NAT has been detected on 1 client in the switch network

SOLVED
EnzoLabruzzo
Here to help

NAT has been detected on 1 client in the switch network

Hello Community

 

The Meraki Monitoring system is sending me several emails indicating that a client with a MAC a01:12b:0:0:0:0:0:0 is performing a NAT on the Network. How can I detect which computer is doing this activity?

 

Enzo.

1 ACCEPTED SOLUTION

I'm going to verify and anything I'll write another comment. Thank you

View solution in original post

13 REPLIES 13
alemabrahao
Kind of a big deal
Kind of a big deal

You can track which port this machine is connected to by looking up your switch's MAC address table.

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.

Hello Alemabrahao.

 

Can you tell me how I can look for that Mac table on the switch?

 

Thank you,

Is your switch Meraki or 3rd party switch?

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.

My switch is Meraki MS355

 

If you click on Tools tab on the specific switch there's a button there. "MAC forwarding table" Hit Run.

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.

EnzoLabruzzo_0-1675789291551.png

Thanks, Execute to see the table and I try to look for the MAC and it does not appear.

It doesn't look like a MAC address, can you share the email you received?

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.

Yes, That MaC seems strange to me.

 

EnzoLabruzzo_0-1675789707629.png

 

I think it's not a MAC address and it's IPv6 address.

 

MS switches can alert an administrator if a device is detected that appears to be using Network Address Translation (NAT). NAT on the LAN may indicate the use of a rogue AP or router, but also may be used for legitimate purposes with technologies such as containers, or tracking prevention. 

 

 

https://documentation.meraki.com/MS/Monitoring_and_Reporting/NAT_Detection_on_MS_Switches

 

 

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.

I'm going to verify and anything I'll write another comment. Thank you

ww
Kind of a big deal
Kind of a big deal

Maybe  a meraki ap using a ssid in nat mode?

Look in your inventory for a device with mac something like 11:2b

If I have configured my AP in NAT mode, but none of the MAC addresses of the APs start with that IP, The other thing that seems strange to me is that the IPV6 Addresses have xxxx: xxxx: xxxx: this format and there it shows only xxx: xxx: xxx:.

I don't understand what could be happening.

JacekJ
Building a reputation

Sorry for the offtop, but since Meraki totally fails communicating this issue I just want to let you know, that if you are using the "A client is detected sharing its IP address via NAT" alert, please be careful with that, it can cause performance issues on switches (some traffic gets dropped).

They were supposed to remove that option, but after few weeks, no luck (I'm not surprised to be honest, but disappointed), more to read about this in this topic:

https://community.meraki.com/t5/Switching/CAUTION-ALERT-if-A-client-is-detected-sharing-its-IP-addre...

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels