BNG in VRF and CGNAT lab

Theoretical foundations and architecture

Lab: integrate a BNG into the MPLS core with subscribers isolated in a VRF and deploy CGNAT (Carrier-Grade NAT: addressing per RFC 6598, CGN requirements per RFC 6888). Because public IPv4 is scarce, the operator gives subscribers addresses from the Shared Address Space 100.64.0.0/10 (RFC 6598; it is not RFC 1918 and must not be handed to a customer as a LAN subnet). PPPoE sessions terminate on the BNG inside VRF SUBS, and the operator service network is reached over the L3VPN. Internet traffic from the VRF is sent to NAT444 (CPE NAT plus CGN): thousands of subscribers are translated into a small public pool with a limited number of ports per subscriber (Port Block Allocation, PBA: a block of 512-2048 ports, 1024 in the lab). This protects the pool from being exhausted by one client, and PBA logs only the allocation and release of a block instead of every session (IPFIX/syslog); that log supports the "public IP:port and time -> subscriber" mapping many countries require. The public pool is summarized and advertised to the upstream in the global table (eBGP), otherwise return traffic from the Internet is lost.

What the lab assembles

The lab closes the module: PE1 (10.255.0.1) works as the BNG, terminates PPPoE subscribers in VRF SUBS (RD 65000:300, RT 65000:300), authorises them via RADIUS (10.255.0.50), performs CGNAT (NAT444) and releases traffic to the Internet through the global table (uplink 172.16.40.0/30, upstream 172.16.40.2, AS 64496). The operator service network 10.90.0.0/24 (OSS: DNS, portal, DHCP) sits behind PE2 (10.255.0.2) in the same VRF SUBS and is reached over L3VPN with the RR 10.255.0.100. So three planes meet on one node: access sessions, VPN services and the public Internet.

Addressing and RFC 6598

The subscribers use the subnet 100.64.0.0/10 (Shared Address Space, RFC 6598): it must not overlap with public addresses or with the RFC 1918 space at customers, which is why it must not be given to a CPE as a LAN. Lab values: Loopback10 in VRF SUBS 100.64.0.1/32 (the unnumbered address of the PPP template), session pool 100.64.1.2-100.64.1.254, public NAT pool 198.51.100.0/28 (addresses .1-.14; the documentation subnet of RFC 5737 stands in for a real block). The pool subnet is summarised (Null0 or discard) and advertised to the upstream, otherwise replies from the Internet will not return.

NAT444, EIM and the effect on applications

NAT444 means two NATs in a row (IPv4 CPE 192.168/16 -> 100.64/10 -> public). RFC 6888 (CGN requirements) and RFC 4787/5382/5508 (UDP/TCP/ICMP behaviour) require: endpoint-independent mapping (EIM) - one internal address and port map to one external one regardless of the destination, which is necessary for P2P, games and WebRTC; endpoint-independent filtering (EIF) at the operator's discretion; hairpinning - a connection of a subscriber to the public address of another subscriber, which is returned inside the CGN; a per-subscriber port limit so that one client with a torrent does not exhaust the pool. ALGs (FTP, SIP, PPTP) on a CGN complicate operation and are often disabled. UDP timeouts (for example 30-120 s for UDP, 2 h 4 min for an established TCP, 4 min for half-open) determine the load on the session table.

Capacity and port block allocation

There are about 64,512 usable ports per public IP (1024-65535). If the block per subscriber is 1024 ports, one IP serves 63 subscribers, and a pool of 14 addresses about 882 subscribers; a ratio of 1:10-1:60 is typical for operators. Dynamic NAT without blocks creates a log record for every session: hundreds of millions of lines a day. Port Block Allocation (PBA) gives the subscriber a block (512-2048 ports) and logs only the allocation and release of the block; Deterministic NAT (RFC 7422) calculates the external IP and port range from the internal address by an algorithm, so logging is essentially not needed. Platforms: Junos MX with MS-MPC (secured-port-block-allocation); on Cisco IOS-XE the extended CGN modes depend on the platform; RouterOS (src-nat/masquerade) has no port blocks and is therefore suitable only for small scale.

Logging and lawful interception

Mapping "public IP:port and time - subscriber" is a legal requirement in many countries (retention of months). Mechanisms: syslog (per event, bulky), NetFlow v9/IPFIX with NAT fields (postNATSourceIPv4Address 225, postNAPTSourceTransportPort 227, natEvent 230), and for PBA/Deterministic - block logging or no logs at all. Time on the NAS and the loggers must be synchronised (NTP), otherwise the mapping breaks. In addition the "login - internal address" binding is logged from RADIUS Accounting.

Exit into MPLS and routing

The subscriber VRF SUBS exports session /32s (redistribute connected) and imports the route of the service network: OSS 10.90.0.0/24 is reachable for all sessions over L3VPN (labels: a transport label from LDP/SR + a VPN label). The Internet path bypasses the L3VPN: ip route vrf SUBS 0.0.0.0 ... global (Cisco) or the next hop of a service interface (Junos) directs the default route into NAT, and from NAT the packet with the public address leaves into the global table. Transit of public addresses through the MPLS core is needed only if NAT is moved to another PE (centralised CGN): then VRF SUBS must contain a default on PE2 and the return route of the pool must be advertised back. Placing NAT on the BNG reduces transit but ties the NAT capacity to the BNG.

IPv6 as a way to reduce CGNAT

Dual-stack through IPv6CP/SLAAC and DHCPv6-PD (RFC 8415) takes IPv6 traffic (30-60% for large services) around the CGNAT. If IPv4 is not needed in the core, DS-Lite (RFC 6333: an IPv4-in-IPv6 tunnel to the AFTR where NAT44 is done), 464XLAT (RFC 6877: CLAT on the CPE + PLAT on the NAT64) or NAT64/DNS64 (RFC 6146/6147) are used. In that case the BNG terminates the IPv6 session and the IPv4 plane is served by the AFTR/PLAT.

Verification order and failures

Check the chain link by link: PPPoE is up and the Accept from RADIUS is received, the address from 100.64.1.0/24 is in VRF SUBS, the default leads into NAT, NAT creates a translation with a public address from the pool, the reply returns (the pool is advertised upstream), the port allocation logs reach the collector, and the service network 10.90.0.0/24 is visible over L3VPN.

1. No ip nat inside/outside or the wrong VRF in the rule: no translations.
2. No route to the pool at the upstream: the SYN leaves, the reply does not come back.
3. The per-host entry limit is too low: one subscriber is blocked during normal browsing.
4. The pool is exhausted (14 addresses x 63 blocks): new sessions are rejected.
5. Logging is not enabled: the interception requirement is violated.
6. MTU: PPPoE 1492 plus a DS-Lite tunnel gives even less, MSS clamping is needed.

Architecture Diagram & Topology

+----------------------+   Shared Space 100.64.0.0/10  +---------------------+
| Subscriber (VRF SUBS)| ============================> |  BNG + CGNAT        |
| IP: 100.64.1.10      |   PBA: 1024-port block        | Pool: 198.51.100.0/28|
| src port: any        | <============================ | (global table)      |
+----------------------+                               +---------------------+

Traffic Flow & Label Stack Scheme

Carrier-Grade NAT (CGNAT / NAT444) Translation:
1. Subscriber session in VRF SUBS: 100.64.1.10:51234 (RFC 6598 space).
2. Default route in VRF SUBS sends the packet to the CGN function (service
   blade or inline NAT engine).
3. CGN picks a public IP from 198.51.100.0/28 and allocates a port block
   (e.g. 1024 ports) to this subscriber.
4. Source is translated to 198.51.100.x:<port from the block> and the
   packet leaves through the global table toward the upstream.
5. Only the block allocation/release is logged (IPFIX/syslog) to map
   public IP:port and time back to the subscriber.
6. The public pool is summarized and advertised to the upstream, otherwise
   return traffic never comes back.

State & Parameter Comparison Table

Architectural model and principles

In real service provider networks, MPLS unifies equipment from multiple vendors. Below are practical configuration and operational verification examples across four platforms: Cisco IOS-XE/XR, Huawei VRP, Juniper Junos, and MikroTik RouterOS v7. Pay close attention to syntax nuances and label distribution mechanisms.

Practical Configuration (Cisco, Huawei, Juniper, MikroTik)

Cisco (IOS-XE/XR)

ip nat pool PUB-POOL 198.51.100.1 198.51.100.14 prefix-length 28
ip access-list standard CGN-ACL
 permit 100.64.0.0 0.63.255.255
ip nat inside source list CGN-ACL pool PUB-POOL vrf SUBS overload
ip nat translation max-entries all-host 2048
ip nat log translations syslog
interface Virtual-Template1
 ip nat inside
interface GigabitEthernet4
 description uplink-to-internet-gw
 ip address 172.16.40.1 255.255.255.252
 ip nat outside
ip route vrf SUBS 0.0.0.0 0.0.0.0 172.16.40.2 global
ip route 198.51.100.0 255.255.255.240 Null0
router bgp 65000
 address-family ipv4
  network 198.51.100.0 mask 255.255.255.240