Skip to content

dynamic-source-nat and IDP doc updates #1113

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Chr1st0ph3rTurn3r merged 3 commits into from
Aug 18, 2026
Merged

dynamic-source-nat and IDP doc updates #1113

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
660ba5f
dynamic-source-nat and IDP doc updates
jamesesilvia Aug 6, 2026
6b044de
Merge branch 'master' into jsilvia/I95-65301-dynamic-source-nat-idp
Chr1st0ph3rTurn3r Aug 18, 2026
947f45d
update troubleshooting topic. Kaushik's comment in the config topic d…
Chr1st0ph3rTurn3r Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/config_dnat.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ Dynamic Source NAT is configured from the network-interface using the following

- [`local-ip`](config_command_guide.md#configure-authority-router-node-device-interface-network-interface-dynamic-source-nat-local-ip): For packets ingressing this interface, the IP that is source NAT'ed to the `remote-ip`.
- [`remote-ip`](config_command_guide.md#configure-authority-router-node-device-interface-network-interface-dynamic-source-nat-remote-ip): For packets ingressing this interface, the IP where the `local-ip` will be source NAT'ed. `remote-ip` must use the /32 prefix.
- [`applies-to-local-breakout`](config_command_guide.md#configure-authority-router-node-device-interface-network-interface-dynamic-source-nat-applies-to-local-breakout): Whether the dynamic source NAT applies to local breakout sessions. Default is `false`. Set to `true` when IDP is enabled on traffic that also requires Dynamic Source NAT — IDP processes traffic as local breakout sessions, so without this flag the NAT rules are not applied to that traffic.

@MichaelBaj MichaelBaj Aug 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a case where you would set this to true and IDP is not configured? i.e., is this only relevant for when IDP and local-break-out is in use together?

@agrawalkaushik agrawalkaushik Aug 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes - this would also be useful for applying the dynamic source nat feature for local breakout scenarios. This was actually implemented for that purpose originally. Since IDP KNI's look like "local breakout" i.e. non SVR - that was the trick to get IDP working. I would argue this is a bit of a hack for IDP but the best option we have right now.


## Show Commands

Expand Down
12 changes: 12 additions & 0 deletions docs/ts_idp.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,18 @@ Beginning with SSR version 6.1.4-R2, traffic destined for IDP will temporarily b

Additionally, services configured for IDP and their status (passing through IDP or not, and why), and when the IDP will be operational are reported in the `show idp application status` command.

## IDP and Dynamic Source NAT

When IDP is enabled on a service that also uses [`dynamic-source-nat`](config_dnat.md), traffic processed by IDP may not be source-NATed as expected. IDP processes traffic as local breakout sessions, and by default `dynamic-source-nat` does not apply to local breakout sessions (`applies-to-local-breakout` defaults to `false`).

To apply source NAT in scenarios where IDP is also required, set `applies-to-local-breakout true` on the `dynamic-source-nat` configuration for each node:

```text
config authority router <router> node <node> device-interface <intf> network-interface <net-intf> dynamic-source-nat 0.0.0.0/0 local-ip 0.0.0.0/0
config authority router <router> node <node> device-interface <intf> network-interface <net-intf> dynamic-source-nat 0.0.0.0/0 remote-ip <nat-ip>/32
config authority router <router> node <node> device-interface <intf> network-interface <net-intf> dynamic-source-nat 0.0.0.0/0 applies-to-local-breakout true
```

## Show Commands

Each of the commands listed below, and the subcommands for each, provide additional details for IDP visibility. Use the links to learn more about each command.
Expand Down