support many-to-one NAT (PAT or NAT overload) functionality.

[Zubair-A]

We are requesting Meraki’s assistance in developing an important security feature to support many-to-one NAT (PAT or NAT overload) functionality. Specifically, we need the ability to translate traffic from a source network (such as our Guest network) to a public IP address provided by our ISP.

This capability would allow us to logically separate guest traffic from production traffic, ensuring that only production traffic—already whitelisted by our vendors—remains trusted. Since our vendors do not wish to whitelist guest network traffic, implementing this feature is critical for maintaining both security and network integrity.

[alemabrahao]

You can also give them your feedback.

https://documentation.meraki.com/General_Administration/Other_Topics/Give_your_feedback_(previously_...)

[ww]

Not what you asking for. But,

You could send guest traffic to a concentrator and break out there. 

Or send just vendor specific traffic to a one armed concentrator and break out there

[Zubair-A]

Thanks for the feedback. We want to avoid saturating the WAN circuits. The design aims to break out guest and certain trusted partners, like O365, traffic locally.

The challenge arises when both types of traffic leave the local site: their source IPs appear the same. When partners whitelist these IPs, not only the trusted traffic is allowed, but guest traffic is inadvertently included as well.

Currently, 1-to-1 NAT is possible, but our goal is Many-to-1 NAT. This would allow us to assign a separate public source IP to guest traffic, ensuring proper segregation and correct whitelisting.

[PhilipDAth]

This would be nice.

Not the fix that you want, but for customers where this is important, I used a second consumer-grade Internet circuit on WAN2.  Then create an Internet flow preference for the guest subnet to prefer WAN2.

It is usually quite a cheap solution as well.