CGNAT for ISPs: Carrier-Grade NAT on Netavo BNG

Carrier-grade NAT lets a growing ISP share each public IPv4 address across many subscribers. Netavo BNG includes it in every licence: NAT44 with endpoint-independent filtering and deterministic port-block allocation, logged so that who held an address and port at any moment is answered by a single query.

Discuss CGNAT Sizing CGNAT for an ISP

Sharing IPv4 without losing track of who held it

New IPv4 addresses are scarce and expensive, and an ISP that keeps growing will run short. CGNAT shares each public address across a number of subscribers, each given its own block of ports, so the addresses an ISP already holds go further.

The hard part is not translation, it is accountability. An abuse report or a lawful request can arrive months later, naming a public address, a port and a time. With deterministic port blocks, each subscriber's allocation is one logged event, so that question has a single, exact answer.

TranslationNAT44, endpoint-independent filtering
AllocationDeterministic port blocks per subscriber
LoggingSequence-numbered port-block logs (RFC 5424)
LicensingIncluded in every Netavo BNG licence

CGNAT bindings in the management portal, with each subscriber's inside address mapped to a public address and port block — Every translation is recorded as a subscriber, a public address and a port block.

One query answers "who had this address?"

admin@cgn1> show cgn bindings inside 100.64.12.34
public     198.51.100.17 · ports 31744–32255 · sticky affinity
since      2026-07-16 09:12:44 · flows 214 · port-cap ok
log        seq 88,214,051 → syslog collector (RFC 5424 JSON)

Each port-block allocation is a sequence-numbered log event, so a gap in the sequence shows if a record was ever lost.

Three ways to get CGNAT from Netavo

Option	What it is	Suited to
Netavo BNG	CGNAT built into the BNG, on standard x86 servers, up to 100,000 subscriber sessions per box	Operators terminating their own subscribers
Managed termination	Your subscribers terminated, addressed and translated on Netavo's own BNG	ISPs who would sooner not run a BNG at all
netavo-cgn (standalone)	The same CGNAT engine as an appliance behind another vendor's BNG, learning subscribers from traffic	Operators keeping their existing BNG; offered through a design-partner programme

Who needs it

Operator	Why
Wireless ISPs	Subscriber growth outpaces the IPv4 they can buy, and CGNAT comes with Netavo BNG at no extra licence
Altnets and fibre builders	Every new street of homes needs addresses; CGNAT stretches the allocation while IPv6 rolls out
Regional ISPs	Keeping public addresses for the business customers who need them, and sharing the rest

A bridge to IPv6, not a destination

CGNAT conserves IPv4 while subscribers' traffic moves to IPv6. Netavo BNG terminates dual-stack subscribers, so the two run side by side: native IPv6 for what supports it, translated IPv4 for the rest. The more traffic goes over IPv6, the less the NAT carries.

Rolling out IPv6 to broadband customers →

IPv6Native, alongside translated IPv4
Dual-stackOne session per access circuit

Common questions

Does Netavo BNG include CGNAT?

Yes. CGNAT is included in every Netavo BNG licence, with NAT44, endpoint-independent filtering and port-block logging.

How are CGNAT translations logged?

Each subscriber's port-block allocation is logged as one sequence-numbered event in RFC 5424 format, so who held a public address and port at a given time is answered by a single query.

Can we add CGNAT without replacing our BNG?

The same CGNAT engine is being packaged as netavo-cgn, a standalone appliance that sits behind another vendor's BNG. It is offered through a design-partner programme.

How many subscribers can Netavo BNG handle?

Netavo BNG terminates up to 100,000 subscriber sessions per box, with CGNAT on the same system.

Can Netavo provide CGNAT as a managed service?

Yes. With managed termination, your subscribers are terminated and addressed on Netavo's own BNG, including carrier-grade NAT.

Discuss CGNAT

Tell us how many subscribers you serve, how much IPv4 you hold, and what terminates them today. An engineer will respond with the options.

Work with us →