4G NAT Classic Mode Topology
4G NAT Flat Mode Topology
Onyx 4G NAT Modes Comparison
| 4G NAT Classic Mode | 4G NAT Flat Mode | |
|---|---|---|
| Architecture | NAT gateway model with dual-interface design. Onyx Edge acts as secure gateway, applying NAT to all UE traffic before forwarding to the enterprise network. AP traffic terminates at the Onyx Edge. Provides complete isolation between RAN and enterprise networks. | NAT gateway model with single-interface design. Onyx Edge acts as gateway for UE traffic only, applying NAT before forwarding to enterprise network. APs share enterprise network infrastructure. |
| Traffic Flow | UE traffic: UE > AP > Onyx Edge (NAT applied) > enterprise network via eth0. AP traffic: APs > Onyx Edge eth1 (private interface) > Onyx Edge eth0 > enterprise network. Complete separation of RAN and enterprise traffic paths. | UE traffic: UE > AP > Onyx Edge (NAT applied) > enterprise network via eth0. AP traffic: APs > enterprise network > Onyx Edge eth0. Both UE and AP traffic share a single interface (eth0), doubling interface load. |
| IP Address Management | Onyx Edge assigns IP addresses to UE from its local pool. Onyx Edge assigns IP addresses to APs via its DHCP service. Enterprise network sees only the Onyx Edge's NAT IP address. | Onyx Edge assigns IP addresses to UE from its local pool. Enterprise DHCP service assigns IP addresses to APs. Enterprise network sees only the Onyx Edge's NAT IP address for UE traffic. |
| Network Isolation | Strong isolation. APs and UE are completely isolated from the enterprise network behind NAT. APs can only communicate with the Onyx Edge via dedicated private interface. Enterprise devices cannot directly access RAN infrastructure or UE. | Weaker isolation. UE are hidden behind NAT, but APs reside on enterprise subnet where they can be accessed by other enterprise devices. Creates higher security risk for RAN infrastructure. Enterprise cannot directly access UE. |
| Interfaces | Dual interfaces provide physical separation: eth1 (dedicated private interface for S1/AP connections) and eth0 (SGi interface connecting to enterprise network). Ensures predictable and controlled traffic separation. | Single interface handles all traffic: eth0 handles both SGi (UE traffic) and S1 (AP control) traffic. Simplifies cabling but combines RAN control and user plane traffic. |
| APN/VLAN Integration | No APN-to-VLAN mapping. All UE traffic from different APNs is collapsed behind NAT and appears as single Onyx Edge IP address on the enterprise network. No VLAN segmentation required. | Same as 4G NAT Classic Mode. |
| Deployment Complexity | Straightforward setup with clear network boundaries. Requires basic IP planning and dual network interfaces on the Onyx Edge. No enterprise VLAN coordination required. | Requires coordination with enterprise networking team to ensure APs can access enterprise DHCP and routing services. May need firewall rules to allow AP connectivity. |
| Best For | Recommended for most deployments. Ideal for enterprises prioritizing security, isolation, and predictable performance. Suitable for medium to large sites. Provides best balance of control, security, and scalability. | Small sites or "quick-start" deployments where enterprise switch VLAN support is not available. Suitable for temporary installations or pilot programs where simplified cabling is prioritized over security. |
| Cautions | Requires proper IP address planning to avoid conflicts. UE remain invisible to enterprise monitoring and management tools. Inbound access to UE is not possible without port forwarding configuration. | eth0 must carry both S1 control and SGi user-plane traffic, which may reduce effective throughput under high load. Capacity planning should account for combined traffic on a single interface. APs exposed on enterprise subnet. Harder to isolate RAN infrastructure. |
4G Bridge Classic Mode Topology
4G Bridge Flat Mode Topology
4G Bridge (APN-on-VLAN) Modes Comparison
| 4G Bridge Classic Mode | 4G Bridge Flat Mode | |
|---|---|---|
| Architecture | VLAN bridge model with dual-interface design. Onyx Edge bridges UE traffic directly into enterprise VLANs without NAT. Each APN maps to a dedicated VLAN, enabling enterprise to apply per-APN policies. APs isolated on private interface. | VLAN bridge model with single-interface design. Onyx Edge bridges UE traffic directly into enterprise VLANs without NAT. Each APN maps to a dedicated VLAN. APs share enterprise network infrastructure. |
| Traffic Flow | UE traffic: UE > AP > Onyx Edge (bridged to VLAN) > Enterprise VLANs via eth0 trunk port. AP traffic: APs > Onyx Edge eth1 (private interface). VLAN-tagged UE traffic separated from AP control traffic. | UE traffic: UE > AP > Onyx Edge (bridged to VLAN) > Enterprise VLANs via eth0 trunk port. AP traffic: APs > Enterprise network > Onyx Edge eth0. VLAN-tagged UE traffic and AP control traffic share single interface. |
| IP Address Management | Enterprise DHCP service assigns IP addresses to UE per VLAN. The Onyx Edge assigns IP addresses to APs via its own DHCP service. UE appear as native devices on enterprise subnets. | Enterprise DHCP service assigns IP addresses to both UE (per VLAN) and APs. UE appear as native devices on enterprise subnets. APs appear as standard enterprise network devices. |
| Network Isolation | Strong per-APN VLAN isolation. Each APN is tied to a dedicated VLAN with isolation maintained by enterprise switch/router policies. APs completely isolated on a dedicated private interface. Enterprise IT has full visibility and control over UE while RAN infrastructure remains protected. | Strong per-APN VLAN isolation for UE traffic. Each APN is tied to a dedicated VLAN with isolation maintained by enterprise switch/router policies. However, APs reside on enterprise subnet where they can be accessed by other devices, reducing RAN infrastructure isolation. |
| Interfaces | Dual interfaces handle traffic: eth0 (VLAN trunk port carrying tagged UE traffic to enterprise) and eth1 (dedicated private interface for AP connections). Provides clean separation between user plane and RAN control. | Single interface handles all traffic: eth0 (VLAN trunk port carrying both tagged UE traffic and AP control traffic). Simplifies cabling and switch configuration but doubles interface load. |
| APN/VLAN Integration | Full APN-to-VLAN mapping. Each APN is mapped to a unique VLAN. Enterprise can apply distinct firewall, QoS, and routing policies per VLAN. Scales for multiple network slices with granular control. | Same as 4G Bridge Classic Mode. |
| Deployment Complexity | Requires comprehensive planning: VLAN design per APN, enterprise DHCP/DNS coordination per VLAN, trunk port configuration on enterprise switches, and IT integration for policy enforcement. Requires significant enterprise networking team involvement. | Requires the same VLAN planning, DHCP/DNS coordination, and policy configuration as Classic mode. Simplified physical cabling (single interface) but increased configuration complexity to ensure proper traffic separation. Requires careful enterprise network capacity planning. |
| Best For | Enterprises requiring maximum security with per-APN isolation, direct UE device access, and advanced network policies. Ideal for mission-critical deployments where RAN infrastructure must remain isolated while UE require full enterprise integration. Suitable for large-scale, permanent installations. | Enterprises requiring per-APN isolation and direct UE device access but lacking infrastructure for dedicated AP connections. Suitable for sites with limited switching capacity or where running separate AP network is not feasible. Good for cost-sensitive deployments prioritizing UE visibility over RAN isolation. |
| Cautions | Heavily dependent on enterprise DHCP and routing infrastructure. Misconfigurations can result in broadcast storms, VLAN leakage, or inter-VLAN routing issues. UE are fully exposed on the enterprise network requiring appropriate security controls and network segmentation policies. | Same as 4G Bridge Classic Mode, plus additional risks: APs fully exposed on enterprise network create RAN security vulnerability. Single interface doubles traffic load and creates potential performance degradation. Enterprise network issues affect both UE and AP connectivity simultaneously. |
4G Networking Mode Selection
5G NAT Mode Topology
5G Bridge Mode Topology
Onyx 5G Deployment Modes Comparison
| 5G NAT Mode | 5G Bridge (APN-on-VLAN) Mode | |
|---|---|---|
| Architecture | NAT gateway model with dedicated fronthaul. Onyx Edge functions as secure gateway between private 5G RAN and enterprise network (N6 interface). All UE traffic NAT-translated before enterprise entry. APs/FHMs are always on dedicated private fronthaul links due to timing requirements. | VLAN bridge model with dedicated fronthaul. Onyx Edge bridges UE traffic directly into enterprise VLANs without NAT. Each APN maps to dedicated VLAN for granular enterprise policy control. APs/FHMs are always on dedicated private fronthaul links due to timing requirements. |
| Traffic Flow | UE traffic: UE > AP/FHM > Onyx Edge (NAT applied) > Enterprise network via N6 interface. AP/FHM traffic: APs/FHMs > Onyx Edge via dedicated fronthaul links (point-to-point, timing-sensitive). Complete isolation of RAN infrastructure from enterprise. | UE traffic: UE > AP/FHM > Onyx Edge (bridged to VLAN) > Enterprise VLANs via N6 trunk port. AP/FHM traffic: Same as 5G NAT Mode. Complete isolation of RAN infrastructure from enterprise. Only UE backhaul handling differs from NAT mode. |
| IP Address Management | Onyx Edge assigns IP addresses to UE from its local pool. Onyx Edge assigns IP addresses to APs and FHMs via its DHCP service. Enterprise network sees only the Onyx Edge's NAT IP address. | Enterprise DHCP service assigns IP addresses to UE per VLAN. Onyx Edge assigns IP addresses to APs and FHMs via its DHCP service. UE appear as native devices on enterprise subnets with enterprise-controlled addressing. |
| Network Isolation | Maximum isolation. APs/FHMs can only communicate with Onyx Edge via private fronthaul (no intermediate switches). UE are hidden behind NAT. Enterprise cannot directly access any RAN infrastructure or UE. Complete security boundary between 5G network and enterprise. | Strong per-APN VLAN isolation for UE traffic. Each APN is bridged into a dedicated VLAN with enterprise-controlled policies. APs/FHMs remain isolated on private fronthaul. UE are fully visible and manageable by enterprise IT. RAN infrastructure is protected while UE are integrated into the enterprise security framework. |
| Interfaces | Fronthaul: 10G+ point-to-point links between APs/FHMs and Onyx Edge (no switches, timing-critical). N6 (backhaul): Connects to enterprise network with NAT applied. | Fronthaul: Same as 5G NAT Mode. N6 (backhaul): Configured as VLAN trunk port connecting to enterprise network. RAN elements are isolated; only UE traffic reaches enterprise via tagged VLANs. |
| APN/VLAN Integration | No APN-to-VLAN mapping at enterprise level. All APN traffic is collapsed behind NAT. APN distinction is not visible to the enterprise network. | Full APN-to-VLAN mapping. Each APN maps to a unique VLAN. Enterprise can apply distinct firewall rules, QoS priorities, and routing policies per VLAN. Enables enterprise policy enforcement per slice. |
| Deployment Complexity | NAT simplifies IP management and reduces enterprise coordination. Requires proper IP address planning for local pools. Fronthaul requires high-speed point-to-point links with no intermediate switches. Less enterprise networking team involvement. Faster deployment. | Requires comprehensive VLAN-per-APN design, enterprise DHCP/DNS coordination per VLAN, N6 trunk port configuration, and deep enterprise IT integration. Fronthaul requirements are same as NAT mode. Significant planning and coordination required. Longer deployment timeline. |
| Best For | Enterprises needing maximum security and isolation where UE are completely shielded from the enterprise LAN. Ideal for high-security environments, quick deployments, or scenarios where the enterprise IT team has limited 5G expertise. Suitable when UE traffic patterns do not require enterprise-level differentiation. | Enterprises needing direct UE access, deep IT/security integration, and per-APN network policies. Ideal for complex deployments with multiple network slices (e.g., separate policies for video surveillance, IoT sensors, voice communications). Suitable for organizations with advanced enterprise networking capabilities. |
| Cautions | Requires proper IP address planning to avoid conflicts. Enterprise cannot directly access UE for management or monitoring. UE traffic patterns are not visible at the enterprise level. May not meet compliance requirements for device visibility in regulated industries. | Heavily dependent on enterprise DHCP, routing, and VLAN infrastructure. Misconfigurations can expose UE to unauthorized access or break VLAN isolation. Requires skilled network administrators familiar with both 5G and enterprise networking. UE are directly accessible on enterprise VLANs, requiring appropriate security controls and network segmentation policies. |
5G Networking Mode Selection
(switch network).
The **Networks** page displays the summary details of all networks configured under the selected Onyx Portal account.
{% endstep %}
{% step %}
For the network that you want to edit, in the **Actions** column, click the corresponding ⋮ (options) icon, then click **Edit**.
The **Edit Network** page > **Network** tab is displayed.
{% endstep %}
{% step %}
In the **Core/RAN** tab:
* To enable NAT mode, turn off the **APN on a VLAN** toggle switch.
* To enable Bridge mode, turn on the **APN on a VLAN** toggle switch.
Network-Level Configuration to Enable NAT or Bridge Mode
NOTE: This IP must be different than Start IP (see below) but must be from the same subnet.
Each APN must be mapped to a unique VLAN to enable proper traffic segregation and enterprise policy enforcement.
NOTE: Each APN must be mapped to a unique VLAN to enable proper traffic segregation and enterprise policy enforcement. The N6 interface is configured as a VLAN trunk to carry tagged UE traffic to the enterprise network.