Add support for per-uplink NAT exceptions on Appliance VLANs

[jon-humphries]

The Meraki "No NAT / NAT Exceptions" feature allows disabling source NAT on a per-VLAN per-uplink basis. This feature was previously behind the has_mx_no_nat_early_access early access opt-in but has now graduated to GA in MX 26.1.X firmware.

The beta API (v1-beta) has added a new uplinks attribute to the existing VLAN endpoint that enables per-uplink NAT exception configuration at the VLAN level.

Beta API Schema

PUT //networks/{networkId}/appliance/uplinks/nat

New uplinks property:

"uplinks": [
  {
    "interface": "wan1",
    "nat": {
      "enabled": true
    }
  },
  {
    "interface": "wan2",
    "nat": {
      "enabled": false
    }
  }
]

"Per-uplink NAT exception override configuration on the VLAN. Applicable only for networks that support NAT exceptions."

API Reference

• Beta spec: https://raw.githubusercontent.com/meraki/openapi/v1-beta/openapi/spec3.json
• Meraki documentation: https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Networks_and_Routing/NAT_Exceptions-No_NAT_on_MX_Security_Appliances

[rrahimm]

NAT exception is configured at 2 levels.

1. Just Wan interface level

2. Additional override at VLAN level

Wan Interface Level No-NAT settings

PUT Request
~ % curl -L --request PUT \
--url https://api.meraki.com/api/v1/networks/L_762234236932477820/appliance/uplinks/nat \
--header 'Authorization: Bearer xxxxxxxx' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data '{
    "uplinks": [
        {
            "interface": "wan1",
            "nat": { "enabled": true }
        },
        {
            "interface": "wan2",
            "nat": { "enabled": false }
        }
    ]
}'

Response:

{
  "uplinks": [
    {
      "interface": "wan1",
      "nat": {
        "enabled": true
      }
    },
    {
      "interface": "wan2",
      "nat": {
        "enabled": false
      }
    }
  ]
}

GET Request
 ~ % curl -L --request GET \
--url https://api.meraki.com/api/v1/organizations/1149116/appliance/uplinks/nat/byNetwork \
--header 'Authorization: Bearer xxxxxxxx' \
--header 'Accept: application/json'

Response:
{
  "items": [
    {
      "networkId": "L_762234236932477820",
      "uplinks": [
        {
          "interface": "wan1",
          "nat": {
            "enabled": true
          }
        },
        {
          "interface": "wan2",
          "nat": {
            "enabled": false
          }
        }
      ]
    }
  ],
  "meta": {
    "counts": {
      "items": {
        "total": 1,
        "remaining": 0
      }
    }
  }
}

[rrahimm]

No NAT override at VLAN level

curl -L --request PUT \
--url https://api.meraki.com/api/v1/networks/L_762234236932477820/appliance/vlans/123 \
--header 'Authorization: Bearer xxxxxxxxxx' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data '{
    "id": 123,
    "name": "test",
    "applianceIp": "10.10.100.1",
    "subnet": "10.10.100.0/24",
    "fixedIpAssignments": {},
    "reservedIpRanges": [],
    "dnsNameservers": "upstream_dns",
    "dhcpHandling": "Run a DHCP server",
    "dhcpLeaseTime": "1 day",
    "dhcpBootOptionsEnabled": false,
    "dhcpOptions": [],
    "interfaceId": "762234236933424174",
    "ipv6": { "enabled": false },
    "mandatoryDhcp": { "enabled": false },
    "uplinks": [
        {
            "interface": "wan1",
            "nat": { "enabled": true }
        },
        {
            "interface": "wan2",
            "nat": { "enabled": false }
        }
    ]
}'

Response:

{
    "id": 123,
    "networkId": "L_762234236932477820",
    "name": "test",
    "applianceIp": "10.10.100.1",
    "subnet": "10.10.100.0/24",
    "fixedIpAssignments": {},
    "reservedIpRanges": [],
    "dnsNameservers": "upstream_dns",
    "dhcpHandling": "Run a DHCP server",
    "dhcpLeaseTime": "1 day",
    "dhcpBootOptionsEnabled": false,
    "dhcpOptions": [],
    "interfaceId": "762234236933424174",
    "ipv6": { "enabled": false },
    "mandatoryDhcp": { "enabled": false },
    "uplinks": [
        {
            "interface": "wan1",
            "nat": { "enabled": true }
        },
        {
            "interface": "wan2",
            "nat": { "enabled": false }
        }
    ]
}


curl -L --request GET \
--url https://api.meraki.com/api/v1/networks/L_762234236932477820/appliance/vlans \
--header 'Authorization: Bearer 424ec950ac95682b3a7a9fdc50a0869c40ee96e5' \
--header 'Accept: application/json'

Response
[
    {
        "id": 1,
        "networkId": "L_762234236932477820",
        "name": "Default",
        "applianceIp": "192.168.128.1",
        "subnet": "192.168.128.0/24",
        "fixedIpAssignments": {},
        "reservedIpRanges": [],
        "dnsNameservers": "upstream_dns",
        "dhcpHandling": "Run a DHCP server",
        "dhcpLeaseTime": "1 day",
        "dhcpBootOptionsEnabled": false,
        "dhcpOptions": [],
        "interfaceId": "762234236933417478",
        "ipv6": { "enabled": false },
        "mandatoryDhcp": { "enabled": false },
        "uplinks": []
    },
    {
        "id": 123,
        "networkId": "L_762234236932477820",
        "name": "test",
        "applianceIp": "10.10.100.1",
        "subnet": "10.10.100.0/24",
        "fixedIpAssignments": {},
        "reservedIpRanges": [],
        "dnsNameservers": "upstream_dns",
        "dhcpHandling": "Run a DHCP server",
        "dhcpLeaseTime": "1 day",
        "dhcpBootOptionsEnabled": false,
        "dhcpOptions": [],
        "interfaceId": "762234236933424174",
        "ipv6": { "enabled": false },
        "mandatoryDhcp": { "enabled": false },
        "uplinks": [
            {
                "interface": "wan1",
                "nat": { "enabled": true }
            },
            {
                "interface": "wan2",
                "nat": { "enabled": false }
            }
        ]
    }
]

[rrahimm]

@fmunozmiranda and @danischm

There has been a recent change in MERAKI API that came along with making NAT Exceptions GA. This has now broken the support for inbound firewall rules. We now need the above enhancements added on priority to keep this feature working.

https://documentation.meraki.com/Platform_Management/Product_Information/Compatibility_and_Firmware/Security_and_SD-WAN_(MX%2CZ)_Features_Directory#Beta_Release-_MX_26.1.X_Firmware_Features

NAT Exceptions	NAT Exceptions (AKA No NAT) offer the ability to configure NAT exemptions on some or all configured VLANs. This exempts the source IP address of a packet received on the LAN of the WAN appliance from being rewritten as it transverses the WAN uplink.