topic Re: NAT Mode in Wireless

NAT Mode

rbmclean — Wed, 15 Apr 2020 11:24:12 GMT

I have a simple question:

What VLAN does traffic from a SSID set to NAT mode traverse?

Re: NAT Mode

kYutobi — Wed, 15 Apr 2020 12:26:33 GMT

The implications of enabling NAT mode are as follows:

Devices outside of the wireless network cannot initiate a connection to a wireless client.
Wireless clients cannot use Layer 2 discovery protocols to find other devices on either the wired or wireless network.
Legacy VPN clients (i.e., those that do not support NAT Traversal) may not be able to establish IPSec tunnels over the wireless network. (One workaround is to upgrade the VPN client or configure the VPN client to establish an IPSec tunnel over TCP, e.g. SSL.)
VLAN Tagging wireless traffic is not supported in NAT mode.

Please note that each AP will NAT to its own management IP address. As a result, LAN flows will be interrupted when the client roams between APs.

The DHCP service for NAT mode will only hand out addresses in the 10.0.0.0/8 subnet. SSIDs in NAT mode can still be used on wired networks already using a 10.x.x.x address space, however clients on the NAT SSID may be unable to communicate with these networks.

Use Cases

NAT mode works well for providing a wireless guest network, since it puts clients on a private wireless network with automatic addressing. Layer 3 firewall rules can also be used to quickly limit or block access to network resources.

Re: NAT Mode

rbmclean — Wed, 15 Apr 2020 12:42:41 GMT

I saw that article, but it doesn't answer the question.

VLAN Tagging wireless traffic is not supported in NAT mode.
- Does this mean is it untagged traffic?
- Does traffic traverse the native VLAN since it is "untagged?"
- Or since it is NATing the management IP does it traverse the management VLAN?

Re: NAT Mode

Rasmus Hoffmann Birkelund — Wed, 15 Apr 2020 12:59:18 GMT

Since NAT is performed directly on the AP, traffic will traverse on the same VLAN as the AP has it's IP address.

So if the AP has an IP address 192.168.5.0/24 on vlan 5, traffic traverses on vlan 5.

Re: NAT Mode

rbmclean — Wed, 15 Apr 2020 13:07:43 GMT

Interesting, but doesn't this contradict the practice of completely segmenting management traffic from all user traffic?

Re: NAT Mode

Rasmus Hoffmann Birkelund — Wed, 15 Apr 2020 13:15:05 GMT

I suppose it is, but then again, I'd normally only use Meraki DHCP on deployments that quickly need guest WiFi, and only able to use single vlans.

Then again, all clients are isolated from eachother. No client can talk to eachother in NAT mode. Internet access only.

Re: NAT Mode

rbmclean — Wed, 15 Apr 2020 13:22:46 GMT

I'm wondering which is more secure, NAT mode or Bridge mode with a L3 rule blocking access to the local LAN?

Re: NAT Mode

kYutobi — Wed, 15 Apr 2020 13:27:00 GMT

@rbmclean NAT mode by default blocks access to the LAN unless you change L3 rules. Just letting you know. 😏

Re: NAT Mode

ConnorL1 — Wed, 15 Apr 2020 13:29:29 GMT

Plus, the first SSID on any network by default will block L3 Wireless > LAN traffic, create a new network and you'll see it 🙂

Re: NAT Mode

rbmclean — Wed, 15 Apr 2020 13:36:24 GMT

Thanks for all the replies.

I think I am going to go back to a bridge mode guest network , if for nothing else than a more seamless roaming, but I do want my management traffic completely separate.

Perhaps if the alternate management IP feature comes out of beta, there will be a way to keep them separate.

Re: NAT Mode

ConnorL1 — Wed, 15 Apr 2020 13:39:53 GMT

My home guest network is in bridge mode too, just on its own VLAN. This means guests that roam between APs keep the same IP address, unlike NAT mode. Was causing issues for iPhone VoWiFi for example

Re: NAT Mode

Nolan H. — Wed, 15 Apr 2020 16:11:12 GMT

If you only have a single AP, and want to make things 'easy' then NAT mode should be fine. Otherwise I never recommend it. Always use bridge-mode, gives you far more control over things in the future when you didn't know you would need to, and the roaming issue that NAT introduces is a true killer.

Re: NAT Mode

SMANNE1 — Wed, 08 Jun 2022 06:02:40 GMT

How do we migrate wireless clients from Meraki DHCP(NAT Mode) to an internal DHCP server(Bridge Mode) seamlessly? Any Suggestions.