Carrier-Grade NAT (CGNAT) Requirement
The Carrier-Grade NAT (CGNAT) configuration is necessary to ensure that network tunnels to Secure Access are functioning efficiently. CGNAT must be configured in the on-premises tunnel gateway to prevent connectivity issues, such as the inability to access private resources or inconsistent traffic routing, even when test connectivity results are successful. For example, Meraki MX devices may require CGNAT configuration to ensure efficient functioning.
However, this consideration is not limited to Meraki devices and is applicable to other supported network devices depending on the environment and requirements.
Ensure that the following subnets are reviewed for inclusion as part of the CGNAT configuration in your on-premises gateway:
- CGNAT IP address range: 100.64.0.0/10
- RA VPN and Management IP Pool subnets