Systems involved
| System | Role |
|---|---|
| NetFlow / IPFIX collector | Port-pool utilization. |
| CGNAT platform (A10 / Cisco NAT44 / MikroTik NAT) | Pool configuration, per-subscriber budgets. |
| NetBox / IPAM | IP plan updates. |
| Abuse-contact registries (ARIN / RIPE / APNIC) | Update pool registrations for subpoena cooperation. |
| Splynx | Subscriber counts mapped to pools. |
Slack #carrier-ops | Engineering channel. |
| Gmail | Inter-carrier abuse-contact comms. |
| Studio Procedures | CGNAT pool expansion runbook. |
Walkthrough
Confirm the capacity problem
Copilot pulls port-pool utilization from the CGNAT platform for the last 14 days. Peak hours hit 98 percent; the distribution of per-subscriber port use is long-tailed — a small number of subscribers drive most of the consumption.
Plan the expansion
Add a /23 of public IPv4 to the pool. Recalculate ports-per-subscriber with the new capacity and the current subscriber count. Stage a mild reduction of the per-subscriber hard cap so the long-tail subscribers are not disproportionate.
Stage the CGNAT config
SSH into the CGNAT platform. Copilot drafts the configuration to add the new pool range and the new per-subscriber budget, stages it in the staging panel, and shows the expected effect on pool utilization.
Announce the new /23 via BGP
On the edge routers, announce the new /23. Verify the advertisement appears in the looking glass and that the ISP’s RPKI ROAs are updated so the prefix is valid.
Push the pool change
During the low-traffic window, push the CGNAT config. Monitor for session churn; most sessions continue because the new pool is additive. Only the subscriber-budget change causes a gentle re-NAT cycle.
Update IPAM
Update NetBox with the new /23 role, the pool ID, the ASN assignment, and the abuse contact. The IP plan artifact is regenerated and saved to the team drive.
Refresh abuse registrations
Through the RIR connectors, update the abuse-contact record for the new /23 so that subpoena requests and spam investigations route to the right ISP team. Draft the inter-carrier courtesy note through Gmail to major abuse partners.
Where Studio earns its keep
- The exhaustion problem, the expansion plan, and the BGP announcement live in one session, with the subscriber impact visible at every step.
- The RIR abuse-contact update is not a forgotten afterthought — it’s in the runbook and it’s actually executed.
- NetBox and the ISP’s public prefix list stay synchronized without anyone remembering to email the IP coordinator.
- The runbook runs again in six months when the next /23 is needed, with the arguments already shaped.
Related
Procedures
CGNAT pool expansion with POP and prefix as arguments.Memories and search
Save CGNAT platform quirks so they’re not relearned at 22:30.