Glossary

CGNAT

Carrier-Grade Network Address Translation

What is CGNAT

CGNAT (Carrier-Grade NAT), also known as Large-Scale NAT (LSN), is a type of network address translation used by Internet Service Providers (ISPs) to let large numbers of subscribers share a small pool of public IPv4 addresses. Instead of assigning each customer a dedicated public IP, the ISP performs an additional layer of address translation inside its own network, extending the usable life of IPv4 while IPv6 adoption continues to grow. The standards and requirements for CGNAT are defined in RFC 6888.

CGNAT exists because the global supply of IPv4 addresses ran out on November 25, 2019, while IPv6 — despite being widely supported today — is still not universally deployed across servers, applications, and legacy infrastructure. Migrating every device and service to IPv6 is neither quick nor cheap, so most operators need a bridge that keeps IPv4 usable during the transition. CGNAT is that bridge.

How CGNAT Works

CGNAT applies the same idea as the NAT running on a home router, but one layer further out, at the ISP’s network edge.

On a typical home network, several devices behind a router share one public IP address; the private address ranges reserved for this purpose are defined in RFC 1918.

CGNAT repeats this pattern at carrier scale:

1. Instead of assigning a routable public IP to the customer router’s WAN interface, the ISP assigns an address from the shared carrier-grade range defined in RFC 6598.

2. When the customer’s traffic reaches the ISP’s CGNAT gateway, that private WAN address is translated to a real, routable public IP address.

3. The same public IP address is shared across hundreds or thousands of other subscribers at the same time.

4. The CGNAT gateway maintains a session table mapping every active connection back to the originating subscriber, so return traffic is delivered to the correct customer.

Because a home router already performs one round of NAT before traffic even reaches the ISP, deployments combining customer-premises NAT with carrier-side CGNAT are commonly referred to as NAT444 — two NAT stages between the subscriber’s device and the public Internet.

Why CGNAT is Beneficial

CGNAT gives operators a practical way to keep IPv4 service running while managing the realities of address scarcity:

· Conserves scarce IPv4 address space: Hundreds of subscribers can share a single public IPv4 address, reducing an operator’s exposure to a shrinking and increasingly expensive IPv4 address market.

· Buys time for a phased IPv6 migration: Operators can keep serving IPv4-only customers and devices while rolling out IPv6 gradually, rather than forcing a disruptive, all-at-once cutover.

· Stays transparent for everyday use: For standard browsing, streaming, and most client-initiated traffic, subscribers typically notice no difference — most mobile networks already run on CGNAT today.

· Supports carrier-grade operational requirements: Modern CGNAT platforms are built for session persistence, lawful-intercept support, DoS mitigation, and the detailed subscriber-level logging that regulators often require.

The trade-off is that subscribers no longer hold a unique, directly reachable public IP address, which can affect inbound connections such as remote access, site-to-site VPNs, or self-hosted services — a factor operators weigh against the address-conservation benefit.

At Asteraix

What We Can Do at Asteraix

AsterNOS-VPP brings CGNAT into the same programmable routing OS used for BGP, OSPF, VPN, and QoS.

· CGNAT alongside standard NAT and MAP-T: AsterNOS-VPP provides NAT, CGNAT, and MAP-T (IETF standards) in one software router, so operators can mix per-subscriber NAT, large-scale NAPT for address sharing, and stateless IPv4-to-IPv6 translation as their network evolves — without swapping platforms at each stage of the IPv6 transition.

· Line-rate translation on the VPP data plane: CGNAT runs on AsterNOS-VPP’s Vector Packet Processing data plane, which is built for high-throughput, cache-friendly packet forwarding on standard x86 or ARM hardware, while SONiC provides the same open, standardized control plane used across the rest of the AsterNOS portfolio.

· Optional hardware acceleration: On ET2508 and ET3600 platforms, AsterNOS-VPP can offload CGNAT and other data-plane workloads to Marvell OCTEON CN102/CN103 processors, adding hardware-accelerated throughput on top of the software data path.

· Built for ISP and BNG deployments: CGNAT is part of Asteraix’s Turnkey Distributed BNG solution for small and medium ISPs, packaged together with PPPoE server, GeoIP/GeoSite routing, HQoS, and large-scale ACLs — the feature set operators typically need to run subscriber-facing IPv4 services on a shrinking address pool.

· Scales with the deployment: AsterNOS-VPP is available across free, commercial, and enterprise editions spanning roughly 0–200 Gbps, so the same CGNAT feature set can be deployed from a branch-office edge router up to backbone-facing infrastructure.