Nintendo Switch - NAT Type D

[ggatten]

Hello, Customer participates in eSports leagues using Nintendo switches. When client connects to Nintendo, the NS switch status says NAT TYpe D; while NAT type A or B is required for proper operation. This is typically caused be port randomization on the firewall/NAT device. Other customers we've had to disable port-randomization to make it work, but as this one is using MX firewall I don't think we can do that? Is this something Meraki Support can do, or is there another option? TIA for any ideas!

[PhilipDAth]

I am thinking to achieve something like that you'll need one of these solutions:

• An IPv6 connection.  Each device can then get a public IPv6 address, and you can create an IPv6 firewall rule to allow all traffic in.  This will only work for communication to other IPv6 devices.
• A block of public IP addresses from your ISP, and do a 1:1 NAT to each device.
• You could try asking Meraki support to enable "Layer 3 Inbound Firewall Rules", which substantially disables a lot of the security.  Not as likely to work as the above two options.

Basically it requires all security to be disabled, and to allow anything in from the Internet.  It sounds like an incredibly bad idea to me.

[ggatten]

Hello, thanks for reply.  I sorta like the IPv6 idea.  But, let me explain a bit further:

 - Cisco routers/NAT do not randomize source ports by default.  

 - pfSense does randomize by default, but you can disable it - which we have.

Source port randomization is...   1.1.1.1 tcp 55555 to 2.2.2.2 tcp 443 when NAT'd becomes 1.1.1.1 tcp 31673* to 2.2.2.2 tcp 443.  * is the randomized source port.

I know in theory non-random ports are more vulnerable to certain attack vectors, but in practice - it's not even in my top 10 list of worries.

I opened a case with Meraki support.  We'll see... 

[RowellDomingo]

@ggatten i ran into the same problem and just resolved it. I have a meraki MX105. 

Solution: As per Meraki Team we can't disable the port randomization firewall/NAT but instead define a firewall/NAT port Session Persistence. Once a port is assigned to a session, that port will remain mapped to the session until the session is terminated or times out. During the life of the session, the port will not change, ensuring that the external service communicates with the same source port throughout. Achieved NAT A and B Nintendo switch perfectly working now. 9-26-2024 11:10. It took me a while to work with meraki support for almost 2hours

P.S this feature can be configured from the backend. So, you need to open a case with meraki support, and they will help you out. Only few individuals Meraki tech has knowledge on this as this is something new in their environment.