# CGNAT for ISPs: Carrier-Grade NAT on Netavo BNG

Carrier-grade NAT lets a growing ISP share each public IPv4 address across many subscribers. Netavo BNG includes it in every licence: NAT44 with endpoint-independent filtering and deterministic port-block allocation, logged so that who held an address and port at any moment is answered by a single query.

[Discuss CGNAT](https://netavo.com/work-with-us)

[Sizing CGNAT for an ISP](https://netavo.com/insights/cgnat-for-isps)

## Sharing IPv4 without losing track of who held it

New IPv4 addresses are scarce and expensive, and an ISP that keeps growing will run short. CGNAT shares each public address across a number of subscribers, each given its own block of ports, so the addresses an ISP already holds go further.

The hard part is not translation, it is accountability. An abuse report or a lawful request can arrive months later, naming a public address, a port and a time. With deterministic port blocks, each subscriber's allocation is one logged event, so that question has a single, exact answer.

- **Translation**: NAT44, endpoint-independent filtering
- **Allocation**: Deterministic port blocks per subscriber
- **Logging**: Sequence-numbered port-block logs (RFC 5424)
- **Licensing**: Included in every Netavo BNG licence

![CGNAT bindings in the management portal, with each subscriber's inside address mapped to a public address and port block](https://netavo.com/images/bng/cgn-bindings.png)

Every translation is recorded as a subscriber, a public address and a port block.

## One query answers "who had this address?"

```
admin@cgn1> show cgn bindings inside 100.64.12.34
public     198.51.100.17 · ports 31744–32255 · sticky affinity
since      2026-07-16 09:12:44 · flows 214 · port-cap ok
log        seq 88,214,051 → syslog collector (RFC 5424 JSON)
```

Each port-block allocation is a sequence-numbered log event, so a gap in the sequence shows if a record was ever lost.

## Three ways to get CGNAT from Netavo

| Option | What it is | Suited to |
| --- | --- | --- |
| Netavo BNG | CGNAT built into the BNG, on standard x86 servers, up to 100,000 subscriber sessions per box | Operators terminating their own subscribers |
| Managed termination | Your subscribers terminated, addressed and translated on Netavo's own BNG | ISPs who would sooner not run a BNG at all |
| netavo-cgn (standalone) | The same CGNAT engine as an appliance behind another vendor's BNG, learning subscribers from traffic | Operators keeping their existing BNG; offered through a design-partner programme |

## Who needs it

| Operator | Why |
| --- | --- |
| Wireless ISPs | Subscriber growth outpaces the IPv4 they can buy, and CGNAT comes with Netavo BNG at no extra licence |
| Altnets and fibre builders | Every new street of homes needs addresses; CGNAT stretches the allocation while IPv6 rolls out |
| Regional ISPs | Keeping public addresses for the business customers who need them, and sharing the rest |

## A bridge to IPv6, not a destination

CGNAT conserves IPv4 while subscribers' traffic moves to IPv6. Netavo BNG terminates dual-stack subscribers, so the two run side by side: native IPv6 for what supports it, translated IPv4 for the rest. The more traffic goes over IPv6, the less the NAT carries.

[Rolling out IPv6 to broadband customers](https://netavo.com/insights/isp-ipv6-rollout)

- **IPv6**: Native, alongside translated IPv4
- **Dual-stack**: One session per access circuit

## Common questions

### Does Netavo BNG include CGNAT?

Yes. CGNAT is included in every Netavo BNG licence, with NAT44, endpoint-independent filtering and port-block logging.

### How are CGNAT translations logged?

Each subscriber's port-block allocation is logged as one sequence-numbered event in RFC 5424 format, so who held a public address and port at a given time is answered by a single query.

### Can we add CGNAT without replacing our BNG?

The same CGNAT engine is being packaged as netavo-cgn, a standalone appliance that sits behind another vendor's BNG. It is offered through a design-partner programme.

### How many subscribers can Netavo BNG handle?

Netavo BNG terminates up to 100,000 subscriber sessions per box, with CGNAT on the same system.

### Can Netavo provide CGNAT as a managed service?

Yes. With managed termination, your subscribers are terminated and addressed on Netavo's own BNG, including carrier-grade NAT.

## Often delivered alongside

### [ISP BNG & CGNAT Systems](https://netavo.com/services/bng)

Netavo BNG, a carrier-grade x86-based BNG and CGNAT platform for internet service providers.

### [Wholesale FTTP Broadband for ISPs, by L2TP](https://netavo.com/services/wholesale-broadband)

Wholesale FTTP from Openreach, CityFibre, KCOM and MS3, handed over by L2TP to your LNS or run white-label for you.

### [ISP Network Services](https://netavo.com/services/isp)

IP transit, backhaul and L2TP broadband for internet service providers and network operators.

## Further reading

- [CGNAT for a growing ISP: why and how to size it](https://netavo.com/insights/cgnat-for-isps)
- [Choosing a BNG: chassis, MikroTik or software](https://netavo.com/insights/choosing-a-bng)
- [Rolling out IPv6 to broadband customers](https://netavo.com/insights/isp-ipv6-rollout)

## Discuss CGNAT

Tell us how many subscribers you serve, how much IPv4 you hold, and what terminates them today. An engineer will respond with the options.

[Work with us](https://netavo.com/work-with-us)

Source: https://netavo.com/services/cgnat