Bypassing CGNAT. You Don’t Need PBR, and I Can Prove It!#

Douglas Fernando Fischer (NZM — network consultancy for ISPs)

• Why: A sharp, transferable edge-design pattern: steering CGNAT vs public-IP subscribers at a BNG without policy-based routing.
• What: The argument, walked through topology by topology, that PBR for CGNAT steering becomes unmanageable ("cancerígeno") as BNGs and CGNAT nodes multiply — and that doubling BNG hardware per subscriber type is the resource-infinite fantasy. The alternative: per-subscriber-type VRFs on a single BNG — the CGNAT VRF holds a default route to the CGNAT, the public-IP VRF defaults to the border router — i.e., source classification by VRF membership instead of per-flow policy matching. Bonus: VRFs as quarantine zones for infected CPEs.
• How: Logical-topology evolution from pre-CGNAT BNG designs, deliberately presented without CLI so the concepts transfer across vendors.
• Where applicable: ISP BNG/CGNAT environments with MPLS/VRF capability; a general technique, no hardware dependency stated. Most valuable to access networks with multiple BNGs and CGNAT nodes.