From 660ba5f2d667310fcf5af8d83e67e87f50c98b48 Mon Sep 17 00:00:00 2001 From: James Silvia Date: Thu, 6 Aug 2026 11:16:05 -0400 Subject: [PATCH 1/2] dynamic-source-nat and IDP doc updates --- docs/config_dnat.md | 1 + docs/ts_idp.md | 12 ++++++++++++ 2 files changed, 13 insertions(+) diff --git a/docs/config_dnat.md b/docs/config_dnat.md index bdb736eb20f..664e5a51d0d 100644 --- a/docs/config_dnat.md +++ b/docs/config_dnat.md @@ -67,6 +67,7 @@ Dynamic Source NAT is configured from the network-interface using the following - [`local-ip`](config_command_guide.md#configure-authority-router-node-device-interface-network-interface-dynamic-source-nat-local-ip): For packets ingressing this interface, the IP that is source NAT'ed to the `remote-ip`. - [`remote-ip`](config_command_guide.md#configure-authority-router-node-device-interface-network-interface-dynamic-source-nat-remote-ip): For packets ingressing this interface, the IP where the `local-ip` will be source NAT'ed. `remote-ip` must use the /32 prefix. +- [`applies-to-local-breakout`](config_command_guide.md#configure-authority-router-node-device-interface-network-interface-dynamic-source-nat-applies-to-local-breakout): Whether the dynamic source NAT applies to local breakout sessions. Default is `false`. Set to `true` when IDP is enabled on traffic that also requires Dynamic Source NAT — IDP processes traffic as local breakout sessions, so without this flag the NAT rules are not applied to that traffic. ## Show Commands diff --git a/docs/ts_idp.md b/docs/ts_idp.md index c9f50f262b4..1daf4945ca3 100644 --- a/docs/ts_idp.md +++ b/docs/ts_idp.md @@ -59,6 +59,18 @@ Beginning with SSR version 6.1.4-R2, traffic destined for IDP will temporarily b Additionally, services configured for IDP and their status (passing through IDP or not, and why), and when the IDP will be operational are reported in the `show idp application status` command. +## IDP and Dynamic Source NAT + +When IDP is enabled on a service that also uses [`dynamic-source-nat`](config_dnat.md), traffic processed by IDP may not be source-NATed as expected. IDP processes traffic as local breakout sessions, and by default `dynamic-source-nat` does not apply to local breakout sessions (`applies-to-local-breakout` defaults to `false`). + +To resolve traffic issues in this scenario, set `applies-to-local-breakout true` on the `dynamic-source-nat` configuration for each node: + +```text +config authority router node device-interface network-interface dynamic-source-nat 0.0.0.0/0 local-ip 0.0.0.0/0 +config authority router node device-interface network-interface dynamic-source-nat 0.0.0.0/0 remote-ip /32 +config authority router node device-interface network-interface dynamic-source-nat 0.0.0.0/0 applies-to-local-breakout true +``` + ## Show Commands Each of the commands listed below, and the subcommands for each, provide additional details for IDP visibility. Use the links to learn more about each command. From 947f45dfd56050a2886a5c4d508f9a0abc5d005b Mon Sep 17 00:00:00 2001 From: Chris Date: Tue, 18 Aug 2026 12:03:46 -0400 Subject: [PATCH 2/2] update troubleshooting topic. Kaushik's comment in the config topic does not seem to identify anything different than local breakout, which is already stated, so no change was made. --- docs/ts_idp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/ts_idp.md b/docs/ts_idp.md index 1daf4945ca3..7ac4a72417e 100644 --- a/docs/ts_idp.md +++ b/docs/ts_idp.md @@ -63,7 +63,7 @@ Additionally, services configured for IDP and their status (passing through IDP When IDP is enabled on a service that also uses [`dynamic-source-nat`](config_dnat.md), traffic processed by IDP may not be source-NATed as expected. IDP processes traffic as local breakout sessions, and by default `dynamic-source-nat` does not apply to local breakout sessions (`applies-to-local-breakout` defaults to `false`). -To resolve traffic issues in this scenario, set `applies-to-local-breakout true` on the `dynamic-source-nat` configuration for each node: +To apply source NAT in scenarios where IDP is also required, set `applies-to-local-breakout true` on the `dynamic-source-nat` configuration for each node: ```text config authority router node device-interface network-interface dynamic-source-nat 0.0.0.0/0 local-ip 0.0.0.0/0