dynamic-source-nat and IDP doc updates - #1113
Merged
Chr1st0ph3rTurn3r merged 3 commits intoAug 18, 2026
Merged
Conversation
jamesesilvia
requested review from
Chr1st0ph3rTurn3r and
MichaelBaj
as code owners
August 11, 2026 15:49
MichaelBaj
requested changes
Aug 11, 2026
|
|
||
| - [`local-ip`](config_command_guide.md#configure-authority-router-node-device-interface-network-interface-dynamic-source-nat-local-ip): For packets ingressing this interface, the IP that is source NAT'ed to the `remote-ip`. | ||
| - [`remote-ip`](config_command_guide.md#configure-authority-router-node-device-interface-network-interface-dynamic-source-nat-remote-ip): For packets ingressing this interface, the IP where the `local-ip` will be source NAT'ed. `remote-ip` must use the /32 prefix. | ||
| - [`applies-to-local-breakout`](config_command_guide.md#configure-authority-router-node-device-interface-network-interface-dynamic-source-nat-applies-to-local-breakout): Whether the dynamic source NAT applies to local breakout sessions. Default is `false`. Set to `true` when IDP is enabled on traffic that also requires Dynamic Source NAT — IDP processes traffic as local breakout sessions, so without this flag the NAT rules are not applied to that traffic. |
Contributor
There was a problem hiding this comment.
Is there a case where you would set this to true and IDP is not configured? i.e., is this only relevant for when IDP and local-break-out is in use together?
Contributor
There was a problem hiding this comment.
Yes - this would also be useful for applying the dynamic source nat feature for local breakout scenarios. This was actually implemented for that purpose originally. Since IDP KNI's look like "local breakout" i.e. non SVR - that was the trick to get IDP working. I would argue this is a bit of a hack for IDP but the best option we have right now.
|
|
||
| When IDP is enabled on a service that also uses [`dynamic-source-nat`](config_dnat.md), traffic processed by IDP may not be source-NATed as expected. IDP processes traffic as local breakout sessions, and by default `dynamic-source-nat` does not apply to local breakout sessions (`applies-to-local-breakout` defaults to `false`). | ||
|
|
||
| To resolve traffic issues in this scenario, set `applies-to-local-breakout true` on the `dynamic-source-nat` configuration for each node: |
Contributor
There was a problem hiding this comment.
Replace "To resolve traffic issues in this scenario" with "To apply source NAT in scenarios where IDP is also required,"
Chr1st0ph3rTurn3r
previously approved these changes
Aug 13, 2026
Chr1st0ph3rTurn3r
left a comment
Chr1st0ph3rTurn3r
left a comment
Contributor
There was a problem hiding this comment.
Approve with changes requested by Mike.
…oes not seem to identify anything different than local breakout, which is already stated, so no change was made.
MichaelBaj
approved these changes
Aug 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
As seen in customer setup (I95-65301), with IDP + Dynamic Source NAT -- the
applies-to-local-breakoutflag must also be configured.