Egress PE NAT is being used via a single centralized router to provide Internet access to L3VPN customers. Which description of the NAT operation is true?

In a multi-tenant environment where a single PE router provides centralized NAT services for multiple L3VPN customers, it is common for customers to use overlapping private IP address spaces (e.g., RFC 1918 addresses). To handle this, the NAT implementation must be VRF-aware. When a NAT translation is created for a packet originating from a customer's VRF, the NAT table on the PE router stores not only the IP and port mappings but also an identifier for the source VRF. This ensures that when return traffic arrives at the outside global address, the router can look up the correct translation, identify the original inside VRF, and forward the packet to the correct customer.

A. Port Address Translation (PAT) allows multiple inside local addresses, even from different VRFs, to be translated to the same outside global IP address using unique port numbers.
C. The question explicitly states that a single centralized router is providing the NAT service, which contradicts the premise that each site has a separate NAT.
D. A fundamental feature of MPLS L3VPNs is the ability to support customers with overlapping private IP address spaces, which VRF-aware NAT is specifically designed to accommodate.

1. Cisco IOS XE IP Addressing Services Configuration Guide

"Configuring NAT for VRF Awareness" section.

Reference: "When a packet is translated

a NAT translation entry is created. This entry contains the inside VRF of the packet. When a translated packet is forwarded

the VRF in the NAT translation entry is used to route the packet." This directly confirms that the NAT table contains a field for the inside VRF. The same document also states

"This feature allows multiple VRFs to be configured on a single device to use the same IP address

" which refutes option D.

2. Cisco IOS IP Application Services Configuration Guide

"NAT Virtual Interface" chapter.

Reference: The documentation for the NAT Virtual Interface (NVI) feature

which is often used in VRF-aware NAT

explains that translations are VRF-aware. The configuration commands

such as ip nat inside source ... vrf ...

explicitly tie the NAT rule and its subsequent translation entries to a specific VRF

demonstrating that the VRF is a key component of the translation logic.

3. Cisco Press

"MPLS Fundamentals" by Luc De Ghein

Chapter 8: "Advanced MPLS VPN Topics".

Reference: While a commercial book

its content is derived from official principles. It explains that for VPN Internet access

VRF-aware NAT is required to handle overlapping addresses. The NAT process must keep track of the originating VRF for each session to ensure return traffic is sent back to the correct VPN

which implies the VRF is part of the translation state.