        "low": "198.51.100.201",
        "high": "198.51.100.220"
      }
    }
  ]
}

NAT Service Profile Configuration

One must create a NAT service profile and attach the service profile with the access interface for enabling CGNAT on the interface.

set access service-profile subs_service
set access service-profile subs_service address-translation profile NAT_PROFILE
set access service-profile subs_service qos profile subs-1q-profile

Enable NAT Service Profile on the Access Interface

It is required to enable the NAT service profile created on the access interface. Run the following commands to enable the NAT service profile on the interface. A service profile named subs_service and a profile named nat_profile1 are configured.

The following configuration attaches the access interface ifp-0/1/40 with the service profile subs_service for the PPPoE and IPoE subscribers.

set access interface double-tagged ifp-0/1/23 1001 1100 1001 1100
set access interface double-tagged ifp-0/1/23 1001 1100 1001 1100 access-type PPPoE
set access interface double-tagged ifp-0/1/23 1001 1100 1001 1100 access-profile-name pppoe
set access interface double-tagged ifp-0/1/23 1001 1100 1001 1100 service-profile-name subs_service
set access interface double-tagged ifp-0/1/23 1001 1100 1001 1100 aaa-profile-name aaa-profile
set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100
set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100 access-type IPoE
set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100 access-profile-name ipoe
set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100 service-profile-name subs_service
set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100 aaa-profile-name aaa-profile
set access interface double-tagged ifp-0/1/23 2001 2100 1001 1100 gateway-ifl lo-0/0/1/0

The configuration for attaching the service profile with the access interface is shown below:

supervisor@rtbrick: op> show config access interface
{
  "rtbrick-config:interface": {
    "double-tagged": [
      {
        "interface-name": "ifp-0/1/23",
        "outer-vlan-min": 2001,
        "outer-vlan-max": 2100,
        "inner-vlan-min": 1001,
        "inner-vlan-max": 1100,
        "access-type": "IPoE",
        "access-profile-name": "ipoe",
        "service-profile-name": "subs_service",
        "aaa-profile-name": "aaa-profile",
        "gateway-ifl": "lo-0/0/1/0"
      },
      {
        "interface-name": "ifp-0/1/23",
        "outer-vlan-min": 1001,
        "outer-vlan-max": 1100,
        "inner-vlan-min": 1001,
        "inner-vlan-max": 1100,
        "access-type": "PPPoE",
        "access-profile-name": "pppoe",
        "service-profile-name": "subs_service",
        "aaa-profile-name": "aaa-profile"
      }
    ]
  }
}

Address Translation Show Command Examples

The following output shows the IP address and port-range allocations assigned to each subscriber by the address translation service.

supervisor@rtbrick: op> show address-translation allocation user
User                             Original Address     Translated Address   Port Range
ppp-0/1/8/72339069014638594      203.0.113.2          198.51.100.207        1024 - 1055
ppp-0/1/8/72339069014638595      203.0.113.3          198.51.100.208        1024 - 1055
ppp-0/1/8/72339069014638596      203.0.113.4          198.51.100.209        1024 - 1055
ppp-0/1/8/72339069014638597      203.0.113.5          198.51.100.210        1024 - 1055
ppp-0/1/8/72339069014638598      203.0.113.1          198.51.100.206        1024 - 1055
ipoe-0/1/10/216454257090494465   203.0.113.65         198.51.100.201        1024 - 1055
ipoe-0/1/10/216454257090494466   203.0.113.66         198.51.100.202        1024 - 1055
ipoe-0/1/10/216454257090494467   203.0.113.67         198.51.100.203        1024 - 1055
ipoe-0/1/10/216454257090494468   203.0.113.68         198.51.100.204        1024 - 1055
ipoe-0/1/10/216454257090494469   203.0.113.69         198.51.100.205        1024 - 1055

The following output shows the active address translation rules, including the original and translated addresses, ports, protocols, and traffic direction for each subscriber.

supervisor@rtbrick: op> show address-translation rule
Instance: default
User                             Protocol   Original Address        Translated Address      Direction
ppp-0/1/8/72339069014638598      tcp        203.0.113.1, 60001      198.51.100.206, 1028    Both
ppp-0/1/8/72339069014638594      tcp        203.0.113.2, 60001      198.51.100.207, 1027    Both
ppp-0/1/8/72339069014638595      tcp        203.0.113.3, 60001      198.51.100.208, 1026    Both
ppp-0/1/8/72339069014638596      tcp        203.0.113.4, 60001      198.51.100.209, 1027    Both
ppp-0/1/8/72339069014638597      tcp        203.0.113.5, 60001      198.51.100.210, 1026    Both
ipoe-0/1/10/216454257090494465   tcp        203.0.113.65, 60001     198.51.100.201, 1024    Both
ipoe-0/1/10/216454257090494466   tcp        203.0.113.66, 60001     198.51.100.202, 1027    Both
ipoe-0/1/10/216454257090494467   tcp        203.0.113.67, 60001     198.51.100.203, 1028    Both
ipoe-0/1/10/216454257090494468   tcp        203.0.113.68, 60001     198.51.100.204, 1024    Both
ipoe-0/1/10/216454257090494469   tcp        203.0.113.69, 60001     198.51.100.205, 1028    Both
ppp-0/1/8/72339069014638598      tcp        203.0.113.1, 60002      198.51.100.206, 1024    Both
ppp-0/1/8/72339069014638594      tcp        203.0.113.2, 60002      198.51.100.207, 1026    Both
ppp-0/1/8/72339069014638595      tcp        203.0.113.3, 60002      198.51.100.208, 1027    Both
ppp-0/1/8/72339069014638596      tcp        203.0.113.4, 60002      198.51.100.209, 1026    Both
ppp-0/1/8/72339069014638597      tcp        203.0.113.5, 60002      198.51.100.210, 1025    Both
ipoe-0/1/10/216454257090494465   tcp        203.0.113.65, 60002     198.51.100.201, 1028    Both
ipoe-0/1/10/216454257090494466   tcp        203.0.113.66, 60002     198.51.100.202, 1026    Both
ipoe-0/1/10/216454257090494467   tcp        203.0.113.67, 60002     198.51.100.203, 1024    Both
ipoe-0/1/10/216454257090494468   tcp        203.0.113.68, 60002     198.51.100.204, 1028    Both
ipoe-0/1/10/216454257090494469   tcp        203.0.113.69, 60002     198.51.100.205, 1027    Both
ppp-0/1/8/72339069014638598      tcp        203.0.113.1, 60003      198.51.100.206, 1027    Both
ppp-0/1/8/72339069014638594      tcp        203.0.113.2, 60003      198.51.100.207, 1028    Both
ppp-0/1/8/72339069014638595      tcp        203.0.113.3, 60003      198.51.100.208, 1025    Both
ppp-0/1/8/72339069014638596      tcp        203.0.113.4, 60003      198.51.100.209, 1025    Both
ppp-0/1/8/72339069014638597      tcp        203.0.113.5, 60003      198.51.100.210, 1027    Both
ipoe-0/1/10/216454257090494465   tcp        203.0.113.65, 60003     198.51.100.201, 1027    Both
ipoe-0/1/10/216454257090494466   tcp        203.0.113.66, 60003     198.51.100.202, 1028    Both
ipoe-0/1/10/216454257090494467   tcp        203.0.113.67, 60003     198.51.100.203, 1027    Both
ipoe-0/1/10/216454257090494468   tcp        203.0.113.68, 60003     198.51.100.204, 1027    Both
ipoe-0/1/10/216454257090494469   tcp        203.0.113.69, 60003     198.51.100.205, 1024    Both
ppp-0/1/8/72339069014638598      tcp        203.0.113.1, 60004      198.51.100.206, 1026    Both
ppp-0/1/8/72339069014638594      tcp        203.0.113.2, 60004      198.51.100.207, 1025    Both
ppp-0/1/8/72339069014638595      tcp        203.0.113.3, 60004      198.51.100.208, 1024    Both
ppp-0/1/8/72339069014638596      tcp        203.0.113.4, 60004      198.51.100.209, 1028    Both
ppp-0/1/8/72339069014638597      tcp        203.0.113.5, 60004      198.51.100.210, 1024    Both
ipoe-0/1/10/216454257090494465   tcp        203.0.113.65, 60004     198.51.100.201, 1025    Both
ipoe-0/1/10/216454257090494466   tcp        203.0.113.66, 60004     198.51.100.202, 1025    Both
ipoe-0/1/10/216454257090494467   tcp        203.0.113.67, 60004     198.51.100.203, 1026    Both
ipoe-0/1/10/216454257090494468   tcp        203.0.113.68, 60004     198.51.100.204, 1025    Both
ipoe-0/1/10/216454257090494469   tcp        203.0.113.69, 60004     198.51.100.205, 1026    Both
ppp-0/1/8/72339069014638598      tcp        203.0.113.1, 60005      198.51.100.206, 1025    Both
ppp-0/1/8/72339069014638594      tcp        203.0.113.2, 60005      198.51.100.207, 1024    Both
ppp-0/1/8/72339069014638595      tcp        203.0.113.3, 60005      198.51.100.208, 1028    Both
ppp-0/1/8/72339069014638596      tcp        203.0.113.4, 60005      198.51.100.209, 1024    Both
ppp-0/1/8/72339069014638597      tcp        203.0.113.5, 60005      198.51.100.210, 1028    Both
ipoe-0/1/10/216454257090494465   tcp        203.0.113.65, 60005     198.51.100.201, 1026    Both
ipoe-0/1/10/216454257090494466   tcp        203.0.113.66, 60005     198.51.100.202, 1024    Both
ipoe-0/1/10/216454257090494467   tcp        203.0.113.67, 60005     198.51.100.203, 1025    Both
ipoe-0/1/10/216454257090494468   tcp        203.0.113.68, 60005     198.51.100.204, 1026    Both
ipoe-0/1/10/216454257090494469   tcp        203.0.113.69, 60005     198.51.100.205, 1025    Both
ppp-0/1/8/72339069014638598      udp        203.0.113.1, 60001      198.51.100.206, 1028    Both
ppp-0/1/8/72339069014638594      udp        203.0.113.2, 60001      198.51.100.207, 1027    Both
ppp-0/1/8/72339069014638595      udp        203.0.113.3, 60001      198.51.100.208, 1027    Both
ppp-0/1/8/72339069014638596      udp        203.0.113.4, 60001      198.51.100.209, 1026    Both
ppp-0/1/8/72339069014638597      udp        203.0.113.5, 60001      198.51.100.210, 1026    Both
ipoe-0/1/10/216454257090494465   udp        203.0.113.65, 60001     198.51.100.201, 1028    Both
ipoe-0/1/10/216454257090494466   udp        203.0.113.66, 60001     198.51.100.202, 1027    Both
ipoe-0/1/10/216454257090494467   udp        203.0.113.67, 60001     198.51.100.203, 1028    Both
ipoe-0/1/10/216454257090494468   udp        203.0.113.68, 60001     198.51.100.204, 1028    Both
ipoe-0/1/10/216454257090494469   udp        203.0.113.69, 60001     198.51.100.205, 1024    Both
ppp-0/1/8/72339069014638598      udp        203.0.113.1, 60002      198.51.100.206, 1027    Both
ppp-0/1/8/72339069014638594      udp        203.0.113.2, 60002      198.51.100.207, 1026    Both
ppp-0/1/8/72339069014638595      udp        203.0.113.3, 60002      198.51.100.208, 1026    Both
ppp-0/1/8/72339069014638596      udp        203.0.113.4, 60002      198.51.100.209, 1027    Both
ppp-0/1/8/72339069014638597      udp        203.0.113.5, 60002      198.51.100.210, 1025    Both
ipoe-0/1/10/216454257090494465   udp        203.0.113.65, 60002     198.51.100.201, 1024    Both
ipoe-0/1/10/216454257090494466   udp        203.0.113.66, 60002     198.51.100.202, 1026    Both
ipoe-0/1/10/216454257090494467   udp        203.0.113.67, 60002     198.51.100.203, 1027    Both
ipoe-0/1/10/216454257090494468   udp        203.0.113.68, 60002     198.51.100.204, 1024    Both
ipoe-0/1/10/216454257090494469   udp        203.0.113.69, 60002     198.51.100.205, 1028    Both
ppp-0/1/8/72339069014638598      udp        203.0.113.1, 60003      198.51.100.206, 1024    Both
ppp-0/1/8/72339069014638594      udp        203.0.113.2, 60003      198.51.100.207, 1025    Both
ppp-0/1/8/72339069014638595      udp        203.0.113.3, 60003      198.51.100.208, 1028    Both
ppp-0/1/8/72339069014638596      udp        203.0.113.4, 60003      198.51.100.209, 1025    Both
ppp-0/1/8/72339069014638597      udp        203.0.113.5, 60003      198.51.100.210, 1024    Both
ipoe-0/1/10/216454257090494465   udp        203.0.113.65, 60003     198.51.100.201, 1027    Both
ipoe-0/1/10/216454257090494466   udp        203.0.113.66, 60003     198.51.100.202, 1025    Both
ipoe-0/1/10/216454257090494467   udp        203.0.113.67, 60003     198.51.100.203, 1024    Both
ipoe-0/1/10/216454257090494468   udp        203.0.113.68, 60003     198.51.100.204, 1027    Both
ipoe-0/1/10/216454257090494469   udp        203.0.113.69, 60003     198.51.100.205, 1027    Both
ppp-0/1/8/72339069014638598      udp        203.0.113.1, 60004      198.51.100.206, 1026    Both
ppp-0/1/8/72339069014638594      udp        203.0.113.2, 60004      198.51.100.207, 1028    Both
ppp-0/1/8/72339069014638595      udp        203.0.113.3, 60004      198.51.100.208, 1025    Both
ppp-0/1/8/72339069014638596      udp        203.0.113.4, 60004      198.51.100.209, 1024    Both
ppp-0/1/8/72339069014638597      udp        203.0.113.5, 60004      198.51.100.210, 1027    Both
ipoe-0/1/10/216454257090494465   udp        203.0.113.65, 60004     198.51.100.201, 1026    Both
ipoe-0/1/10/216454257090494466   udp        203.0.113.66, 60004     198.51.100.202, 1028    Both
ipoe-0/1/10/216454257090494467   udp        203.0.113.67, 60004     198.51.100.203, 1026    Both
ipoe-0/1/10/216454257090494468   udp        203.0.113.68, 60004     198.51.100.204, 1026    Both
ipoe-0/1/10/216454257090494469   udp        203.0.113.69, 60004     198.51.100.205, 1025    Both
ppp-0/1/8/72339069014638598      udp        203.0.113.1, 60005      198.51.100.206, 1025    Both
ppp-0/1/8/72339069014638594      udp        203.0.113.2, 60005      198.51.100.207, 1024    Both
ppp-0/1/8/72339069014638595      udp        203.0.113.3, 60005      198.51.100.208, 1024    Both
ppp-0/1/8/72339069014638596      udp        203.0.113.4, 60005      198.51.100.209, 1028    Both
ppp-0/1/8/72339069014638597      udp        203.0.113.5, 60005      198.51.100.210, 1028    Both
ipoe-0/1/10/216454257090494465   udp        203.0.113.65, 60005     198.51.100.201, 1025    Both
ipoe-0/1/10/216454257090494466   udp        203.0.113.66, 60005     198.51.100.202, 1024    Both
ipoe-0/1/10/216454257090494467   udp        203.0.113.67, 60005     198.51.100.203, 1025    Both
ipoe-0/1/10/216454257090494468   udp        203.0.113.68, 60005     198.51.100.204, 1025    Both
ipoe-0/1/10/216454257090494469   udp        203.0.113.69, 60005     198.51.100.205, 1026    Both
ppp-0/1/8/72339069014638598      icmp       203.0.113.1, 256        198.51.100.206, 1024    Both
ppp-0/1/8/72339069014638594      icmp       203.0.113.2, 256        198.51.100.207, 1024    Both
ppp-0/1/8/72339069014638595      icmp       203.0.113.3, 256        198.51.100.208, 1024    Both
ppp-0/1/8/72339069014638596      icmp       203.0.113.4, 256        198.51.100.209, 1024    Both
ppp-0/1/8/72339069014638597      icmp       203.0.113.5, 256        198.51.100.210, 1024    Both
ipoe-0/1/10/216454257090494465   icmp       203.0.113.65, 256       198.51.100.201, 1024    Both
ipoe-0/1/10/216454257090494466   icmp       203.0.113.66, 256       198.51.100.202, 1024    Both
ipoe-0/1/10/216454257090494467   icmp       203.0.113.67, 256       198.51.100.203, 1024    Both
ipoe-0/1/10/216454257090494468   icmp       203.0.113.68, 256       198.51.100.204, 1024    Both
ipoe-0/1/10/216454257090494469   icmp       203.0.113.69, 256       198.51.100.205, 1024    Both

The following output shows a summary of the dynamically created address translation rules by protocol and the total number of dynamic rules.

supervisor@rtbrick: op> show address-translation rule summary
Instance: default
  Source     Protocol      Rules
  Dynamic    tcp              50
  Dynamic    udp              50
  Dynamic    other            10
  Total Dynamic Rules        110

The following output shows the number of successful and failed address translation traps processed for each protocol.

supervisor@rtbrick: op> show address-translation trap statistics
Protocol   Flags                     Status             Count
tcp        -|syn|-|-|-|-|-|-|-       Success             8630
udp        -|-|-|-|-|-|-|-|-         Success             8651
other      -|-|-|-|-|-|-|-|-         Success              500
Total Successful Traps:                                 17781
Total Failed Traps:                                         0

The following output shows address translation errors, including the associated error type, counter value, and the timestamps of the current and last updates.

supervisor@rtbrick: op> show address-translation error
CONTROL_PLANE - Control Rule Not found
    Counter        : 10
    Current Update : Fri Aug 21 14:23:32 GMT +0000 2026
    Last Update    : Fri Aug 21 14:23:32 GMT +0000 2026
PACKET - TCP CTRL Processed
    Counter        : 17181
    Current Update : Fri Aug 21 14:23:30 GMT +0000 2026
    Last Update    : Fri Aug 21 14:23:30 GMT +0000 2026