Turnkey BNG and CGNAT for ISPs: Enterprise Router Architecture & Sizing Guide

Based on the AsterNOS-VPP Broadband Network Gateway Technology White Paper V1.0 and the RT Series Enterprise Routing Platform Datasheet. Note: 'Not specified in white paper' indicates parameters omitted from the original document rather than unsupported product features. Metrics marked as 'Calculated' or 'Inferred' represent engineering deductions based on documented parameters rather than vendor guarantees. Figures marked as 'Industry Baseline' should be validated against telemetry from your live production network.

Executive Summary

• Solution Delivery: Instead of forcing network engineers to build, compile, and maintain DIY white-box DPDK/VPP software stacks, Asteraix delivers the comprehensive routing, BNG, and CGNAT capabilities of AsterNOS-VPP pre-installed and hardware-accelerated on RT2508 and RT3608 enterprise router series.

• Capacity Sizing by Deployment Model:

     - Pure BNG Termination Mode (CGNAT offloaded upstream): Supports up to 50,000 PPPoE / 100,000 IPoE active sessions per single node.

     - Integrated BNG + CGNAT Mode: Practical subscriber capacity is governed by CGNAT memory pools and peak concurrent connections per household, NOT the session table limit. Plan for 5,000–10,000 active homes on a 16 GB profile (RT2508 / RT3608 base), and 20,000–30,000 active homes on a 32 GB profile.

•  Hardware Agility & True TCO: Turnkey appliances powered by Marvell OCTEON 10 DPUs deliver line-rate routing (<60W on RT2508; <100W on RT3608) with zero per-subscriber session licensing fees, eliminating legacy chassis CapEx and unpredictable OpEx.

•  Dual-Stack & Feature Alignment: While this release's sizing and benchmark data specifically quantify IPv4 access and CGNAT resource consumption, full IPv4/IPv6 dual-stack access and hierarchical QoS (HQoS) are core platform capabilities actively supported and deployable based on customer network requirements.

1. Architectural Context: Distributed Edge vs. Centralized Chassis

1.1 The Business & Operational Case for Distributed BNG

Traditional centralized BNG architectures backhaul all subscriber traffic (typically encapsulated in QinQ VLANs) to a centralized core metro pop. In sparse, geographically dispersed regions, this creates severe engineering and economic penalties: every remote site requires dedicated long-haul transport links, and subscriber traffic travels long distances before reaching centralized CGNAT and transit exits, expanding the blast radius of network failures.

The Distributed BNG (dBNG) model terminates subscriber sessions directly at the access site and performs localized Carrier-Grade NAT (CGNAT), forwarding clean, routable public traffic directly into transit links. Backhaul links no longer carry raw Layer 2 QinQ subscriber frames, substantially reducing leased bandwidth requirements. Meanwhile, core AAA (RADIUS) and IPAM (DHCP) remain centralized, eliminating the need to duplicate user databases across sites.

1.2 Engineering Assumptions & Hardware Footprint

1. Topology: ONT/ONU → OLT → Aggregation Switch → RT2508 / RT3608 Router → Upstream IP Transit.

2. Hardware Platforms:

   • Asteraix RT2508: Powered by Marvell OCTEON 10 CN102 (8-Core ARM Neoverse N2 @ 2.5 GHz), 4x 10GE SFP+ + 4x 2.5GE + 8x 1GE, 16GB DDR5 (up to 48GB), 50 Gbps Routing / 58 Gbps Switching, 50 Gbps Crypto, fixed PSU & 2x fixed fans, <60W full-load power.

   • Asteraix RT3608: Powered by Marvell OCTEON 10 CN103 (8-Core ARM Neoverse N2 @ 2.5 GHz), 2x 100GE QSFP28 + 2x 10GE SFP+, 16GB DDR5 (up to 48GB), 100 Gbps Routing / 220 Gbps Switching, 100 Gbps True Inline Crypto, 1+1 Redundant PSU/Fans, <100W power.

3. Node Session Limits (White Paper): Up to 50,000 PPPoE sessions; up to 100,000 IPoE sessions.

4. Addressing & AAA: RFC 6598 (100.64.0.0/10) CGNAT with centralized RADIUS authentication and DHCPv4 relay.

1.3 Understanding Subscriber Sizing: Lab Limits vs. Production Baseline

1.4 Sizing Models: Pure BNG vs. Integrated BNG + CGNAT

2. Three Engineering Trade-offs in Edge Subscriber Access

2.1 State-Intensive Onboarding vs. Line-Rate Forwarding

Subscriber onboarding is an infrequent event involving complex state machine handshakes (PADI/PADO/PADR/PADS or DHCP), RADIUS queries, IP allocation, and session provisioning. Conversely, payload forwarding is an ultra-high-frequency event requiring minimal processing latency. AsterNOS-VPP decouples state creation from packet execution: the SONiC control plane handles AAA and session orchestration, offloading completed state objects to the VPP data plane, which forwards packets at line rate via hardware-accelerated vector processing.

2.2 Subscriber Identity Demarcation in Sessionless IPoE

While PPPoE enforces a clear cryptographic boundary via PPP encapsulation, IPoE runs natively over raw Ethernet. Identity must be synthesized from composite access contexts: Source MAC, Ingress Port/VLAN, DHCP Option 82 (Circuit-ID / Remote-ID), and the assigned IPv4 lease. Forwarding privileges must remain strictly gated until authentication and lease synchronization are verified.

2.3 The CGNAT Trilemma: IPv4 Sharing, Logging Overhead, and Fairness

A single public IPv4 address provides approximately 64,512 usable ports (excluding ports 1–1023). Maximizing sharing ratios conserves address space, but introduces critical constraints: high-connection clients can exhaust shared ports, per-session translation logging generates massive data volumes, and regulatory compliance demands tracing subscribers via Public IP + Port + Timestamp. CGNAT resolves these trade-offs via Port Block Allocation (PBA) to enforce fair resource limits and reduce logging overhead.

3. Disaggregated Architecture: SONiC Control & Hardware-Accelerated VPP

 State programming follows a strict path: SONiC / Business Logic → Switch Abstraction Interface (SAI) → libsaivpp → VPP. This provides complete protocol isolation and enables the VPP data plane to leverage Marvell OCTEON 10 DPU hardware packet accelerators directly.

3.1 Layer 2 Subscriber Gating for IPoE Sessions

1. VPP matches incoming traffic against {Ingress Interface + Source IPv4}, validating the Source MAC in L2 mode.

2. Unauthenticated clients are restricted exclusively to whitelisted DHCPv4 control frames.

3. Unmatched IPv4 traffic is dropped by default.

4. Forwarding authorization activates only after RADIUS Access-Accept, DHCP lease grant, and SAI/VPP objects are committed.

5. An integrated Timer Wheel in the data plane handles state expiration to purge stale entries automatically.

4. Comparative Evaluation Matrices

4.1 PPPoE vs. IPoE Protocol Comparison

4.2 Legacy Monolithic Chassis vs. Turnkey Disaggregated Appliances

5. The CGNAT Capacity Equation: Sizing RT2508 & RT3608

5.1 Memory vs. Session Tables

PPPoE Limit Invariance: The 50,000 limit remains identical on both 16 GB and 32 GB profiles. This ceiling is likely governed by control plane CPU polling threads, PPP state machine scheduling, or conservative qualification baselines in V1.0 rather than data plane memory.

5.2 Household Concurrency Realities: 16 GB vs. 32 GB Profiles

Production Impact: A modern broadband home routinely generates 200 to 500 concurrent NAT sessions during peak hours (Industry Baseline). Under a 16 GB profile, spreading 50,000 subscribers leaves an average of only 42 connections per home, causing port exhaustion. Therefore, recommended planning baselines for Integrated CGNAT Mode are:

• 16 GB Memory (RT2508 / RT3608): 5,000–10,000 Active Households (≈ 209–418 sessions/home).

• 32 GB Memory (RT2508 / RT3608): 20,000–30,000 Active Households (≈ 333–500 sessions/home).

5.3 Public Address Sizing (Calculated)

5.4 RFC 6888 Compliance Gap Analysis

• REQ-1: Supports TCP/UDP/ICMP; DCCP unsupported.

• REQ-4: Supports overall subscriber port limits; per-protocol quotas unsupported.

• REQ-9: PCP / explicit mapping protocols unsupported.

• REQ-10: Read-only monitoring via CLI and SNMP; SNMP SET unsupported.

• REQ-11: Rejects new mappings upon pool exhaustion rather than terminating active sessions.

• Supported Capabilities: Paired Pooling, Endpoint-Independent Filtering (EIF), port cooling timers, randomized port selection, and subscriber CPS rate-limiting.

6. Deployment Boundaries: Recommended Fits vs. Out of Scope

6.1 Recommended Scenarios

1. Distributed Regional Edge: Geographically distributed hubs serving thousands to tens of thousands of subscribers.

2. Centralized AAA with Lean Remote Sites: Operators using upstream RADIUS/DHCP looking to avoid distributed user databases.

3. Low-Power Edge Footprint: Deployments targeting compact ARM appliances (<60W RT2508 / <100W RT3608).

4. IPv4 Address Scarcity: Operators requiring PBA CGNAT, rate limiting, and block logging.

6.2 Scenarios Requiring Engineering Review

• Node High Availability (HA): Stateful session synchronization and hitless failover require validation for mission-critical remote sites.

• Saturating Node Maximums: Operating near 50k PPPoE or 100k IPoE leaves zero headroom on a single instance.

• 16 GB Profile with Heavy Concurrency: Concurrency above 10,000 users risks port block starvation under high connection workloads.

6.3 Scope Alignment and Future Roadmap Items

7. ISP Pre-Deployment & Acceptance Checklist

1. Forwarding Throughput: Measure 64B and IMIX pps/Gbps across pure routing, IPoE gating, and active CGNAT modes.

2. Session Setup Rates: Validate sustained PPPoE CPS, DHCP setup rates, and CGNAT connection-per-second thresholds.

3. Resilience & Recovery: Measure session recovery times following reboots, WAN flaps, and RADIUS unreachable scenarios.

4. Exhaustion Behavior: Observe error handling and alarm triggers when CGNAT session pools reach 100% saturation.

5. Syslog Volume: Verify external Syslog receiver capacity under peak port block allocation events.

6. Access Node Interoperability: Validate Option 82 circuit/remote ID formats against RADIUS authorization rules.

7. Accounting Mechanisms: Confirm accounting and billing integration for IPoE deployments.

8. Commercial Sizing: Validate turnkey hardware appliance requirements (RT2508 vs. RT3608) against target site subscriber counts.

Conclusion

AsterNOS-VPP pairs a modular SONiC control plane with a VPP data plane to deliver hardware-accelerated subscriber termination and integrated CGNAT on Asteraix RT2508 and RT3608 enterprise routers. When evaluating capacity, deployers must distinguish between pure protocol limits (50k PPPoE / 100k IPoE) and practical CGNAT memory bounds (5k–10k homes on 16 GB; 20k–30k homes on 32 GB). Asteraix RT2508 and RT3608 offer an agile, cost-effective fit for ISPs seeking to eliminate monolithic chassis expenses in distributed deployments, delivering enterprise routing performance without per-subscriber licensing taxes.