Manual Chapter : Deploying a Carrier Grade NAT

Applies To:

Show Versions Show Versions


  • 11.4.1
Manual Chapter

About the carrier-grade NAT (CGNAT) module

The carrier-grade network address translation (CGNAT) module on the BIG-IP® system supports large groups of translation addresses using large-scale NAT (LSN) pools and grouping of address-translation-related options in an ALG profile, which can be assigned to multiple virtual servers. It also has the ability to match virtual servers based on client address to destination addresses and ports. Other characteristics of the CGNAT module are listed here.

Translation address persistence

The CGNAT module can assign the same external (translation) address to all connections originated by the same internal client. For example, providing endpoint-independent address mapping.

Automatic external inbound connection handling

CGNAT can accept inbound external connections to active translation address/port combinations to facilitate endpoint-independent filtering as described in section 5 of RFC 4787. This is also known as a full-cone NAT.

More efficient logging

Log messages that map external addresses and ports back to internal clients for troubleshooting and law enforcement/legal compliance are supported.

Deterministic assignment of translation addresses

Deterministic mode is an option to assign translation address and port based on the client address/port and destination address/port. It uses reversible mapping to reduce logging, while maintaining translated IP address discoverability for troubleshooting and law compliance. Deterministic mode also provides an option to configure backup-members.


Geared toward service providers, the CGNAT module is offered as a stand-alone license or as an add-on license for Local Traffic Manager™ (LTM®) and Policy Enforcement Manager (PEM).

About ALG Profiles

Application Layer Gateway (ALG) profiles provide the CGNAT with enough protocol and service knowledge to carry out the necessary application protocol header and payload modifications that allow these protocols to seamlessly traverse the NAT. FTP, RSTP, and SIP profiles are supported with ALG profiles and may be added to the CGNAT configuration as needed.

Important: ALG traffic cannot use a deterministically-mapped address. Using a separate NAPT pool for these translations is recommended.

Task summary

Perform these tasks to deploy a source translation using CGNAT.

Creating an LSN pool

The CGNAT module must be enabled through System > Resource Provisioning before LSN pools can be configured.
Large Scale NAT (LSN) pools are used by the CGNAT module to allow efficient configuration of translation prefixes and parameters.
  1. On the Main tab, click Carrier Grade NAT > LSN Pools. The LSN Pool List screen opens.
  2. Click Create.
  3. Enter a unique name in the Name field.
  4. In the Configuration area, for the Member List setting, enter an address and a prefix length in the Address/Prefix Length field and click Add. If your pool uses deterministic mode, ensure that any address ranges you enter as a member do not overlap another member's prefix address ranges. For example, the address and prefix overlaps
  5. Click Finished.
Your LSN pool is now ready and you can continue to configure your CGNAT.

Configuring a SIP ALG profile

You must have a SIP registrar and proxy configured prior to using a SIP ALG profile.
The SIP ALG profile provides the CGNAT module with enough protocol and service knowledge to make specified packet modifications to the IP and TCP/UDP headers, as well as the SIP payload during translation.
Important: Only edit copies of the included ALG profiles to avoid unwanted propagation of settings to other profiles that use the included profiles as parents.
  1. On the Main tab, click Carrier Grade NAT > ALG Profiles > SIP. The SIP screen opens and displays a list of available SIP ALG profiles.
  2. Click Create to open the New SIP Profile screen.
  3. Enter a name for the new profile.
  4. From the Parent Profile list, select sip as the new profile.
  5. For the Terminate on BYE setting, select the Enabled check box.
  6. Select the Dialog Aware check box, and enter a unique community string in the Community field.
  7. From the Insert Via Header list, select Enabled.
  8. Click Finished to save the new SIP ALG profile.
  9. You must also create two virtual servers: one to handle SIP TCP traffic and another to handle SIP UDP traffic.
    1. Create a host virtual server with a Source address of and a Destination type set as Network, as well as a Mask of and a Service Port of 5060.
    2. From the Protocol list, select TCP.
    3. From the SIP Profile list, select a SIP profile.
    4. From the VLAN and Tunnel Traffic list, select All VLANs and Tunnels.
    5. From the LSN Pool list, select an LSN pool.
    6. Repeat the virtual server creation procedure, and then from the Protocol list, choose UDP. Also choose the SSL client, SSL server, and Authentication profiles from their respective lists as needed.
    You now have a TCP and UDP virtual server to handle SIP traffic.
You now have a SIP ALG profile for use by CGNAT.

Configuring a CGNAT iRule

You create iRules® to automate traffic forwarding for XML content-based routing. When a match occurs, an iRule event is triggered, and the iRule directs the individual request to an LSN pool, a node, or virtual server.
  1. On the Main tab, click Carrier Grade NAT > iRules. The iRule List screen opens.
  2. Click Create.
  3. In the Name field, type a 1 to 31 character name, such as cgn_https_redirect_iRule.
  4. In the Definition field, type the syntax for the iRule using Tool Command Language (Tcl) syntax. For complete and detailed information iRules syntax, see the F5 Networks DevCentral web site (
  5. Click Finished.
You now have an iRule to use with a CGNAT virtual server.

Creating a virtual server for an LSN pool

Virtual servers are matched based on source (client) addresses. Define a virtual server that references the CGNAT profile and the LSN pool.
  1. On the Main tab, click Carrier Grade NAT > Virtual Servers. The Virtual Servers screen opens.
  2. Click the Create button. The New Virtual Server screen opens.
  3. In the Name field, type a unique name for the virtual server.
  4. From the Type list, select Performance (Layer 4).
  5. For the Destination setting, in the Address field, type to allow all traffic to be translated.
  6. In the Service Port field, type * or select * All Ports from the list.
  7. From the VLAN and Tunnel Traffic list, select Enabled on. Then, for the VLANs and Tunnels setting, move the VLAN or VLANs on which you want to allow the virtual servers to share traffic from the Available list to the Selected list.
  8. For the LSN Pool setting, select the pool that this server will draw on for translation addresses.
  9. In the Resources area of the screen, for the iRules setting, select the name of the iRule that you want to assign and using the Move button, move the name from the Available list to the Enabled list.
  10. Click Finished.
The custom CGNAT virtual server now appears in the CGNAT Virtual Servers list.

Creating a CGNAT tunnel

Many translations use tunneling to move TCP/UDP traffic where the payload is other IP traffic. Create and configure a tunnel for use with an LSN pool.
  1. On the Main tab, click Carrier Grade NAT > Tunnels. The Tunnels screen opens.
  2. Click Create. The New Tunnel screen opens.
  3. In the Name field, type a unique name for the tunnel.
  4. In the Local Address field, type the IP address of the BIG-IP system.
  5. From the Remote Address list, select Specify, and type a wildcard address (:: or as the other end of the tunnel.
  6. Click Finished.
Your CGNAT tunnel is ready to use as an egress interface in an LSN Pool.