Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

External CGNAT

External CGNAT transfers Network Address Translations (NAT) and Network Address Port Translations (NAPT) to an external device and account subscriber activity by correlating RADIUS‑reported public IPv4 addresses and port blocks with individual subscriber sessions.

External CGNAT enables broadband service providers to transfer Network Address Translation (NAT) and Network Address Port Translations (NAPT) processing to a dedicated CGNAT device while retaining subscriber termination and control functions on the Broadband Network Gateway (BNG) router. The BNG maintains full subscriber context—including authentication state, access interface, and service profiles—and forwards subscriber traffic to the external CGNAT system for address and port translation.

When you enable external CGNAT and accounting service, the BNG records public IP address and public port block information received from the CGNAT system through RADIUS Vendor-Specific Attribute (VSA) 238. Each subscriber session on the BNG is uniquely identified using an internal session identifier, which is mapped to the assigned public IP address, port block, and timestamp. Upon subscriber login, the BNG creates an accounting entry (Account-Start), and upon subscriber logout, the entry is cleared (Account-Stop). These mappings are maintained in an internal database to ensure accurate correlation between subscriber identity and post-NAT address usage. This capability enables service providers to track and report subscriber activity even when NAT translation occurs outside the BNG, supporting billing, monitoring, and regulatory compliance requirements.

Configure external CGNAT

Follow the steps below to enable external CGNATS and thereby report the Ipv4 public address and port block to the RADIUS server as part of subscriber accounting:

  1. Enable CGNAT accounting service on the BNG device.

  2. Enable external CGNAT feature using one of the following methods:

    1. Add the external-napt statement under the [edit dynamic-profiles name services] hierarchy to enable external CGNAT for individual subscriber sessions. For example:

      Note:

      Inline CGNAT and external CGNAT are exclusive features. You can enable only one at a time, as configuring both prevents committing.

    2. Enable external CGNAT from the RADIUS server using the predefined variable $junos-external-napt-control, which sends over the RADIUS vendor-specific attribute (VSA) 237. For example:

      The conditional statement disable:$junos-external-napt-control used in the configuration above is to disable the external CGNAT feature if RADIUS server does not return a value for the variable.

      You can define a default value for the $junos-external-napt-control variable. To configure a default value, use the following command:

      Note:

      When a default value is not configured for the variable $junos-external-napt-control and RADIUS fails to return a value, the external CGNAT feature remains disabled by default.

Verify Subscriber Mapping

Use the show subscribers id id command to verify the subscriber mapping details. For example: