NAT has been detected on 1 client in the switch network

[EnzoLabruzzo]

Hello Community

The Meraki Monitoring system is sending me several emails indicating that a client with a MAC a01:12b:0:0:0:0:0:0 is performing a NAT on the Network. How can I detect which computer is doing this activity?

Enzo.

[alemabrahao]

You can track which port this machine is connected to by looking up your switch's MAC address table.

[EnzoLabruzzo]

Hello Alemabrahao.

Can you tell me how I can look for that Mac table on the switch?

Thank you,

[alemabrahao]

Is your switch Meraki or 3rd party switch?

[EnzoLabruzzo]

My switch is Meraki MS355

[alemabrahao]

If you click on Tools tab on the specific switch there's a button there. "MAC forwarding table" Hit Run.

[EnzoLabruzzo]

Thanks, Execute to see the table and I try to look for the MAC and it does not appear.

[alemabrahao]

It doesn't look like a MAC address, can you share the email you received?

[EnzoLabruzzo]

Yes, That MaC seems strange to me.

[alemabrahao]

I think it's not a MAC address and it's IPv6 address.

MS switches can alert an administrator if a device is detected that appears to be using Network Address Translation (NAT). NAT on the LAN may indicate the use of a rogue AP or router, but also may be used for legitimate purposes with technologies such as containers, or tracking prevention. 

https://documentation.meraki.com/MS/Monitoring_and_Reporting/NAT_Detection_on_MS_Switches

[EnzoLabruzzo · Accepted solution]

I'm going to verify and anything I'll write another comment. Thank you

[ww]

Maybe  a meraki ap using a ssid in nat mode?

Look in your inventory for a device with mac something like 11:2b

[EnzoLabruzzo]

If I have configured my AP in NAT mode, but none of the MAC addresses of the APs start with that IP, The other thing that seems strange to me is that the IPV6 Addresses have xxxx: xxxx: xxxx: this format and there it shows only xxx: xxx: xxx:.

I don't understand what could be happening.

[JacekJ]

Sorry for the offtop, but since Meraki totally fails communicating this issue I just want to let you know, that if you are using the "A client is detected sharing its IP address via NAT" alert, please be careful with that, it can cause performance issues on switches (some traffic gets dropped).

They were supposed to remove that option, but after few weeks, no luck (I'm not surprised to be honest, but disappointed), more to read about this in this topic:

https://community.meraki.com/t5/Switching/CAUTION-ALERT-if-A-client-is-detected-sharing-its-IP-addre...