NAT has been detected on 1 client in the switch network

Solved
EnzoLabruzzo
Here to help

NAT has been detected on 1 client in the switch network

Hello Community

 

The Meraki Monitoring system is sending me several emails indicating that a client with a MAC a01:12b:0:0:0:0:0:0 is performing a NAT on the Network. How can I detect which computer is doing this activity?

 

Enzo.

1 Accepted Solution
EnzoLabruzzo
Here to help

I'm going to verify and anything I'll write another comment. Thank you

View solution in original post

13 Replies 13
alemabrahao
Kind of a big deal
Kind of a big deal

You can track which port this machine is connected to by looking up your switch's MAC address table.

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.
EnzoLabruzzo
Here to help

Hello Alemabrahao.

 

Can you tell me how I can look for that Mac table on the switch?

 

Thank you,

alemabrahao
Kind of a big deal
Kind of a big deal

Is your switch Meraki or 3rd party switch?

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.
EnzoLabruzzo
Here to help

My switch is Meraki MS355

 

alemabrahao
Kind of a big deal
Kind of a big deal

If you click on Tools tab on the specific switch there's a button there. "MAC forwarding table" Hit Run.

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.
EnzoLabruzzo
Here to help

EnzoLabruzzo_0-1675789291551.png

Thanks, Execute to see the table and I try to look for the MAC and it does not appear.

alemabrahao
Kind of a big deal
Kind of a big deal

It doesn't look like a MAC address, can you share the email you received?

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.
EnzoLabruzzo
Here to help

Yes, That MaC seems strange to me.

 

EnzoLabruzzo_0-1675789707629.png

 

alemabrahao
Kind of a big deal
Kind of a big deal

I think it's not a MAC address and it's IPv6 address.

 

MS switches can alert an administrator if a device is detected that appears to be using Network Address Translation (NAT). NAT on the LAN may indicate the use of a rogue AP or router, but also may be used for legitimate purposes with technologies such as containers, or tracking prevention. 

 

 

https://documentation.meraki.com/MS/Monitoring_and_Reporting/NAT_Detection_on_MS_Switches

 

 

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.
EnzoLabruzzo
Here to help

I'm going to verify and anything I'll write another comment. Thank you

ww
Kind of a big deal
Kind of a big deal

Maybe  a meraki ap using a ssid in nat mode?

Look in your inventory for a device with mac something like 11:2b

EnzoLabruzzo
Here to help

If I have configured my AP in NAT mode, but none of the MAC addresses of the APs start with that IP, The other thing that seems strange to me is that the IPV6 Addresses have xxxx: xxxx: xxxx: this format and there it shows only xxx: xxx: xxx:.

I don't understand what could be happening.

JacekJ
Building a reputation

Sorry for the offtop, but since Meraki totally fails communicating this issue I just want to let you know, that if you are using the "A client is detected sharing its IP address via NAT" alert, please be careful with that, it can cause performance issues on switches (some traffic gets dropped).

They were supposed to remove that option, but after few weeks, no luck (I'm not surprised to be honest, but disappointed), more to read about this in this topic:

https://community.meraki.com/t5/Switching/CAUTION-ALERT-if-A-client-is-detected-sharing-its-IP-addre...

Get notified when there are additional replies to this discussion.