This article explains how CSO process NAT IP address for CPE behind NAT scenario.
When a underlay interface is behind NAT, it is possible that during the life time of the CPE the natd-ipaddr can change any time. CSO will detect this change and update the IPSEC tunnels configuration on the CPEs that are already created on that wan-link. Detecting:
CSO uses the secure OAM tunnels created over that wan-interface to detect the IP change as described below:
When the NATD IP changes, the OAM tunnel over that wan-interface flaps (as the tunnel goes down and comes up)
CSO monitoring system detects this and generates notification.
Upon receiving the notification, CSO computes the nat-information from both the OAM hubs and updates the nat-ipaddr and nat-port information for this wan-interface in CSO DB.
In Kibana (elastic search engine), you can search for highlighted text to understand if the link change alert triggered the nat update workflow to kick in.
Updating :
When the NAT address mapping gets updated, CSO starts a nat-update job.
Nat-update job does the following:
Compute all the site-to-site tunnels that are activated on that wan-interface for which the nat-ipaddr got changed.
Reconfigure the IPSEC tunnel configuration on both the ends of all the existing site-to-site tunnels on that WAN interface.