# CGNAT for a growing ISP: why and how to size it

Every expanding ISP meets the same wall. There is not enough IPv4 to give each subscriber a public address. Carrier-grade NAT shares the addresses you have across many subscribers, and how you size it decides your cost and your support load.

9 July 2026

[ISP & Network Operators](https://netavo.com/insights)

## Running out of IPv4

IPv4 addresses are scarce and expensive, and the market for them does not get cheaper. A growing subscriber base needs a growing pool of public addresses, and buying enough to give every household its own is rarely affordable. Carrier-grade NAT, CGNAT, is how operators bridge the gap: it shares one public IPv4 across many subscribers, each using a slice of that address's ports.

The question is not whether to run CGNAT, but how many subscribers to put behind each public address, and how to do it without generating support tickets. That is a sizing decision, and it is worth making deliberately.

## Sizing and logging

Each subscriber is given a block of ports on a shared public address. The number of subscribers per address is simply the usable ports divided by the block size. Larger blocks leave heavy households more headroom before anything fails, but pack fewer subscribers onto each address; smaller blocks raise density but risk port exhaustion for the busiest users. A conservative block is a sound default that you tighten only once the data supports it.

Logging matters as much as sizing. Deterministic port-block allocation records one binding per subscriber, so an abuse report or a lawful request months later is answered from a single line, not from a flood of per-connection logs. Netavo BNG provides CGNAT with deterministic port blocks of exactly this kind. The underlying arithmetic and the logging model are set out in detail in the [CGNAT port-block maths](https://netavobng.com/engineering/cgnat-subscribers-per-ipv4) and [CGNAT logging](https://netavobng.com/engineering/cgnat-logging-deterministic) notes on the Netavo BNG site.

## CGNAT is a bridge, not a destination

CGNAT conserves IPv4 and buys time, but it does not make the scarcity go away, and it adds a layer that a minority of applications dislike. The durable fix is IPv6, where every subscriber has routable addresses and the sharing problem disappears for any traffic that can use it. The right posture is to run both: deploy IPv6 to every subscriber now, and keep a well-sized CGNAT for the IPv4 that remains. Over time the CGNAT carries less, because more traffic goes native over IPv6.

## Common questions

### Does Netavo BNG include CGNAT?

Yes. Netavo BNG provides integrated carrier-grade NAT with deterministic port-block allocation, so each subscriber's public address and port range are recorded for abuse and lawful-request handling.

### How many subscribers can share one public IPv4?

It depends on the port-block size you choose: usable ports divided by block size. A larger block means fewer subscribers per address but more headroom; the sharing ratio is a policy choice, not a fixed number.

### Does CGNAT remove the need for IPv6?

No. CGNAT conserves IPv4 and buys time; IPv6 removes the scarcity for traffic that can use it. The pragmatic approach is to deploy IPv6 and keep a well-sized CGNAT for the remaining IPv4.

## Related services

### [ISP BNG & CGNAT Systems](https://netavo.com/services/bng)

Netavo BNG, a carrier-grade x86-based BNG and CGNAT platform for internet service providers.

### [ISP Network Services](https://netavo.com/services/isp)

IP transit, backhaul and L2TP broadband for internet service providers and network operators.

## Sizing CGNAT for your subscriber base?

Tell us your subscriber numbers and the public IPv4 you hold, and an engineer will talk through a sharing ratio and a logging model that fit.

[Work with us](https://netavo.com/work-with-us)

Source: https://netavo.com/insights/cgnat-for-isps