Overview

Determining whether your Optical Network Terminal (ONT) is operating behind Carrier-Grade NAT (CGNAT) is a critical first step in troubleshooting remote access, port forwarding, VPN, and hosted-service failures. In carrier deployments, CGNAT is frequently enabled by default to conserve public IPv4 space, which means your ONT WAN interface may receive a private or shared address (typically 100.64.0.0/10 per RFC 6598) rather than a globally routable public IP. This FAQ provides direct, engineer-grade answers to the most common pre-sales and post-sales questions about CGNAT detection on ONT platforms, covering CLI diagnostics, WAN IP range checks, traceroute interpretation, optical module compatibility, throughput limits, stacking behavior, and redundant power failover. Each answer is structured for fast scanning so network architects and field technicians can isolate CGNAT conditions in minutes.

Frequently Asked Questions

Q1: How do I check if my ONT is operating on a Carrier-Grade NAT (CGNAT) private IP?

The fastest way is to compare your ONT WAN IP address against the RFC 6598 shared address range 100.64.0.0/10, the RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and your public IP as seen by an external service. If the ONT WAN interface shows an address inside 100.64.0.0/10 or a private RFC 1918 range while an external checker reports a different public IP, the ONT is almost certainly behind CGNAT. Confirm by running a traceroute to a public destination (for example, 8.8.8.8) and checking whether the first few hops contain 100.64.x.x addresses before reaching the carrier edge.

Q2: What CLI commands show the WAN IP and NAT status on an ONT?

Use the vendor CLI to display the WAN interface address and NAT mode. Typical commands are show wan interface, show ip interface brief, show nat status, or show cgnat status depending on the platform. On many ONTs, the command show interface wan0 returns the assigned IP, subnet mask, and gateway, while show nat translations or show cgnat sessions reveals whether NAT is active. If the WAN IP falls in 100.64.0.0/10, CGNAT is in use; if the NAT table is empty and the WAN IP is public, the ONT is not behind CGNAT.

Q3: What WAN IP ranges indicate a CGNAT address on an ONT?

The definitive CGNAT range is 100.64.0.0/10 (100.64.0.0 through 100.127.255.255) as defined by RFC 6598. Additional indicators include RFC 1918 private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) on the WAN side, and carrier-assigned addresses that change frequently or match a shared gateway. If the ONT WAN IP is inside 100.64.0.0/10, the carrier is using CGNAT; if it is a public routable address, CGNAT is not applied at that layer.

Q4: How does CGNAT affect port forwarding, VPN, and remote access on an ONT?

CGNAT breaks inbound port forwarding, inbound VPN termination, and remote management because the carrier does not route unsolicited inbound traffic to your shared address. You cannot open a port on a 100.64.0.0/10 WAN IP and expect external reachability. Workarounds include requesting a public/static IP from the carrier, using an outbound-initiated VPN or reverse tunnel, or deploying a relay/overlay service. For B2B deployments, the standard fix is to order a public IPv4 add-on or a business-grade circuit without CGNAT.

Q5: What optical module types and throughput does a CGNAT-capable ONT support?

Most carrier-grade ONTs support GPON/EPON optical interfaces with downstream rates up to 2.5 Gbps and upstream up to 1.25 Gbps, while XGS-PON models reach 10 Gbps symmetric. SFP/SFP+ slots, where present, accept standard 1000BASE-X or 10GBASE-LR/ER modules, and maximum forwarding throughput typically ranges from 1 Gbps to 10 Gbps line rate depending on the model. Always verify the ONT datasheet for optical module compatibility, because CGNAT functionality is independent of the optical layer and does not change transceiver support.

Q6: Can I disable CGNAT on my ONT through the CLI or web GUI?

No, CGNAT is provisioned by the carrier on the upstream BNG/OLT, not on the ONT itself, so it cannot be disabled from the ONT CLI or web GUI. The ONT only reports the assigned WAN address and NAT state; the translation happens in the carrier network. To remove CGNAT, contact the ISP and request a public IP or a business plan without CGNAT, then recheck the WAN IP after reprovisioning.

Q7: How do I troubleshoot stacking and redundant power failover on a CGNAT-enabled ONT?

First confirm CGNAT status with show wan interface and show cgnat status, then verify stacking links with show stack status or show virtual-chassis and power status with show power or show environment. If a redundant power supply fails, the ONT should remain operational on the secondary PSU; check the PSU LEDs, alarm logs, and show power detail for failover events. For stacking errors, verify the stacking ports, cable type, and firmware version match across members, and confirm the CGNAT WAN address is still reachable after failover.

Q8: What is the difference between CGNAT and a standard NAT on an ONT?

Standard NAT on an ONT translates between the LAN private subnet and a single public WAN IP assigned to that subscriber, preserving inbound port-forwarding control. CGNAT adds a second translation layer at the carrier level, where many subscribers share one public IP and each receives a 100.64.0.0/10 address, removing inbound reachability and port-forwarding capability. In short, standard NAT is subscriber-controlled, while CGNAT is carrier-controlled and shared.