On a Cisco ASR running CGNAT, thousands of subscribers share a few public IPs, and DoT expects you to name the one behind any IP, port and timestamp. This guide shows ISPs and integrators how to export flows, log NAT events over NetFlow v9 or syslog, tie them to RADIUS, and avoid the gaps that fail audits.