diff --git a/src/plugins/nat/CMakeLists.txt b/src/plugins/nat/CMakeLists.txt
index 5ce8b8a..688eb4f 100644
--- a/src/plugins/nat/CMakeLists.txt
+++ b/src/plugins/nat/CMakeLists.txt
@@ -30,9 +30,6 @@
   out2in.c
   out2in_ed.c
   nat_ipfix_logging.c
-  nat_det.c
-  nat_det_in2out.c
-  nat_det_out2in.c
   nat_dpo.c
   nat44_cli.c
   nat44_handoff.c
@@ -56,8 +53,6 @@
   nat44_handoff.c
   nat64_in2out.c
   nat64_out2in.c
-  nat_det_in2out.c
-  nat_det_out2in.c
   out2in.c
   out2in_ed.c
 
@@ -116,3 +111,22 @@
 
   LINK_LIBRARIES nat
 )
+
+add_vpp_plugin(det44
+  SOURCES
+  det44/det44.c
+  det44/det44_cli.c
+  det44/det44_api.c
+  det44/det44_in2out.c
+  det44/det44_out2in.c
+
+  MULTIARCH_SOURCES
+  det44/det44_in2out.c
+  det44/det44_out2in.c
+
+  API_FILES
+  det44/det44.api
+  nat_types.api
+
+  LINK_LIBRARIES nat
+)
diff --git a/src/plugins/nat/FEATURE.yaml b/src/plugins/nat/FEATURE.yaml
index 183db05..175d2c8 100644
--- a/src/plugins/nat/FEATURE.yaml
+++ b/src/plugins/nat/FEATURE.yaml
@@ -15,7 +15,7 @@
       - Endpoint dependent NAT
       - TCP MSS clamping
       - Local bypass (DHCP)
-  - CGN - deterministic NAT
+  - DET44 - deterministic NAT (CGN)
   - NAT64
   - NAT66
   - DS-lite
diff --git a/src/plugins/nat/det44/det44.api b/src/plugins/nat/det44/det44.api
new file mode 100644
index 0000000..818d46a
--- /dev/null
+++ b/src/plugins/nat/det44/det44.api
@@ -0,0 +1,469 @@
+/*
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+option version = "1.0.0";
+import "vnet/ip/ip_types.api";
+import "vnet/interface_types.api";
+import "plugins/nat/nat_types.api";
+
+/**
+ * @file det44.api
+ * @brief VPP control-plane API messages.
+ *
+ * This file defines VPP control-plane API messages which are generally
+ * called through a shared memory interface.
+ */
+
+/** \brief Enable/disable DET44 plugin
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param inside_vrf - inside VRF id
+    @param outside_vrf - outside VRF id
+    @param enable - true if enable, false if disable
+*/
+autoreply define det44_plugin_enable_disable {
+  u32 client_index;
+  u32 context;
+  u32 inside_vrf;
+  u32 outside_vrf;
+  bool enable;
+  vl_api_interface_index_t sw_if_index;
+  option status="in_progress";
+};
+
+/** \brief Enable/disable DET44 feature on the interface
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param is_add - true if add, false if delete
+    @param is_inside - true if interface is inside, false if outside
+    @param sw_if_index - software index of the interface
+*/
+autoreply define det44_interface_add_del_feature {
+  u32 client_index;
+  u32 context;
+  bool is_add;
+  bool is_inside;
+  vl_api_interface_index_t sw_if_index;
+  option status="in_progress";
+};
+
+/** \brief Dump interfaces with DET44 feature
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+*/
+define det44_interface_dump {
+  u32 client_index;
+  u32 context;
+  option status="in_progress";
+};
+
+/** \brief DET44 interface details response
+    @param context - sender context, to match reply w/ request
+    @param is_inside - true if interface is inside, false if outside
+    @param sw_if_index - software index of the interface
+*/
+define det44_interface_details {
+  u32 context;
+  bool is_inside;
+  bool is_outside;
+  vl_api_interface_index_t sw_if_index;
+  option status="in_progress";
+};
+
+/** \brief Add/delete DET44 mapping
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param is_add - true if add, false if delete
+    @param in_addr - inside IPv4 address
+    @param in_plen - inside IPv4 address prefix length
+    @param out_addr - outside IPv4 address
+    @param out_plen - outside IPv4 address prefix length
+*/
+autoreply define det44_add_del_map {
+  u32 client_index;
+  u32 context;
+  bool is_add;
+  vl_api_ip4_address_t in_addr;
+  u8 in_plen;
+  vl_api_ip4_address_t out_addr;
+  u8 out_plen;
+};
+
+/** \brief Get outside address and port range from inside address
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param in_addr - inside IP address
+*/
+define det44_forward {
+  u32 client_index;
+  u32 context;
+  vl_api_ip4_address_t in_addr;
+};
+
+/** \brief Get outside address and port range from inside address
+    @param context - sender context, to match reply w/ request
+    @param retval - return code
+    @param out_port_lo - outside port range start
+    @param out_port_hi - outside port range end
+    @param out_addr - outside IPv4 address
+*/
+define det44_forward_reply {
+  u32 context;
+  i32 retval;
+  u16 out_port_lo;
+  u16 out_port_hi;
+  vl_api_ip4_address_t out_addr;
+};
+
+/** \brief Get inside address from outside address and port
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param out_port - outside port
+    @param out_addr - outside IPv4 address
+*/
+define det44_reverse {
+  u32 client_index;
+  u32 context;
+  u16 out_port;
+  vl_api_ip4_address_t out_addr;
+};
+
+/** \brief Get inside address from outside address and port reply
+    @param context - sender context, to match reply w/ request
+    @param retval - return code
+    @param in_addr - inside IP address
+*/
+define det44_reverse_reply {
+  u32 context;
+  i32 retval;
+  vl_api_ip4_address_t in_addr;
+};
+
+/** \brief Dump DET44 mappings
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+*/
+define det44_map_dump {
+  u32 client_index;
+  u32 context;
+};
+
+/** \brief DET44 users response
+    @param context - sender context, to match reply w/ request
+    @param in_addr - inside IPv4 address
+    @param in_plen - inside IPv4 address prefix length
+    @param out_addr - outside IPv4 address
+    @param out_plen - outside IPv4 address prefix length
+    @param sharing_ratio - outside to inside address sharing ratio
+    @param ports_per_host - number of ports available to a host
+    @param ses_num - number of sessions belonging to this mapping
+*/
+define det44_map_details {
+  u32 context;
+  vl_api_ip4_address_t in_addr;
+  u8 in_plen;
+  vl_api_ip4_address_t out_addr;
+  u8 out_plen;
+  u32 sharing_ratio;
+  u16 ports_per_host;
+  u32 ses_num;
+};
+
+/** \brief Close DET44 session by outside address and port
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param out_addr - outside IPv4 address
+    @param out_port - outside port
+    @param ext_addr - external host IPv4 address
+    @param ext_port - external host port
+*/
+autoreply define det44_close_session_out {
+  u32 client_index;
+  u32 context;
+  vl_api_ip4_address_t out_addr;
+  u16 out_port;
+  vl_api_ip4_address_t ext_addr;
+  u16 ext_port;
+};
+
+/** \brief Close DET44 session by inside address and port
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param in_addr - inside IP address
+    @param in_port - inside port
+    @param ext_addr - external host IP address
+    @param ext_port - external host port
+*/
+autoreply define det44_close_session_in {
+  u32 client_index;
+  u32 context;
+  vl_api_ip4_address_t in_addr;
+  u16 in_port;
+  vl_api_ip4_address_t ext_addr;
+  u16 ext_port;
+};
+
+/** \brief Dump DET44 sessions
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param user_addr - address of an inside user whose sessions to dump
+*/
+define det44_session_dump {
+  u32 client_index;
+  u32 context;
+  vl_api_ip4_address_t user_addr;
+};
+
+/** \brief DET44 sessions reply
+    @param context - sender context, to match reply w/ request
+    @param in_port - inside port
+    @param ext_addr - external host IPv4 address
+    @param ext_port - external host port
+    @param out_port - outside port
+    @param state - session state
+    @param expire - session expiration timestamp
+*/
+define det44_session_details {
+  u32 context;
+  u16 in_port;
+  vl_api_ip4_address_t ext_addr;
+  u16 ext_port;
+  u16 out_port;
+  u8 state;
+  u32 expire;
+};
+
+/** \brief Set values of timeouts for DET44 sessions (seconds)
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param udp - UDP timeout (default 300sec)
+    @param tcp_established - TCP established timeout (default 7440sec)
+    @param tcp_transitory - TCP transitory timeout (default 240sec)
+    @param icmp - ICMP timeout (default 60sec)
+*/
+autoreply define det44_set_timeouts {
+  u32 client_index;
+  u32 context;
+  u32 udp;
+  u32 tcp_established;
+  u32 tcp_transitory;
+  u32 icmp;
+  option status="in_progress";
+};
+
+/** \brief Get values of timeouts for DET44 sessions (seconds)
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+*/
+define det44_get_timeouts {
+  u32 client_index;
+  u32 context;
+};
+
+/** \brief Get values of timeouts for DET44 sessions reply
+    @param context - sender context, to match reply w/ request
+    @param retval - return code
+    @param udp - UDP timeout
+    @param tcp_established - TCP established timeout
+    @param tcp_transitory - TCP transitory timeout
+    @param icmp - ICMP timeout
+*/
+define det44_get_timeouts_reply {
+  u32 context;
+  i32 retval;
+  u32 udp;
+  u32 tcp_established;
+  u32 tcp_transitory;
+  u32 icmp;
+  option status="in_progress";
+};
+
+/*
+ * Obsolete deterministic API to be removed
+ */
+
+/** \brief Add/delete NAT deterministic mapping
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param is_add - true if add, false if delete
+    @param in_addr - inside IPv4 address
+    @param in_plen - inside IPv4 address prefix length
+    @param out_addr - outside IPv4 address
+    @param out_plen - outside IPv4 address prefix length
+*/
+autoreply define nat_det_add_del_map {
+  u32 client_index;
+  u32 context;
+  bool is_add;
+  vl_api_ip4_address_t in_addr;
+  u8 in_plen;
+  vl_api_ip4_address_t out_addr;
+  u8 out_plen;
+  option status="deprecated";
+};
+
+/** \brief Get outside address and port range from inside address
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param in_addr - inside IP address
+*/
+define nat_det_forward {
+  u32 client_index;
+  u32 context;
+  vl_api_ip4_address_t in_addr;
+  option status="deprecated";
+};
+
+/** \brief Get outside address and port range from inside address
+    @param context - sender context, to match reply w/ request
+    @param retval - return code
+    @param out_port_lo - outside port range start
+    @param out_port_hi - outside port range end
+    @param out_addr - outside IPv4 address
+*/
+define nat_det_forward_reply {
+  u32 context;
+  i32 retval;
+  u16 out_port_lo;
+  u16 out_port_hi;
+  vl_api_ip4_address_t out_addr;
+  option status="deprecated";
+};
+
+/** \brief Get inside address from outside address and port
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param out_port - outside port
+    @param out_addr - outside IPv4 address
+*/
+define nat_det_reverse {
+  u32 client_index;
+  u32 context;
+  u16 out_port;
+  vl_api_ip4_address_t out_addr;
+  option status="deprecated";
+};
+
+/** \brief Get inside address from outside address and port reply
+    @param context - sender context, to match reply w/ request
+    @param retval - return code
+    @param in_addr - inside IP address
+*/
+define nat_det_reverse_reply {
+  u32 context;
+  i32 retval;
+  vl_api_ip4_address_t in_addr;
+  option status="deprecated";
+};
+
+/** \brief Dump NAT deterministic mappings
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+*/
+define nat_det_map_dump {
+  u32 client_index;
+  u32 context;
+  option status="deprecated";
+};
+
+/** \brief NAT users response
+    @param context - sender context, to match reply w/ request
+    @param in_addr - inside IPv4 address
+    @param in_plen - inside IPv4 address prefix length
+    @param out_addr - outside IPv4 address
+    @param out_plen - outside IPv4 address prefix length
+    @param sharing_ratio - outside to inside address sharing ratio
+    @param ports_per_host - number of ports available to a host
+    @param ses_num - number of sessions belonging to this mapping
+*/
+define nat_det_map_details {
+  u32 context;
+  vl_api_ip4_address_t in_addr;
+  u8 in_plen;
+  vl_api_ip4_address_t out_addr;
+  u8 out_plen;
+  u32 sharing_ratio;
+  u16 ports_per_host;
+  u32 ses_num;
+  option status="deprecated";
+};
+
+/** \brief Close deterministic NAT session by outside address and port
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param out_addr - outside IPv4 address
+    @param out_port - outside port
+    @param ext_addr - external host IPv4 address
+    @param ext_port - external host port
+*/
+autoreply define nat_det_close_session_out {
+  u32 client_index;
+  u32 context;
+  vl_api_ip4_address_t out_addr;
+  u16 out_port;
+  vl_api_ip4_address_t ext_addr;
+  u16 ext_port;
+  option status="deprecated";
+};
+
+/** \brief Close deterministic NAT session by inside address and port
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param in_addr - inside IP address
+    @param in_port - inside port
+    @param ext_addr - external host IP address
+    @param ext_port - external host port
+*/
+autoreply define nat_det_close_session_in {
+  u32 client_index;
+  u32 context;
+  vl_api_ip4_address_t in_addr;
+  u16 in_port;
+  vl_api_ip4_address_t ext_addr;
+  u16 ext_port;
+  option status="deprecated";
+};
+
+/** \brief Dump determinstic NAT sessions
+    @param client_index - opaque cookie to identify the sender
+    @param context - sender context, to match reply w/ request
+    @param user_addr - address of an inside user whose sessions to dump
+*/
+define nat_det_session_dump {
+  u32 client_index;
+  u32 context;
+  vl_api_ip4_address_t user_addr;
+  option status="deprecated";
+};
+
+/** \brief Deterministic NAT sessions reply
+    @param context - sender context, to match reply w/ request
+    @param in_port - inside port
+    @param ext_addr - external host IPv4 address
+    @param ext_port - external host port
+    @param out_port - outside NAT port
+    @param state - session state
+    @param expire - session expiration timestamp
+*/
+define nat_det_session_details {
+  u32 context;
+  u16 in_port;
+  vl_api_ip4_address_t ext_addr;
+  u16 ext_port;
+  u16 out_port;
+  u8 state;
+  u32 expire;
+  option status="deprecated";
+};
diff --git a/src/plugins/nat/det44/det44.c b/src/plugins/nat/det44/det44.c
new file mode 100644
index 0000000..886092c
--- /dev/null
+++ b/src/plugins/nat/det44/det44.c
@@ -0,0 +1,608 @@
+/*
+ * det44.c - deterministic NAT
+ *
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * @file
+ * @brief deterministic NAT (CGN)
+ */
+
+#include <vnet/vnet.h>
+#include <vnet/ip/ip.h>
+#include <vnet/ip/ip4.h>
+#include <vpp/app/version.h>
+#include <vnet/plugin/plugin.h>
+
+#include <nat/det44/det44.h>
+
+det44_main_t det44_main;
+
+/* *INDENT-OFF* */
+VNET_FEATURE_INIT (ip4_det44_in2out, static) = {
+  .arc_name = "ip4-unicast",
+  .node_name = "det44-in2out",
+  .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
+                               "ip4-sv-reassembly-feature"),
+};
+VNET_FEATURE_INIT (ip4_det44_out2in, static) = {
+  .arc_name = "ip4-unicast",
+  .node_name = "det44-out2in",
+  .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa",
+                               "ip4-sv-reassembly-feature",
+                               "ip4-dhcp-client-detect"),
+};
+VLIB_PLUGIN_REGISTER () = {
+    .version = VPP_BUILD_VER,
+    .description = "Deterministic NAT (CGN)",
+};
+/* *INDENT-ON* */
+
+void
+det44_add_del_addr_to_fib (ip4_address_t * addr, u8 p_len, u32 sw_if_index,
+			   int is_add)
+{
+  det44_main_t *dm = &det44_main;
+  fib_prefix_t prefix = {
+    .fp_len = p_len,
+    .fp_proto = FIB_PROTOCOL_IP4,
+    .fp_addr = {
+		.ip4.as_u32 = addr->as_u32,
+		},
+  };
+  u32 fib_index = ip4_fib_table_get_index_for_sw_if_index (sw_if_index);
+
+  if (is_add)
+    {
+      fib_table_entry_update_one_path (fib_index,
+				       &prefix,
+				       dm->fib_src_low,
+				       (FIB_ENTRY_FLAG_CONNECTED |
+					FIB_ENTRY_FLAG_LOCAL |
+					FIB_ENTRY_FLAG_EXCLUSIVE),
+				       DPO_PROTO_IP4,
+				       NULL,
+				       sw_if_index,
+				       ~0, 1, NULL, FIB_ROUTE_PATH_FLAG_NONE);
+    }
+  else
+    {
+      fib_table_entry_delete (fib_index, &prefix, dm->fib_src_low);
+    }
+}
+
+/**
+ * @brief Add/delete deterministic NAT mapping.
+ *
+ * Create bijective mapping of inside address to outside address and port range
+ * pairs, with the purpose of enabling deterministic NAT to reduce logging in
+ * CGN deployments.
+ *
+ * @param in_addr  Inside network address.
+ * @param in_plen  Inside network prefix length.
+ * @param out_addr Outside network address.
+ * @param out_plen Outside network prefix length.
+ * @param is_add   If 0 delete, otherwise add.
+ */
+int
+snat_det_add_map (ip4_address_t * in_addr, u8 in_plen,
+		  ip4_address_t * out_addr, u8 out_plen, int is_add)
+{
+  static snat_det_session_t empty_snat_det_session = { 0 };
+  det44_main_t *dm = &det44_main;
+  ip4_address_t in_cmp, out_cmp;
+  det44_interface_t *i;
+  snat_det_map_t *mp;
+  u8 found = 0;
+
+  in_cmp.as_u32 = in_addr->as_u32 & ip4_main.fib_masks[in_plen];
+  out_cmp.as_u32 = out_addr->as_u32 & ip4_main.fib_masks[out_plen];
+  vec_foreach (mp, dm->det_maps)
+  {
+    /* Checking for overlapping addresses to be added here */
+    if (mp->in_addr.as_u32 == in_cmp.as_u32 &&
+	mp->in_plen == in_plen &&
+	mp->out_addr.as_u32 == out_cmp.as_u32 && mp->out_plen == out_plen)
+      {
+	found = 1;
+	break;
+      }
+  }
+
+  /* If found, don't add again */
+  if (found && is_add)
+    return VNET_API_ERROR_VALUE_EXIST;
+
+  /* If not found, don't delete */
+  if (!found && !is_add)
+    return VNET_API_ERROR_NO_SUCH_ENTRY;
+
+  if (is_add)
+    {
+      pool_get (dm->det_maps, mp);
+      clib_memset (mp, 0, sizeof (*mp));
+      mp->in_addr.as_u32 = in_cmp.as_u32;
+      mp->in_plen = in_plen;
+      mp->out_addr.as_u32 = out_cmp.as_u32;
+      mp->out_plen = out_plen;
+      mp->sharing_ratio = (1 << (32 - in_plen)) / (1 << (32 - out_plen));
+      mp->ports_per_host = (65535 - 1023) / mp->sharing_ratio;
+
+      vec_validate_init_empty (mp->sessions,
+			       DET44_SES_PER_USER * (1 << (32 - in_plen)) -
+			       1, empty_snat_det_session);
+    }
+  else
+    {
+      vec_free (mp->sessions);
+      vec_del1 (dm->det_maps, mp - dm->det_maps);
+    }
+
+  /* Add/del external address range to FIB */
+  /* *INDENT-OFF* */
+  pool_foreach (i, dm->interfaces, ({
+    if (det44_interface_is_inside(i))
+      continue;
+    det44_add_del_addr_to_fib(out_addr, out_plen, i->sw_if_index, is_add);
+    goto out;
+  }));
+  /* *INDENT-ON* */
+out:
+  return 0;
+}
+
+int
+det44_set_timeouts (nat_timeouts_t * timeouts)
+{
+  det44_main_t *dm = &det44_main;
+  if (timeouts->udp)
+    dm->timeouts.udp = timeouts->udp;
+  if (timeouts->tcp.established)
+    dm->timeouts.tcp.established = timeouts->tcp.established;
+  if (timeouts->tcp.transitory)
+    dm->timeouts.tcp.transitory = timeouts->tcp.transitory;
+  if (timeouts->icmp)
+    dm->timeouts.icmp = timeouts->icmp;
+  return 0;
+}
+
+nat_timeouts_t
+det44_get_timeouts ()
+{
+  det44_main_t *dm = &det44_main;
+  return dm->timeouts;
+}
+
+void
+det44_reset_timeouts ()
+{
+  det44_main_t *dm = &det44_main;
+  dm->timeouts.udp = 300;
+  dm->timeouts.tcp.established = 7440;
+  dm->timeouts.tcp.transitory = 240;
+  dm->timeouts.icmp = 60;
+}
+
+int
+det44_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del)
+{
+  det44_main_t *dm = &det44_main;
+  det44_interface_t *tmp, *i = 0;
+  const char *feature_name;
+  int rv;
+
+  // TODO: if plugin is not enabled do not register nodes on interfaces
+  // rather make a structure and when enable call is used
+  // then register nodes
+
+  /* *INDENT-OFF* */
+  pool_foreach (tmp, dm->interfaces, ({
+    if (tmp->sw_if_index == sw_if_index)
+      {
+        i = tmp;
+        goto out;
+      }
+  }));
+  /* *INDENT-ON* */
+out:
+
+  feature_name = is_inside ? "det44-in2out" : "det44-out2in";
+
+  if (is_del)
+    {
+      if (!i)
+	{
+	  det44_log_err ("det44 is not enabled on this interface");
+	  return VNET_API_ERROR_INVALID_VALUE;
+	}
+
+      rv = ip4_sv_reass_enable_disable_with_refcnt (sw_if_index, 0);
+      if (rv)
+	return rv;
+
+      rv = vnet_feature_enable_disable ("ip4-unicast", feature_name,
+					sw_if_index, 1, 0, 0);
+      if (rv)
+	return rv;
+
+      pool_put (dm->interfaces, i);
+    }
+  else
+    {
+      if (i)
+	{
+	  det44_log_err ("det44 is already enabled on this interface");
+	  return VNET_API_ERROR_INVALID_VALUE;
+	}
+
+      rv = ip4_sv_reass_enable_disable_with_refcnt (sw_if_index, 1);
+      if (rv)
+	return rv;
+
+      rv = vnet_feature_enable_disable ("ip4-unicast", feature_name,
+					sw_if_index, 1, 0, 0);
+      if (rv)
+	return rv;
+
+      pool_get (dm->interfaces, i);
+      clib_memset (i, 0, sizeof (*i));
+
+      i->sw_if_index = sw_if_index;
+
+      if (is_inside)
+	i->flags |= DET44_INTERFACE_FLAG_IS_INSIDE;
+      else
+	i->flags |= DET44_INTERFACE_FLAG_IS_OUTSIDE;
+    }
+
+  if (!is_inside)
+    {
+      u32 fib_index = fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4,
+							   sw_if_index);
+      // add/del outside interface fib to registry
+      u8 found = 0;
+      det44_fib_t *outside_fib;
+      /* *INDENT-OFF* */
+      vec_foreach (outside_fib, dm->outside_fibs)
+        {
+          if (outside_fib->fib_index == fib_index)
+            {
+              if (!is_del)
+                {
+                  outside_fib->refcount++;
+                }
+              else
+                {
+                  outside_fib->refcount--;
+                  if (!outside_fib->refcount)
+                    {
+                      vec_del1 (dm->outside_fibs,
+                                outside_fib - dm->outside_fibs);
+                    }
+                }
+              found = 1;
+              break;
+            }
+        }
+      /* *INDENT-ON* */
+      if (!is_del && !found)
+	{
+	  vec_add2 (dm->outside_fibs, outside_fib, 1);
+	  outside_fib->fib_index = fib_index;
+	  outside_fib->refcount = 1;
+	}
+      // add/del outside address to FIB
+      snat_det_map_t *mp;
+      /* *INDENT-OFF* */
+      pool_foreach (mp, dm->det_maps, ({
+        det44_add_del_addr_to_fib(&mp->out_addr,
+                                  mp->out_plen, sw_if_index, !is_del);
+      }));
+      /* *INDENT-ON* */
+    }
+  return 0;
+}
+
+/**
+ * @brief The 'det44-expire-walk' process's main loop.
+ *
+ * Check expire time for active sessions.
+ */
+static uword
+det44_expire_walk_fn (vlib_main_t * vm, vlib_node_runtime_t * rt,
+		      vlib_frame_t * f)
+{
+  det44_main_t *dm = &det44_main;
+  snat_det_session_t *ses;
+  snat_det_map_t *mp;
+
+  vlib_process_wait_for_event_or_clock (vm, 10.0);
+  vlib_process_get_events (vm, NULL);
+  u32 now = (u32) vlib_time_now (vm);
+  /* *INDENT-OFF* */
+  pool_foreach (mp, dm->det_maps, ({
+    vec_foreach(ses, mp->sessions)
+      {
+        /* Delete if session expired */
+        if (ses->in_port && (ses->expire < now))
+          snat_det_ses_close (mp, ses);
+      }
+  }));
+  /* *INDENT-ON* */
+  return 0;
+}
+
+void
+det44_create_expire_walk_process ()
+{
+  det44_main_t *dm = &det44_main;
+
+  if (dm->expire_walk_node_index)
+    return;
+
+  dm->expire_walk_node_index = vlib_process_create (vlib_get_main (),
+						    "det44-expire-walk",
+						    det44_expire_walk_fn,
+						    16 /* stack_bytes */ );
+}
+
+int
+det44_plugin_enable (det44_config_t c)
+{
+  det44_main_t *dm = &det44_main;
+
+  if (plugin_enabled () == 1)
+    {
+      det44_log_err ("plugin already enabled!");
+      return 1;
+    }
+
+  det44_log_err ("inside %u, outside %u", c.inside_vrf_id, c.outside_vrf_id);
+
+  dm->outside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
+							     c.outside_vrf_id,
+							     dm->fib_src_hi);
+  dm->inside_fib_index = fib_table_find_or_create_and_lock (FIB_PROTOCOL_IP4,
+							    c.inside_vrf_id,
+							    dm->fib_src_hi);
+
+  det44_create_expire_walk_process ();
+  dm->mss_clamping = 0;
+  dm->config = c;
+  dm->enabled = 1;
+  return 0;
+}
+
+int
+det44_plugin_disable ()
+{
+  det44_main_t *dm = &det44_main;
+  det44_interface_t *i, *interfaces;
+  snat_det_map_t *mp;
+  int rv = 0;
+
+  if (plugin_enabled () == 0)
+    {
+      det44_log_err ("plugin already disabled!");
+      return 1;
+    }
+
+  // DET44 cleanup (order dependent)
+  // 1) remove interfaces (det44_interface_add_del) removes map ranges from fib
+  // 2) free sessions
+  // 3) free maps
+
+  interfaces = vec_dup (dm->interfaces);
+  vec_foreach (i, interfaces)
+  {
+    vnet_main_t *vnm = vnet_get_main ();
+
+    if (i->flags & DET44_INTERFACE_FLAG_IS_INSIDE)
+      {
+	rv = det44_interface_add_del (i->sw_if_index, i->flags, 1);
+	if (rv)
+	  {
+	    det44_log_err ("inside interface %U del failed",
+			   unformat_vnet_sw_interface, vnm, i->sw_if_index);
+	  }
+      }
+
+    if (i->flags & DET44_INTERFACE_FLAG_IS_OUTSIDE)
+      {
+	rv = det44_interface_add_del (i->sw_if_index, i->flags, 1);
+	if (rv)
+	  {
+	    det44_log_err ("outside interface %U del failed",
+			   unformat_vnet_sw_interface, vnm, i->sw_if_index);
+	  }
+
+      }
+  }
+  vec_free (interfaces);
+
+  /* *INDENT-OFF* */
+  pool_foreach (mp, dm->det_maps,
+  ({
+    vec_free (mp->sessions);
+  }));
+  /* *INDENT-ON* */
+
+  det44_reset_timeouts ();
+  dm->enabled = 0;
+
+  pool_free (dm->interfaces);
+  pool_free (dm->det_maps);
+
+  return rv;
+}
+
+static void
+det44_update_outside_fib (ip4_main_t * im,
+			  uword opaque,
+			  u32 sw_if_index, u32 new_fib_index,
+			  u32 old_fib_index)
+{
+  det44_main_t *dm = &det44_main;
+
+  det44_fib_t *outside_fib;
+  det44_interface_t *i;
+
+  u8 is_add = 1;
+  u8 match = 0;
+
+  if (plugin_enabled () == 0)
+    return;
+
+  if (new_fib_index == old_fib_index)
+    return;
+
+  if (!vec_len (dm->outside_fibs))
+    return;
+
+  /* *INDENT-OFF* */
+  pool_foreach (i, dm->interfaces,
+    ({
+      if (i->sw_if_index == sw_if_index)
+        {
+          if (!(det44_interface_is_outside (i)))
+	    return;
+          match = 1;
+        }
+    }));
+  /* *INDENT-ON* */
+
+  if (!match)
+    return;
+
+  vec_foreach (outside_fib, dm->outside_fibs)
+  {
+    if (outside_fib->fib_index == old_fib_index)
+      {
+	outside_fib->refcount--;
+	if (!outside_fib->refcount)
+	  vec_del1 (dm->outside_fibs, outside_fib - dm->outside_fibs);
+	break;
+      }
+  }
+
+  vec_foreach (outside_fib, dm->outside_fibs)
+  {
+    if (outside_fib->fib_index == new_fib_index)
+      {
+	outside_fib->refcount++;
+	is_add = 0;
+	break;
+      }
+  }
+
+  if (is_add)
+    {
+      vec_add2 (dm->outside_fibs, outside_fib, 1);
+      outside_fib->refcount = 1;
+      outside_fib->fib_index = new_fib_index;
+    }
+}
+
+static clib_error_t *
+det44_init (vlib_main_t * vm)
+{
+  det44_main_t *dm = &det44_main;
+  ip4_table_bind_callback_t cb;
+  vlib_node_t *node;
+
+  clib_memset (dm, 0, sizeof (*dm));
+
+  dm->ip4_main = &ip4_main;
+  dm->log_class = vlib_log_register_class ("det44", 0);
+
+  node = vlib_get_node_by_name (vm, (u8 *) "det44-in2out");
+  dm->in2out_node_index = node->index;
+  node = vlib_get_node_by_name (vm, (u8 *) "det44-out2in");
+  dm->out2in_node_index = node->index;
+
+  dm->fib_src_hi = fib_source_allocate ("det44-hi",
+					FIB_SOURCE_PRIORITY_HI,
+					FIB_SOURCE_BH_SIMPLE);
+  dm->fib_src_low = fib_source_allocate ("det44-low",
+					 FIB_SOURCE_PRIORITY_LOW,
+					 FIB_SOURCE_BH_SIMPLE);
+
+  cb.function = det44_update_outside_fib;
+  cb.function_opaque = 0;
+  vec_add1 (dm->ip4_main->table_bind_callbacks, cb);
+
+  det44_reset_timeouts ();
+  return det44_api_hookup (vm);
+}
+
+VLIB_INIT_FUNCTION (det44_init);
+
+u8 *
+format_det44_session_state (u8 * s, va_list * args)
+{
+  u32 i = va_arg (*args, u32);
+  u8 *t = 0;
+
+  switch (i)
+    {
+#define _(v, N, str) case DET44_SESSION_##N: t = (u8 *) str; break;
+      foreach_det44_session_state
+#undef _
+    default:
+      t = format (t, "unknown");
+    }
+  s = format (s, "%s", t);
+  return s;
+}
+
+u8 *
+format_det_map_ses (u8 * s, va_list * args)
+{
+  snat_det_map_t *det_map = va_arg (*args, snat_det_map_t *);
+  ip4_address_t in_addr, out_addr;
+  u32 in_offset, out_offset;
+  snat_det_session_t *ses = va_arg (*args, snat_det_session_t *);
+  u32 *i = va_arg (*args, u32 *);
+
+  u32 user_index = *i / DET44_SES_PER_USER;
+  in_addr.as_u32 =
+    clib_host_to_net_u32 (clib_net_to_host_u32 (det_map->in_addr.as_u32) +
+			  user_index);
+  in_offset =
+    clib_net_to_host_u32 (in_addr.as_u32) -
+    clib_net_to_host_u32 (det_map->in_addr.as_u32);
+  out_offset = in_offset / det_map->sharing_ratio;
+  out_addr.as_u32 =
+    clib_host_to_net_u32 (clib_net_to_host_u32 (det_map->out_addr.as_u32) +
+			  out_offset);
+  s =
+    format (s,
+	    "in %U:%d out %U:%d external host %U:%d state: %U expire: %d\n",
+	    format_ip4_address, &in_addr, clib_net_to_host_u16 (ses->in_port),
+	    format_ip4_address, &out_addr,
+	    clib_net_to_host_u16 (ses->out.out_port), format_ip4_address,
+	    &ses->out.ext_host_addr,
+	    clib_net_to_host_u16 (ses->out.ext_host_port),
+	    format_det44_session_state, ses->state, ses->expire);
+
+  return s;
+}
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/nat/det44/det44.h b/src/plugins/nat/det44/det44.h
new file mode 100644
index 0000000..3ddba6d
--- /dev/null
+++ b/src/plugins/nat/det44/det44.h
@@ -0,0 +1,449 @@
+/*
+ * det44.h - deterministic NAT definitions
+ *
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file
+ * @brief Deterministic NAT (CGN) definitions
+ */
+
+#ifndef __included_det44_h__
+#define __included_det44_h__
+
+#include <vnet/vnet.h>
+#include <vnet/ip/ip.h>
+#include <vnet/ethernet/ethernet.h>
+#include <vnet/ip/icmp46_packet.h>
+#include <vnet/api_errno.h>
+#include <vnet/fib/fib_source.h>
+#include <vppinfra/dlist.h>
+#include <vppinfra/error.h>
+#include <vlibapi/api.h>
+#include <vlib/log.h>
+#include <vnet/fib/fib_table.h>
+#include <vnet/fib/ip4_fib.h>
+#include <vnet/ip/reass/ip4_sv_reass.h>
+
+#include <nat/lib/lib.h>
+#include <nat/lib/inlines.h>
+
+/* Session state */
+#define foreach_det44_session_state        \
+  _(0, UNKNOWN, "unknown")                 \
+  _(1, UDP_ACTIVE, "udp-active")           \
+  _(2, TCP_SYN_SENT, "tcp-syn-sent")       \
+  _(3, TCP_ESTABLISHED, "tcp-established") \
+  _(4, TCP_FIN_WAIT, "tcp-fin-wait")       \
+  _(5, TCP_CLOSE_WAIT, "tcp-close-wait")   \
+  _(6, TCP_CLOSING, "tcp-closing")         \
+  _(7, TCP_LAST_ACK, "tcp-last-ack")       \
+  _(8, TCP_CLOSED, "tcp-closed")           \
+  _(9, ICMP_ACTIVE, "icmp-active")
+
+typedef enum
+{
+#define _(v, N, s) DET44_SESSION_##N = v,
+  foreach_det44_session_state
+#undef _
+} det44_session_state_t;
+
+#define DET44_SES_PER_USER 1000
+
+typedef struct
+{
+  u16 identifier;
+  u16 sequence;
+} icmp_echo_header_t;
+
+typedef struct
+{
+  u16 src_port, dst_port;
+} tcp_udp_header_t;
+
+typedef struct
+{
+  u32 cached_sw_if_index;
+  u32 cached_ip4_address;
+} det44_runtime_t;
+
+typedef struct nat_timeouts_s
+{
+  u32 udp;
+
+  struct
+  {
+    u32 transitory;
+    u32 established;
+  } tcp;
+
+  u32 icmp;
+
+} nat_timeouts_t;
+
+/* deterministic session outside key */
+typedef struct
+{
+  union
+  {
+    struct
+    {
+      ip4_address_t ext_host_addr;
+      u16 ext_host_port;
+      u16 out_port;
+    };
+    u64 as_u64;
+  };
+} snat_det_out_key_t;
+
+typedef struct
+{
+  /* Inside network port */
+  u16 in_port;
+  /* Outside network address and port */
+  snat_det_out_key_t out;
+  /* Session state */
+  u8 state;
+  /* Expire timeout */
+  u32 expire;
+} snat_det_session_t;
+
+typedef struct
+{
+  /* inside IP address range */
+  ip4_address_t in_addr;
+  u8 in_plen;
+  /* outside IP address range */
+  ip4_address_t out_addr;
+  u8 out_plen;
+  /* inside IP addresses / outside IP addresses */
+  u32 sharing_ratio;
+  /* number of ports available to internal host */
+  u16 ports_per_host;
+  /* session counter */
+  u32 ses_num;
+  /* vector of sessions */
+  snat_det_session_t *sessions;
+} snat_det_map_t;
+
+typedef struct
+{
+  u32 sw_if_index;
+  u8 flags;
+} det44_interface_t;
+
+typedef struct
+{
+
+  u32 outside_vrf_id;
+  u32 inside_vrf_id;
+
+} det44_config_t;
+
+typedef struct
+{
+  u32 fib_index;
+  u32 refcount;
+} det44_fib_t;
+
+typedef struct det44_main_s
+{
+  det44_config_t config;
+
+  u32 outside_fib_index;
+  u32 inside_fib_index;
+
+  /* Vector of outside fibs */
+  det44_fib_t *outside_fibs;
+
+  fib_source_t fib_src_hi;
+  fib_source_t fib_src_low;
+
+  u32 out2in_node_index;
+  u32 in2out_node_index;
+
+  /* Deterministic NAT mappings */
+  snat_det_map_t *det_maps;
+
+  /* TCP MSS clamping */
+  u16 mss_clamping;
+
+  /* Protocol timeouts */
+  nat_timeouts_t timeouts;
+
+  /* Expire walk process node index */
+  u32 expire_walk_node_index;
+
+  u32 enabled;
+
+  /* API message ID base */
+  u16 msg_id_base;
+
+  /* log class */
+  vlib_log_class_t log_class;
+
+  det44_interface_t *interfaces;
+
+  /* convenience */
+  ip4_main_t *ip4_main;
+  /* required */
+  vnet_main_t *vnet_main;
+
+} det44_main_t;
+
+extern det44_main_t det44_main;
+
+/* logging */
+#define det44_log_err(...) \
+  vlib_log(VLIB_LOG_LEVEL_ERR, det44_main.log_class, __VA_ARGS__)
+#define det44_log_warn(...) \
+  vlib_log(VLIB_LOG_LEVEL_WARNING, det44_main.log_class, __VA_ARGS__)
+#define det44_log_notice(...) \
+  vlib_log(VLIB_LOG_LEVEL_NOTICE, det44_main.log_class, __VA_ARGS__)
+#define det44_log_info(...) \
+  vlib_log(VLIB_LOG_LEVEL_INFO, det44_main.log_class, __VA_ARGS__)
+#define det44_log_debug(...)\
+  vlib_log(VLIB_LOG_LEVEL_DEBUG, det44_main.log_class, __VA_ARGS__)
+
+/* Deterministic NAT interface flags */
+#define DET44_INTERFACE_FLAG_IS_INSIDE 1
+#define DET44_INTERFACE_FLAG_IS_OUTSIDE 2
+
+/** \brief Check if Deterministic NAT interface is inside.
+    @param i Deterministic NAT interface
+    @return 1 if inside interface
+*/
+#define det44_interface_is_inside(i) i->flags & DET44_INTERFACE_FLAG_IS_INSIDE
+
+/** \brief Check if Deterministic NAT interface is outside.
+    @param i Deterministic NAT interface
+    @return 1 if outside interface
+*/
+#define det44_interface_is_outside(i) i->flags & DET44_INTERFACE_FLAG_IS_OUTSIDE
+
+static_always_inline u8
+plugin_enabled ()
+{
+  det44_main_t *dm = &det44_main;
+  return dm->enabled;
+}
+
+extern vlib_node_registration_t det44_in2out_node;
+extern vlib_node_registration_t det44_out2in_node;
+
+int det44_plugin_enable ();
+int det44_plugin_disable ();
+
+int det44_interface_add_del (u32 sw_if_index, u8 is_inside, int is_del);
+
+int det44_set_timeouts (nat_timeouts_t * timeouts);
+nat_timeouts_t det44_get_timeouts ();
+void det44_reset_timeouts ();
+
+/* format functions */
+format_function_t format_det_map_ses;
+
+int snat_det_add_map (ip4_address_t * in_addr, u8 in_plen,
+		      ip4_address_t * out_addr, u8 out_plen, int is_add);
+
+/* icmp session match functions */
+u32 icmp_match_out2in_det (vlib_node_runtime_t * node,
+			   u32 thread_index, vlib_buffer_t * b0,
+			   ip4_header_t * ip0, ip4_address_t * addr,
+			   u16 * port, u32 * fib_index,
+			   nat_protocol_t * proto, void *d, void *e,
+			   u8 * dont_translate);
+u32 icmp_match_in2out_det (vlib_node_runtime_t * node,
+			   u32 thread_index, vlib_buffer_t * b0,
+			   ip4_header_t * ip0, ip4_address_t * addr,
+			   u16 * port, u32 * fib_index,
+			   nat_protocol_t * proto, void *d, void *e,
+			   u8 * dont_translate);
+u32 det44_icmp_in2out (vlib_buffer_t * b0, ip4_header_t * ip0,
+		       icmp46_header_t * icmp0, u32 sw_if_index0,
+		       u32 rx_fib_index0, vlib_node_runtime_t * node,
+		       u32 next0, u32 thread_index, void *d, void *e);
+u32 det44_icmp_out2in (vlib_buffer_t * b0, ip4_header_t * ip0,
+		       icmp46_header_t * icmp0, u32 sw_if_index0,
+		       u32 rx_fib_index0, vlib_node_runtime_t * node,
+		       u32 next0, u32 thread_index, void *d, void *e);
+
+static_always_inline int
+is_addr_in_net (ip4_address_t * addr, ip4_address_t * net, u8 plen)
+{
+  if (net->as_u32 == (addr->as_u32 & ip4_main.fib_masks[plen]))
+    return 1;
+  return 0;
+}
+
+static_always_inline snat_det_map_t *
+snat_det_map_by_user (ip4_address_t * user_addr)
+{
+  det44_main_t *dm = &det44_main;
+  snat_det_map_t *mp;
+  /* *INDENT-OFF* */
+  pool_foreach (mp, dm->det_maps,
+  ({
+    if (is_addr_in_net(user_addr, &mp->in_addr, mp->in_plen))
+      return mp;
+  }));
+  /* *INDENT-ON* */
+  return 0;
+}
+
+static_always_inline snat_det_map_t *
+snat_det_map_by_out (ip4_address_t * out_addr)
+{
+  det44_main_t *dm = &det44_main;
+  snat_det_map_t *mp;
+  /* *INDENT-OFF* */
+  pool_foreach (mp, dm->det_maps,
+  ({
+    if (is_addr_in_net(out_addr, &mp->out_addr, mp->out_plen))
+      return mp;
+  }));
+  /* *INDENT-ON* */
+  return 0;
+}
+
+static_always_inline void
+snat_det_forward (snat_det_map_t * dm, ip4_address_t * in_addr,
+		  ip4_address_t * out_addr, u16 * lo_port)
+{
+  u32 in_offset, out_offset;
+
+  in_offset = clib_net_to_host_u32 (in_addr->as_u32) -
+    clib_net_to_host_u32 (dm->in_addr.as_u32);
+  out_offset = in_offset / dm->sharing_ratio;
+  out_addr->as_u32 =
+    clib_host_to_net_u32 (clib_net_to_host_u32 (dm->out_addr.as_u32) +
+			  out_offset);
+  *lo_port = 1024 + dm->ports_per_host * (in_offset % dm->sharing_ratio);
+}
+
+static_always_inline void
+snat_det_reverse (snat_det_map_t * dm, ip4_address_t * out_addr, u16 out_port,
+		  ip4_address_t * in_addr)
+{
+  u32 in_offset1, in_offset2, out_offset;
+
+  out_offset = clib_net_to_host_u32 (out_addr->as_u32) -
+    clib_net_to_host_u32 (dm->out_addr.as_u32);
+  in_offset1 = out_offset * dm->sharing_ratio;
+  in_offset2 = (out_port - 1024) / dm->ports_per_host;
+  in_addr->as_u32 =
+    clib_host_to_net_u32 (clib_net_to_host_u32 (dm->in_addr.as_u32) +
+			  in_offset1 + in_offset2);
+}
+
+static_always_inline u32
+snat_det_user_ses_offset (ip4_address_t * addr, u8 plen)
+{
+  return (clib_net_to_host_u32 (addr->as_u32) & pow2_mask (32 - plen)) *
+    DET44_SES_PER_USER;
+}
+
+static_always_inline snat_det_session_t *
+snat_det_get_ses_by_out (snat_det_map_t * dm, ip4_address_t * in_addr,
+			 u64 out_key)
+{
+  u32 user_offset;
+  u16 i;
+
+  user_offset = snat_det_user_ses_offset (in_addr, dm->in_plen);
+  for (i = 0; i < DET44_SES_PER_USER; i++)
+    {
+      if (dm->sessions[i + user_offset].out.as_u64 == out_key)
+	return &dm->sessions[i + user_offset];
+    }
+
+  return 0;
+}
+
+static_always_inline snat_det_session_t *
+snat_det_find_ses_by_in (snat_det_map_t * dm, ip4_address_t * in_addr,
+			 u16 in_port, snat_det_out_key_t out_key)
+{
+  snat_det_session_t *ses;
+  u32 user_offset;
+  u16 i;
+
+  user_offset = snat_det_user_ses_offset (in_addr, dm->in_plen);
+  for (i = 0; i < DET44_SES_PER_USER; i++)
+    {
+      ses = &dm->sessions[i + user_offset];
+      if (ses->in_port == in_port &&
+	  ses->out.ext_host_addr.as_u32 == out_key.ext_host_addr.as_u32 &&
+	  ses->out.ext_host_port == out_key.ext_host_port)
+	return &dm->sessions[i + user_offset];
+    }
+
+  return 0;
+}
+
+static_always_inline snat_det_session_t *
+snat_det_ses_create (u32 thread_index, snat_det_map_t * dm,
+		     ip4_address_t * in_addr, u16 in_port,
+		     snat_det_out_key_t * out)
+{
+  u32 user_offset;
+  u16 i;
+
+  user_offset = snat_det_user_ses_offset (in_addr, dm->in_plen);
+
+  for (i = 0; i < DET44_SES_PER_USER; i++)
+    {
+      if (!dm->sessions[i + user_offset].in_port)
+	{
+	  if (clib_atomic_bool_cmp_and_swap
+	      (&dm->sessions[i + user_offset].in_port, 0, in_port))
+	    {
+	      dm->sessions[i + user_offset].out.as_u64 = out->as_u64;
+	      dm->sessions[i + user_offset].state = DET44_SESSION_UNKNOWN;
+	      dm->sessions[i + user_offset].expire = 0;
+	      clib_atomic_add_fetch (&dm->ses_num, 1);
+	      return &dm->sessions[i + user_offset];
+	    }
+	}
+    }
+
+  // TODO:
+  /*snat_ipfix_logging_max_entries_per_user (thread_index,
+     DET44_SES_PER_USER,
+     in_addr->as_u32); */
+  return 0;
+}
+
+static_always_inline void
+snat_det_ses_close (snat_det_map_t * dm, snat_det_session_t * ses)
+{
+  if (clib_atomic_bool_cmp_and_swap (&ses->in_port, ses->in_port, 0))
+    {
+      ses->out.as_u64 = 0;
+      clib_atomic_add_fetch (&dm->ses_num, -1);
+    }
+}
+
+clib_error_t *det44_api_hookup (vlib_main_t * vm);
+
+#endif /* __included_det44_h__ */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/nat/det44/det44_api.c b/src/plugins/nat/det44/det44_api.c
new file mode 100644
index 0000000..7c7b178
--- /dev/null
+++ b/src/plugins/nat/det44/det44_api.c
@@ -0,0 +1,633 @@
+/*
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file
+ * @brief Deterministic NAT (CGN) plugin API implementation
+ */
+
+#include <vnet/ip/ip_types_api.h>
+#include <nat/det44/det44.h>
+#include <nat/det44/det44.api_enum.h>
+#include <nat/det44/det44.api_types.h>
+#include <vnet/fib/fib_table.h>
+#include <vnet/ip/ip.h>
+
+#include <vlibmemory/api.h>
+
+#define REPLY_MSG_ID_BASE dm->msg_id_base
+#include <vlibapi/api_helper_macros.h>
+
+static void
+vl_api_det44_add_del_map_t_handler (vl_api_det44_add_del_map_t * mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_det44_add_del_map_reply_t *rmp;
+  int rv = 0;
+  ip4_address_t in_addr, out_addr;
+  clib_memcpy (&in_addr, mp->in_addr, 4);
+  clib_memcpy (&out_addr, mp->out_addr, 4);
+  rv = snat_det_add_map (&in_addr, mp->in_plen, &out_addr,
+			 mp->out_plen, mp->is_add);
+  REPLY_MACRO (VL_API_DET44_ADD_DEL_MAP_REPLY);
+}
+
+static void
+vl_api_det44_forward_t_handler (vl_api_det44_forward_t * mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_det44_forward_reply_t *rmp;
+  int rv = 0;
+  u16 lo_port = 0, hi_port = 0;
+  snat_det_map_t *m;
+  ip4_address_t in_addr, out_addr;
+
+  out_addr.as_u32 = 0;
+  clib_memcpy (&in_addr, mp->in_addr, 4);
+  m = snat_det_map_by_user (&in_addr);
+  if (!m)
+    {
+      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+      goto send_reply;
+    }
+
+  snat_det_forward (m, &in_addr, &out_addr, &lo_port);
+  hi_port = lo_port + m->ports_per_host - 1;
+
+send_reply:
+  /* *INDENT-OFF* */
+  REPLY_MACRO2 (VL_API_DET44_FORWARD_REPLY,
+  ({
+    rmp->out_port_lo = ntohs (lo_port);
+    rmp->out_port_hi = ntohs (hi_port);
+    clib_memcpy (rmp->out_addr, &out_addr, 4);
+  }))
+  /* *INDENT-ON* */
+}
+
+static void
+vl_api_det44_reverse_t_handler (vl_api_det44_reverse_t * mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_det44_reverse_reply_t *rmp;
+  int rv = 0;
+  ip4_address_t out_addr, in_addr;
+  snat_det_map_t *m;
+
+  in_addr.as_u32 = 0;
+  clib_memcpy (&out_addr, mp->out_addr, 4);
+  m = snat_det_map_by_out (&out_addr);
+  if (!m)
+    {
+      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+      goto send_reply;
+    }
+
+  snat_det_reverse (m, &out_addr, htons (mp->out_port), &in_addr);
+
+send_reply:
+  /* *INDENT-OFF* */
+  REPLY_MACRO2 (VL_API_DET44_REVERSE_REPLY,
+  ({
+    clib_memcpy (rmp->in_addr, &in_addr, 4);
+  }))
+  /* *INDENT-ON* */
+}
+
+static void
+sent_det44_map_details (snat_det_map_t * m, vl_api_registration_t * reg,
+			u32 context)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_det44_map_details_t *rmp;
+
+  rmp = vl_msg_api_alloc (sizeof (*rmp));
+  clib_memset (rmp, 0, sizeof (*rmp));
+  rmp->_vl_msg_id = ntohs (VL_API_DET44_MAP_DETAILS + dm->msg_id_base);
+  clib_memcpy (rmp->in_addr, &m->in_addr, 4);
+  rmp->in_plen = m->in_plen;
+  clib_memcpy (rmp->out_addr, &m->out_addr, 4);
+  rmp->out_plen = m->out_plen;
+  rmp->sharing_ratio = htonl (m->sharing_ratio);
+  rmp->ports_per_host = htons (m->ports_per_host);
+  rmp->ses_num = htonl (m->ses_num);
+  rmp->context = context;
+
+  vl_api_send_msg (reg, (u8 *) rmp);
+}
+
+static void
+vl_api_det44_map_dump_t_handler (vl_api_det44_map_dump_t * mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_registration_t *reg;
+  snat_det_map_t *m;
+
+  reg = vl_api_client_index_to_registration (mp->client_index);
+  if (!reg)
+    return;
+
+  /* *INDENT-OFF* */
+  vec_foreach(m, dm->det_maps)
+    sent_det44_map_details(m, reg, mp->context);
+  /* *INDENT-ON* */
+}
+
+static void
+vl_api_det44_close_session_out_t_handler (vl_api_det44_close_session_out_t
+					  * mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_det44_close_session_out_reply_t *rmp;
+  ip4_address_t out_addr, ext_addr, in_addr;
+  snat_det_out_key_t key;
+  snat_det_map_t *m;
+  snat_det_session_t *ses;
+  int rv = 0;
+
+  clib_memcpy (&out_addr, mp->out_addr, 4);
+  clib_memcpy (&ext_addr, mp->ext_addr, 4);
+
+  m = snat_det_map_by_out (&out_addr);
+  if (!m)
+    {
+      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+      goto send_reply;
+    }
+  snat_det_reverse (m, &ext_addr, ntohs (mp->out_port), &in_addr);
+  key.ext_host_addr = ext_addr;
+  key.ext_host_port = mp->ext_port;
+  key.out_port = mp->out_port;
+  ses = snat_det_get_ses_by_out (m, &in_addr, key.as_u64);
+  if (!ses)
+    {
+      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+      goto send_reply;
+    }
+  snat_det_ses_close (m, ses);
+
+send_reply:
+  REPLY_MACRO (VL_API_DET44_CLOSE_SESSION_OUT_REPLY);
+}
+
+static void
+vl_api_det44_close_session_in_t_handler (vl_api_det44_close_session_in_t * mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_det44_close_session_in_reply_t *rmp;
+  ip4_address_t in_addr, ext_addr;
+  snat_det_out_key_t key;
+  snat_det_map_t *m;
+  snat_det_session_t *ses;
+  int rv = 0;
+
+  clib_memcpy (&in_addr, mp->in_addr, 4);
+  clib_memcpy (&ext_addr, mp->ext_addr, 4);
+
+  m = snat_det_map_by_user (&in_addr);
+  if (!m)
+    {
+      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+      goto send_reply;
+    }
+  key.ext_host_addr = ext_addr;
+  key.ext_host_port = mp->ext_port;
+  ses = snat_det_find_ses_by_in (m, &in_addr, mp->in_port, key);
+  if (!ses)
+    {
+      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+      goto send_reply;
+    }
+  snat_det_ses_close (m, ses);
+
+send_reply:
+  REPLY_MACRO (VL_API_DET44_CLOSE_SESSION_OUT_REPLY);
+}
+
+static void
+send_det44_session_details (snat_det_session_t * s,
+			    vl_api_registration_t * reg, u32 context)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_det44_session_details_t *rmp;
+
+  rmp = vl_msg_api_alloc (sizeof (*rmp));
+  clib_memset (rmp, 0, sizeof (*rmp));
+  rmp->_vl_msg_id = ntohs (VL_API_DET44_SESSION_DETAILS + dm->msg_id_base);
+  rmp->in_port = s->in_port;
+  clib_memcpy (rmp->ext_addr, &s->out.ext_host_addr, 4);
+  rmp->ext_port = s->out.ext_host_port;
+  rmp->out_port = s->out.out_port;
+  rmp->state = s->state;
+  rmp->expire = ntohl (s->expire);
+  rmp->context = context;
+
+  vl_api_send_msg (reg, (u8 *) rmp);
+}
+
+static void
+vl_api_det44_session_dump_t_handler (vl_api_det44_session_dump_t * mp)
+{
+  vl_api_registration_t *reg;
+  ip4_address_t user_addr;
+  snat_det_map_t *m;
+  snat_det_session_t *s, empty_ses;
+  u16 i;
+
+  reg = vl_api_client_index_to_registration (mp->client_index);
+  if (!reg)
+    return;
+
+  clib_memset (&empty_ses, 0, sizeof (empty_ses));
+  clib_memcpy (&user_addr, mp->user_addr, 4);
+  m = snat_det_map_by_user (&user_addr);
+  if (!m)
+    return;
+
+  s = m->sessions + snat_det_user_ses_offset (&user_addr, m->in_plen);
+  for (i = 0; i < DET44_SES_PER_USER; i++)
+    {
+      if (s->out.as_u64)
+	send_det44_session_details (s, reg, mp->context);
+      s++;
+    }
+}
+
+static void
+  vl_api_det44_plugin_enable_disable_t_handler
+  (vl_api_det44_plugin_enable_disable_t * mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_det44_plugin_enable_disable_reply_t *rmp;
+  det44_config_t c = { 0 };
+  int rv = 0;
+  if (mp->enable)
+    {
+      c.outside_vrf_id = ntohl (mp->outside_vrf);
+      c.inside_vrf_id = ntohl (mp->inside_vrf);
+      rv = det44_plugin_enable (c);
+    }
+  else
+    {
+      rv = det44_plugin_disable ();
+    }
+  REPLY_MACRO (VL_API_DET44_PLUGIN_ENABLE_DISABLE_REPLY);
+}
+
+static void
+  vl_api_det44_interface_add_del_feature_t_handler
+  (vl_api_det44_interface_add_del_feature_t * mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_det44_interface_add_del_feature_reply_t *rmp;
+  u32 sw_if_index = ntohl (mp->sw_if_index);
+  int rv = 0;
+  VALIDATE_SW_IF_INDEX (mp);
+  rv = det44_interface_add_del (sw_if_index, mp->is_inside, !mp->is_add);
+  BAD_SW_IF_INDEX_LABEL;
+  REPLY_MACRO (VL_API_DET44_INTERFACE_ADD_DEL_FEATURE_REPLY);
+}
+
+static void
+det44_send_interface_details (det44_interface_t * i,
+			      vl_api_registration_t * reg, u32 context)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_det44_interface_details_t *rmp;
+
+  rmp = vl_msg_api_alloc (sizeof (*rmp));
+  clib_memset (rmp, 0, sizeof (*rmp));
+  rmp->_vl_msg_id = ntohs (VL_API_DET44_INTERFACE_DETAILS + dm->msg_id_base);
+  rmp->sw_if_index = ntohl (i->sw_if_index);
+  rmp->is_outside = det44_interface_is_outside (i);
+  rmp->is_inside = det44_interface_is_inside (i);
+  rmp->context = context;
+  vl_api_send_msg (reg, (u8 *) rmp);
+}
+
+static void
+vl_api_det44_interface_dump_t_handler (vl_api_det44_interface_dump_t * mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_registration_t *reg;
+  det44_interface_t *i;
+
+  reg = vl_api_client_index_to_registration (mp->client_index);
+  if (!reg)
+    return;
+
+  /* *INDENT-OFF* */
+  pool_foreach (i, dm->interfaces,
+  ({
+    det44_send_interface_details(i, reg, mp->context);
+  }));
+  /* *INDENT-ON* */
+}
+
+static void
+vl_api_det44_set_timeouts_t_handler (vl_api_det44_set_timeouts_t * mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_det44_set_timeouts_reply_t *rmp;
+  nat_timeouts_t timeouts;
+  int rv = 0;
+  timeouts.udp = ntohl (mp->udp);
+  timeouts.tcp.established = ntohl (mp->tcp_established);
+  timeouts.tcp.transitory = ntohl (mp->tcp_transitory);
+  timeouts.icmp = ntohl (mp->icmp);
+  rv = det44_set_timeouts (&timeouts);
+  REPLY_MACRO (VL_API_DET44_SET_TIMEOUTS_REPLY);
+}
+
+static void
+vl_api_det44_get_timeouts_t_handler (vl_api_det44_get_timeouts_t * mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_det44_get_timeouts_reply_t *rmp;
+  nat_timeouts_t timeouts;
+  int rv = 0;
+  timeouts = det44_get_timeouts ();
+  /* *INDENT-OFF* */
+  REPLY_MACRO2 (VL_API_DET44_GET_TIMEOUTS_REPLY,
+  ({
+    rmp->udp = htonl (timeouts.udp);
+    rmp->tcp_established = htonl (timeouts.tcp.established);
+    rmp->tcp_transitory = htonl (timeouts.tcp.transitory);
+    rmp->icmp = htonl (timeouts.icmp);
+  }))
+  /* *INDENT-ON* */
+}
+
+/*
+ * Obsolete deterministic API to be removed
+ */
+
+static void
+vl_api_nat_det_add_del_map_t_handler (vl_api_nat_det_add_del_map_t * mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_nat_det_add_del_map_reply_t *rmp;
+  int rv = 0;
+  ip4_address_t in_addr, out_addr;
+
+  clib_memcpy (&in_addr, mp->in_addr, 4);
+  clib_memcpy (&out_addr, mp->out_addr, 4);
+  rv = snat_det_add_map (&in_addr, mp->in_plen, &out_addr,
+			 mp->out_plen, mp->is_add);
+  REPLY_MACRO (VL_API_NAT_DET_ADD_DEL_MAP_REPLY);
+}
+
+static void
+vl_api_nat_det_forward_t_handler (vl_api_nat_det_forward_t * mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_nat_det_forward_reply_t *rmp;
+  int rv = 0;
+  u16 lo_port = 0, hi_port = 0;
+  snat_det_map_t *m;
+  ip4_address_t in_addr, out_addr;
+
+  out_addr.as_u32 = 0;
+  clib_memcpy (&in_addr, mp->in_addr, 4);
+  m = snat_det_map_by_user (&in_addr);
+  if (!m)
+    {
+      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+      goto send_reply;
+    }
+
+  snat_det_forward (m, &in_addr, &out_addr, &lo_port);
+  hi_port = lo_port + m->ports_per_host - 1;
+
+send_reply:
+  /* *INDENT-OFF* */
+  REPLY_MACRO2 (VL_API_NAT_DET_FORWARD_REPLY,
+  ({
+    rmp->out_port_lo = ntohs (lo_port);
+    rmp->out_port_hi = ntohs (hi_port);
+    clib_memcpy (rmp->out_addr, &out_addr, 4);
+  }))
+  /* *INDENT-ON* */
+}
+
+static void
+vl_api_nat_det_reverse_t_handler (vl_api_nat_det_reverse_t * mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_nat_det_reverse_reply_t *rmp;
+  int rv = 0;
+  ip4_address_t out_addr, in_addr;
+  snat_det_map_t *m;
+
+  in_addr.as_u32 = 0;
+  clib_memcpy (&out_addr, mp->out_addr, 4);
+  m = snat_det_map_by_out (&out_addr);
+  if (!m)
+    {
+      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+      goto send_reply;
+    }
+
+  snat_det_reverse (m, &out_addr, htons (mp->out_port), &in_addr);
+
+send_reply:
+  /* *INDENT-OFF* */
+  REPLY_MACRO2 (VL_API_NAT_DET_REVERSE_REPLY,
+  ({
+    clib_memcpy (rmp->in_addr, &in_addr, 4);
+  }))
+  /* *INDENT-ON* */
+}
+
+static void
+sent_nat_det_map_details (snat_det_map_t * m, vl_api_registration_t * reg,
+			  u32 context)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_nat_det_map_details_t *rmp;
+
+  rmp = vl_msg_api_alloc (sizeof (*rmp));
+  clib_memset (rmp, 0, sizeof (*rmp));
+  rmp->_vl_msg_id = ntohs (VL_API_NAT_DET_MAP_DETAILS + dm->msg_id_base);
+  clib_memcpy (rmp->in_addr, &m->in_addr, 4);
+  rmp->in_plen = m->in_plen;
+  clib_memcpy (rmp->out_addr, &m->out_addr, 4);
+  rmp->out_plen = m->out_plen;
+  rmp->sharing_ratio = htonl (m->sharing_ratio);
+  rmp->ports_per_host = htons (m->ports_per_host);
+  rmp->ses_num = htonl (m->ses_num);
+  rmp->context = context;
+
+  vl_api_send_msg (reg, (u8 *) rmp);
+}
+
+static void
+vl_api_nat_det_map_dump_t_handler (vl_api_nat_det_map_dump_t * mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_registration_t *reg;
+  snat_det_map_t *m;
+
+  reg = vl_api_client_index_to_registration (mp->client_index);
+  if (!reg)
+    return;
+
+  /* *INDENT-OFF* */
+  vec_foreach(m, dm->det_maps)
+    sent_nat_det_map_details(m, reg, mp->context);
+  /* *INDENT-ON* */
+}
+
+static void
+vl_api_nat_det_close_session_out_t_handler (vl_api_nat_det_close_session_out_t
+					    * mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_nat_det_close_session_out_reply_t *rmp;
+  ip4_address_t out_addr, ext_addr, in_addr;
+  snat_det_out_key_t key;
+  snat_det_map_t *m;
+  snat_det_session_t *ses;
+  int rv = 0;
+
+  clib_memcpy (&out_addr, mp->out_addr, 4);
+  clib_memcpy (&ext_addr, mp->ext_addr, 4);
+
+  m = snat_det_map_by_out (&out_addr);
+  if (!m)
+    {
+      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+      goto send_reply;
+    }
+  snat_det_reverse (m, &ext_addr, ntohs (mp->out_port), &in_addr);
+  key.ext_host_addr = ext_addr;
+  key.ext_host_port = mp->ext_port;
+  key.out_port = mp->out_port;
+  ses = snat_det_get_ses_by_out (m, &in_addr, key.as_u64);
+  if (!ses)
+    {
+      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+      goto send_reply;
+    }
+  snat_det_ses_close (m, ses);
+
+send_reply:
+  REPLY_MACRO (VL_API_NAT_DET_CLOSE_SESSION_OUT_REPLY);
+}
+
+static void
+vl_api_nat_det_close_session_in_t_handler (vl_api_nat_det_close_session_in_t *
+					   mp)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_nat_det_close_session_in_reply_t *rmp;
+  ip4_address_t in_addr, ext_addr;
+  snat_det_out_key_t key;
+  snat_det_map_t *m;
+  snat_det_session_t *ses;
+  int rv = 0;
+
+  clib_memcpy (&in_addr, mp->in_addr, 4);
+  clib_memcpy (&ext_addr, mp->ext_addr, 4);
+
+  m = snat_det_map_by_user (&in_addr);
+  if (!m)
+    {
+      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+      goto send_reply;
+    }
+  key.ext_host_addr = ext_addr;
+  key.ext_host_port = mp->ext_port;
+  ses = snat_det_find_ses_by_in (m, &in_addr, mp->in_port, key);
+  if (!ses)
+    {
+      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
+      goto send_reply;
+    }
+  snat_det_ses_close (m, ses);
+
+send_reply:
+  REPLY_MACRO (VL_API_NAT_DET_CLOSE_SESSION_OUT_REPLY);
+}
+
+static void
+send_nat_det_session_details (snat_det_session_t * s,
+			      vl_api_registration_t * reg, u32 context)
+{
+  det44_main_t *dm = &det44_main;
+  vl_api_nat_det_session_details_t *rmp;
+
+  rmp = vl_msg_api_alloc (sizeof (*rmp));
+  clib_memset (rmp, 0, sizeof (*rmp));
+  rmp->_vl_msg_id = ntohs (VL_API_NAT_DET_SESSION_DETAILS + dm->msg_id_base);
+  rmp->in_port = s->in_port;
+  clib_memcpy (rmp->ext_addr, &s->out.ext_host_addr, 4);
+  rmp->ext_port = s->out.ext_host_port;
+  rmp->out_port = s->out.out_port;
+  rmp->state = s->state;
+  rmp->expire = ntohl (s->expire);
+  rmp->context = context;
+
+  vl_api_send_msg (reg, (u8 *) rmp);
+}
+
+static void
+vl_api_nat_det_session_dump_t_handler (vl_api_nat_det_session_dump_t * mp)
+{
+  vl_api_registration_t *reg;
+  ip4_address_t user_addr;
+  snat_det_map_t *m;
+  snat_det_session_t *s, empty_ses;
+  u16 i;
+
+  reg = vl_api_client_index_to_registration (mp->client_index);
+  if (!reg)
+    return;
+
+  clib_memset (&empty_ses, 0, sizeof (empty_ses));
+  clib_memcpy (&user_addr, mp->user_addr, 4);
+  m = snat_det_map_by_user (&user_addr);
+  if (!m)
+    return;
+
+  s = m->sessions + snat_det_user_ses_offset (&user_addr, m->in_plen);
+  for (i = 0; i < DET44_SES_PER_USER; i++)
+    {
+      if (s->out.as_u64)
+	send_nat_det_session_details (s, reg, mp->context);
+      s++;
+    }
+}
+
+/* API definitions */
+#include <vnet/format_fns.h>
+#include <nat/det44/det44.api.c>
+
+/* Set up the API message handling tables */
+clib_error_t *
+det44_api_hookup (vlib_main_t * vm)
+{
+  det44_main_t *dm = &det44_main;
+  dm->msg_id_base = setup_message_id_table ();
+  return 0;
+}
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/nat/det44/det44_cli.c b/src/plugins/nat/det44/det44_cli.c
new file mode 100644
index 0000000..7085eba
--- /dev/null
+++ b/src/plugins/nat/det44/det44_cli.c
@@ -0,0 +1,697 @@
+/*
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * @file
+ * @brief DET44 CLI
+ */
+#include <nat/det44/det44.h>
+
+static clib_error_t *
+det44_map_command_fn (vlib_main_t * vm, unformat_input_t * input,
+		      vlib_cli_command_t * cmd)
+{
+  unformat_input_t _line_input, *line_input = &_line_input;
+  ip4_address_t in_addr, out_addr;
+  u32 in_plen, out_plen;
+  int is_add = 1, rv;
+  clib_error_t *error = 0;
+
+  if (!unformat_user (input, unformat_line_input, line_input))
+    return 0;
+
+  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat
+	  (line_input, "in %U/%u", unformat_ip4_address, &in_addr, &in_plen))
+	;
+      else
+	if (unformat
+	    (line_input, "out %U/%u", unformat_ip4_address, &out_addr,
+	     &out_plen))
+	;
+      else if (unformat (line_input, "del"))
+	is_add = 0;
+      else
+	{
+	  error = clib_error_return (0, "unknown input '%U'",
+				     format_unformat_error, line_input);
+	  goto done;
+	}
+    }
+
+  rv = snat_det_add_map (&in_addr, (u8) in_plen, &out_addr, (u8) out_plen,
+			 is_add);
+
+  if (rv)
+    {
+      error = clib_error_return (0, "snat_det_add_map return %d", rv);
+      goto done;
+    }
+
+done:
+  unformat_free (line_input);
+
+  return error;
+}
+
+static clib_error_t *
+det44_show_mappings_command_fn (vlib_main_t * vm,
+				unformat_input_t * input,
+				vlib_cli_command_t * cmd)
+{
+  det44_main_t *dm = &det44_main;
+  snat_det_map_t *mp;
+  vlib_cli_output (vm, "NAT44 deterministic mappings:");
+  /* *INDENT-OFF* */
+  pool_foreach (mp, dm->det_maps,
+  ({
+    vlib_cli_output (vm, " in %U/%d out %U/%d\n",
+                     format_ip4_address, &mp->in_addr, mp->in_plen,
+                     format_ip4_address, &mp->out_addr, mp->out_plen);
+    vlib_cli_output (vm, "  outside address sharing ratio: %d\n",
+                     mp->sharing_ratio);
+    vlib_cli_output (vm, "  number of ports per inside host: %d\n",
+                     mp->ports_per_host);
+    vlib_cli_output (vm, "  sessions number: %d\n", mp->ses_num);
+  }));
+  /* *INDENT-ON* */
+  return 0;
+}
+
+static clib_error_t *
+det44_forward_command_fn (vlib_main_t * vm,
+			  unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  unformat_input_t _line_input, *line_input = &_line_input;
+  ip4_address_t in_addr, out_addr;
+  u16 lo_port;
+  snat_det_map_t *mp;
+  clib_error_t *error = 0;
+
+  if (!unformat_user (input, unformat_line_input, line_input))
+    return 0;
+
+  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (line_input, "%U", unformat_ip4_address, &in_addr))
+	;
+      else
+	{
+	  error = clib_error_return (0, "unknown input '%U'",
+				     format_unformat_error, line_input);
+	  goto done;
+	}
+    }
+
+  mp = snat_det_map_by_user (&in_addr);
+  if (!mp)
+    vlib_cli_output (vm, "no match");
+  else
+    {
+      snat_det_forward (mp, &in_addr, &out_addr, &lo_port);
+      vlib_cli_output (vm, "%U:<%d-%d>", format_ip4_address, &out_addr,
+		       lo_port, lo_port + mp->ports_per_host - 1);
+    }
+
+done:
+  unformat_free (line_input);
+
+  return error;
+}
+
+static clib_error_t *
+det44_reverse_command_fn (vlib_main_t * vm,
+			  unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  unformat_input_t _line_input, *line_input = &_line_input;
+  ip4_address_t in_addr, out_addr;
+  clib_error_t *error = 0;
+  snat_det_map_t *mp;
+  u32 out_port;
+
+  if (!unformat_user (input, unformat_line_input, line_input))
+    return 0;
+
+  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat
+	  (line_input, "%U:%d", unformat_ip4_address, &out_addr, &out_port))
+	;
+      else
+	{
+	  error = clib_error_return (0, "unknown input '%U'",
+				     format_unformat_error, line_input);
+	  goto done;
+	}
+    }
+
+  if (out_port < 1024 || out_port > 65535)
+    {
+      error = clib_error_return (0, "wrong port, must be <1024-65535>");
+      goto done;
+    }
+
+  mp = snat_det_map_by_out (&out_addr);
+  if (!mp)
+    vlib_cli_output (vm, "no match");
+  else
+    {
+      snat_det_reverse (mp, &out_addr, (u16) out_port, &in_addr);
+      vlib_cli_output (vm, "%U", format_ip4_address, &in_addr);
+    }
+
+done:
+  unformat_free (line_input);
+
+  return error;
+}
+
+static clib_error_t *
+det44_show_sessions_command_fn (vlib_main_t * vm,
+				unformat_input_t * input,
+				vlib_cli_command_t * cmd)
+{
+  det44_main_t *dm = &det44_main;
+  snat_det_session_t *ses;
+  snat_det_map_t *mp;
+  vlib_cli_output (vm, "NAT44 deterministic sessions:");
+  /* *INDENT-OFF* */
+  pool_foreach (mp, dm->det_maps,
+  ({
+    int i;
+    vec_foreach_index (i, mp->sessions)
+      {
+        ses = vec_elt_at_index (mp->sessions, i);
+        if (ses->in_port)
+          vlib_cli_output (vm, "  %U", format_det_map_ses, mp, ses, &i);
+      }
+  }));
+  /* *INDENT-ON* */
+  return 0;
+}
+
+static clib_error_t *
+det44_close_session_out_fn (vlib_main_t * vm,
+			    unformat_input_t * input,
+			    vlib_cli_command_t * cmd)
+{
+  unformat_input_t _line_input, *line_input = &_line_input;
+  ip4_address_t out_addr, ext_addr, in_addr;
+  u32 out_port, ext_port;
+  snat_det_map_t *mp;
+  snat_det_session_t *ses;
+  snat_det_out_key_t key;
+  clib_error_t *error = 0;
+
+  if (!unformat_user (input, unformat_line_input, line_input))
+    return 0;
+
+  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (line_input, "%U:%d %U:%d",
+		    unformat_ip4_address, &out_addr, &out_port,
+		    unformat_ip4_address, &ext_addr, &ext_port))
+	;
+      else
+	{
+	  error = clib_error_return (0, "unknown input '%U'",
+				     format_unformat_error, line_input);
+	  goto done;
+	}
+    }
+
+  unformat_free (line_input);
+
+  mp = snat_det_map_by_out (&out_addr);
+  if (!mp)
+    vlib_cli_output (vm, "no match");
+  else
+    {
+      snat_det_reverse (mp, &ext_addr, (u16) out_port, &in_addr);
+      key.ext_host_addr = out_addr;
+      key.ext_host_port = ntohs ((u16) ext_port);
+      key.out_port = ntohs ((u16) out_port);
+      ses = snat_det_get_ses_by_out (mp, &out_addr, key.as_u64);
+      if (!ses)
+	vlib_cli_output (vm, "no match");
+      else
+	snat_det_ses_close (mp, ses);
+    }
+
+done:
+  unformat_free (line_input);
+
+  return error;
+}
+
+static clib_error_t *
+det44_close_session_in_fn (vlib_main_t * vm,
+			   unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  unformat_input_t _line_input, *line_input = &_line_input;
+  ip4_address_t in_addr, ext_addr;
+  u32 in_port, ext_port;
+  snat_det_map_t *mp;
+  snat_det_session_t *ses;
+  snat_det_out_key_t key;
+  clib_error_t *error = 0;
+
+  if (!unformat_user (input, unformat_line_input, line_input))
+    return 0;
+
+  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (line_input, "%U:%d %U:%d",
+		    unformat_ip4_address, &in_addr, &in_port,
+		    unformat_ip4_address, &ext_addr, &ext_port))
+	;
+      else
+	{
+	  error = clib_error_return (0, "unknown input '%U'",
+				     format_unformat_error, line_input);
+	  goto done;
+	}
+    }
+
+  unformat_free (line_input);
+
+  mp = snat_det_map_by_user (&in_addr);
+  if (!mp)
+    vlib_cli_output (vm, "no match");
+  else
+    {
+      key.ext_host_addr = ext_addr;
+      key.ext_host_port = ntohs ((u16) ext_port);
+      ses =
+	snat_det_find_ses_by_in (mp, &in_addr, ntohs ((u16) in_port), key);
+      if (!ses)
+	vlib_cli_output (vm, "no match");
+      else
+	snat_det_ses_close (mp, ses);
+    }
+
+done:
+  unformat_free (line_input);
+
+  return error;
+}
+
+static clib_error_t *
+det44_set_timeouts_command_fn (vlib_main_t * vm,
+			       unformat_input_t * input,
+			       vlib_cli_command_t * cmd)
+{
+  unformat_input_t _line_input, *line_input = &_line_input;
+  nat_timeouts_t timeouts = { 0 };
+  clib_error_t *error = 0;
+  u8 reset = 0;
+
+  if (!unformat_user (input, unformat_line_input, line_input))
+    return 0;
+
+  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (line_input, "udp %u", &timeouts.udp));
+      else if (unformat (line_input, "tcp established %u",
+			 &timeouts.tcp.established));
+      else if (unformat (line_input, "tcp transitory %u",
+			 &timeouts.tcp.transitory));
+      else if (unformat (line_input, "icmp %u", &timeouts.icmp));
+      else if (unformat (line_input, "reset"))
+	reset = 1;
+      else
+	{
+	  error = clib_error_return (0, "unknown input '%U'",
+				     format_unformat_error, line_input);
+	  goto done;
+	}
+    }
+
+  if (!reset)
+    {
+      if (det44_set_timeouts (&timeouts))
+	{
+	  error = clib_error_return (0, "error configuring timeouts");
+	}
+    }
+  else
+    det44_reset_timeouts ();
+done:
+  unformat_free (line_input);
+  return error;
+}
+
+static clib_error_t *
+det44_show_timeouts_command_fn (vlib_main_t * vm,
+				unformat_input_t * input,
+				vlib_cli_command_t * cmd)
+{
+  nat_timeouts_t timeouts;
+  timeouts = det44_get_timeouts ();
+  vlib_cli_output (vm, "udp timeout: %dsec", timeouts.udp);
+  vlib_cli_output (vm, "tcp established timeout: %dsec",
+		   timeouts.tcp.established);
+  vlib_cli_output (vm, "tcp transitory timeout: %dsec",
+		   timeouts.tcp.transitory);
+  vlib_cli_output (vm, "icmp timeout: %dsec", timeouts.icmp);
+  return 0;
+}
+
+static clib_error_t *
+det44_plugin_enable_disable_command_fn (vlib_main_t * vm,
+					unformat_input_t * input,
+					vlib_cli_command_t * cmd)
+{
+  unformat_input_t _line_input, *line_input = &_line_input;
+  u8 enable = 0, is_set = 0;
+  clib_error_t *error = 0;
+  det44_config_t c = { 0 };
+
+  if (!unformat_user (input, unformat_line_input, line_input))
+    return 0;
+
+  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (!is_set && unformat (line_input, "enable"))
+	{
+	  unformat (line_input, "inside vrf %u", &c.inside_vrf_id);
+	  unformat (line_input, "outside vrf %u", &c.outside_vrf_id);
+	  enable = 1;
+	}
+      else if (!is_set && unformat (line_input, "disable"));
+      else
+	{
+	  error = clib_error_return (0, "unknown input '%U'",
+				     format_unformat_error, line_input);
+	  goto done;
+	}
+      is_set = 1;
+    }
+
+  if (enable)
+    {
+      if (det44_plugin_enable (c))
+	error = clib_error_return (0, "plugin enable failed");
+    }
+  else
+    {
+      if (det44_plugin_disable ())
+	error = clib_error_return (0, "plugin disable failed");
+    }
+done:
+  unformat_free (line_input);
+  return error;
+}
+
+typedef struct
+{
+  u32 sw_if_index;
+  u8 is_inside;
+} sw_if_indices_t;
+
+static clib_error_t *
+det44_feature_command_fn (vlib_main_t * vm,
+			  unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  unformat_input_t _line_input, *line_input = &_line_input;
+  sw_if_indices_t *sw_if_indices = 0, *p, e;
+  vnet_main_t *vnm = vnet_get_main ();
+  clib_error_t *error = 0;
+  u8 is_del = 0;
+
+  if (!unformat_user (input, unformat_line_input, line_input))
+    return 0;
+
+  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (line_input, "inside %U", unformat_vnet_sw_interface,
+		    vnm, &e.sw_if_index))
+	{
+	  e.is_inside = 1;
+	  vec_add1 (sw_if_indices, e);
+	}
+      else if (unformat (line_input, "outside %U", unformat_vnet_sw_interface,
+			 vnm, &e.sw_if_index))
+	{
+	  e.is_inside = 0;
+	  vec_add1 (sw_if_indices, e);
+	}
+      else if (unformat (line_input, "del"))
+	is_del = 1;
+      else
+	{
+	  error = clib_error_return (0, "unknown input '%U'",
+				     format_unformat_error, line_input);
+	  goto done;
+	}
+    }
+
+  /* *INDENT-OFF* */
+  vec_foreach (p, sw_if_indices)
+    {
+      if (det44_interface_add_del (p->sw_if_index, p->is_inside, is_del))
+        {
+          error = clib_error_return (0, "%s %s %U failed",
+                                     is_del ? "del" : "add",
+                                     p->is_inside ? "inside" : "outside",
+				     format_vnet_sw_if_index_name,
+				     vnm, p->sw_if_index);
+          break;
+        }
+    }
+  /* *INDENT-ON* */
+done:
+  unformat_free (line_input);
+  vec_free (sw_if_indices);
+  return error;
+}
+
+static clib_error_t *
+det44_show_interfaces_command_fn (vlib_main_t * vm, unformat_input_t * input,
+				  vlib_cli_command_t * cmd)
+{
+  vnet_main_t *vnm = vnet_get_main ();
+  det44_main_t *dm = &det44_main;
+  det44_interface_t *i;
+  vlib_cli_output (vm, "DET44 interfaces:");
+  /* *INDENT-OFF* */
+  pool_foreach (i, dm->interfaces,
+  ({
+    vlib_cli_output (vm, " %U %s", format_vnet_sw_if_index_name, vnm,
+                     i->sw_if_index,
+                     (det44_interface_is_inside(i) &&
+                      det44_interface_is_outside(i)) ? "in out" :
+                     (det44_interface_is_inside(i) ? "in" : "out"));
+  }));
+  /* *INDENT-ON* */
+  return 0;
+}
+
+/* *INDENT-OFF* */
+/*?
+ * @cliexpar
+ * @cliexstart{det44 add}
+ * Create bijective mapping of inside address to outside address and port range
+ * pairs, with the purpose of enabling DET44 to reduce logging in CGN
+ * deployments.
+ * To create mapping between inside network 10.0.0.0/18 and
+ * outside network 1.1.1.0/30 use:
+ * # vpp# det44 add in 10.0.0.0/18 out 1.1.1.0/30
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_map_command, static) = {
+    .path = "det44 add",
+    .short_help = "det44 add in <addr>/<plen> out <addr>/<plen> [del]",
+    .function = det44_map_command_fn,
+};
+
+/*?
+ * @cliexpar
+ * @cliexpstart{show det44 mappings}
+ * Show DET44 mappings
+ * vpp# show det44 mappings
+ * DET44 mappings:
+ *  in 10.0.0.0/24 out 1.1.1.1/32
+ *   outside address sharing ratio: 256
+ *   number of ports per inside host: 252
+ *   sessions number: 0
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_show_mappings_command, static) = {
+    .path = "show det44 mappings",
+    .short_help = "show det44 mappings",
+    .function = det44_show_mappings_command_fn,
+};
+
+/*?
+ * @cliexpar
+ * @cliexstart{det44 forward}
+ * Return outside address and port range from inside address for DET44.
+ * To obtain outside address and port of inside host use:
+ *  vpp# det44 forward 10.0.0.2
+ *  1.1.1.0:<1054-1068>
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_forward_command, static) = {
+    .path = "det44 forward",
+    .short_help = "det44 forward <addr>",
+    .function = det44_forward_command_fn,
+};
+
+/*?
+ * @cliexpar
+ * @cliexstart{det44 reverse}
+ * Return inside address from outside address and port for DET44.
+ * To obtain inside host address from outside address and port use:
+ *  #vpp det44 reverse 1.1.1.1:1276
+ *  10.0.16.16
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_reverse_command, static) = {
+    .path = "det44 reverse",
+    .short_help = "det44 reverse <addr>:<port>",
+    .function = det44_reverse_command_fn,
+};
+
+/*?
+ * @cliexpar
+ * @cliexstart{show det44 sessions}
+ * Show DET44 sessions.
+ * vpp# show det44 sessions
+ * DET44 sessions:
+ *   in 10.0.0.3:3005 out 1.1.1.2:1146 external host 172.16.1.2:3006 state: udp-active expire: 306
+ *   in 10.0.0.3:3000 out 1.1.1.2:1141 external host 172.16.1.2:3001 state: udp-active expire: 306
+ *   in 10.0.0.4:3005 out 1.1.1.2:1177 external host 172.16.1.2:3006 state: udp-active expire: 306
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_show_sessions_command, static) = {
+  .path = "show det44 sessions",
+  .short_help = "show det44 sessions",
+  .function = det44_show_sessions_command_fn,
+};
+
+/*?
+ * @cliexpar
+ * @cliexstart{det44 close session out}
+ * Close session using outside ip address and port
+ * and external ip address and port, use:
+ *  vpp# det44 close session out 1.1.1.1:1276 2.2.2.2:2387
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_close_sesion_out_command, static) = {
+  .path = "det44 close session out",
+  .short_help = "det44 close session out "
+                "<out_addr>:<out_port> <ext_addr>:<ext_port>",
+  .function = det44_close_session_out_fn,
+};
+
+/*?
+ * @cliexpar
+ * @cliexstart{det44 deterministic close session in}
+ * Close session using inside ip address and port
+ * and external ip address and port, use:
+ *  vpp# det44 close session in 3.3.3.3:3487 2.2.2.2:2387
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_close_session_in_command, static) = {
+  .path = "det44 close session in",
+  .short_help = "det44 close session in "
+                "<in_addr>:<in_port> <ext_addr>:<ext_port>",
+  .function = det44_close_session_in_fn,
+};
+/* *INDENT-ON* */
+
+/*?
+ * @cliexpar
+ * @cliexstart{set det44 timeout}
+ * Set values of timeouts for DET44 sessions (in seconds), use:
+ *  vpp# set det44 timeouts udp 120 tcp established 7500 tcp transitory 250 icmp 90
+ * To reset default values use:
+ *  vpp# set det44 timeouts reset
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_set_timeouts_command, static) =
+{
+.path = "set det44 timeouts",.short_help =
+    "set det44 timeouts <[udp <sec>] [tcp established <sec>] "
+    "[tcp transitory <sec>] [icmp <sec>]|reset>",.function =
+    det44_set_timeouts_command_fn,};
+
+/*?
+ * @cliexpar
+ * @cliexstart{show det44 timeouts}
+ * Show values of timeouts for DET44 sessions.
+ * vpp# show det44 timeouts
+ * udp timeout: 300sec
+ * tcp-established timeout: 7440sec
+ * tcp-transitory timeout: 240sec
+ * icmp timeout: 60sec
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_show_timeouts_command, static) =
+{
+.path = "show det44 timeouts",.short_help =
+    "show det44 timeouts",.function = det44_show_timeouts_command_fn,};
+
+/*?
+ * @cliexpar
+ * @cliexstart{det44 plugin}
+ * Enable/disable DET44 plugin.
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_plugin_enable_disable_command, static) =
+{
+.path = "det44 plugin",.short_help =
+    "det44 plugin <enable [inside vrf] [outside vrf]|disable>",.function =
+    det44_plugin_enable_disable_command_fn,};
+
+/*?
+ * @cliexpar
+ * @cliexstart{set interface det44}
+ * Enable/disable DET44 feature on the interface.
+ * To enable DET44 feature with local network interface use:
+ *  vpp# set interface det44 inside GigabitEthernet0/8/0
+ * To enable DET44 feature with external network interface use:
+ *  vpp# set interface det44 outside GigabitEthernet0/a/0
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_feature_command, static) =
+{
+.path = "set interface det44",.short_help =
+    "set interface det44 inside <intfc> outside <intfc> [del]",.function =
+    det44_feature_command_fn,};
+
+/*?
+ * @cliexpar
+ * @cliexstart{show det44 interfaces}
+ * Show interfaces with DET44 feature.
+ * vpp# show det44 interfaces
+ * DET44 interfaces:
+ *  GigabitEthernet0/8/0 in
+ *  GigabitEthernet0/a/0 out
+ * @cliexend
+?*/
+VLIB_CLI_COMMAND (det44_show_interfaces_command, static) =
+{
+.path = "show det44 interfaces",.short_help =
+    "show det44 interfaces",.function = det44_show_interfaces_command_fn,};
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/nat/det44/det44_in2out.c b/src/plugins/nat/det44/det44_in2out.c
new file mode 100644
index 0000000..3ed1cc7
--- /dev/null
+++ b/src/plugins/nat/det44/det44_in2out.c
@@ -0,0 +1,1067 @@
+/*
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file
+ * @brief Deterministic NAT (CGN) inside to outside translation
+ */
+
+#include <vlib/vlib.h>
+#include <vnet/vnet.h>
+#include <vnet/ip/ip.h>
+#include <vnet/fib/ip4_fib.h>
+#include <vppinfra/error.h>
+#include <vppinfra/elog.h>
+
+#include <nat/det44/det44.h>
+#include <nat/det44/det44_inlines.h>
+
+#include <nat/lib/lib.h>
+#include <nat/lib/inlines.h>
+#include <nat/lib/nat_inlines.h>
+
+typedef enum
+{
+  DET44_IN2OUT_NEXT_LOOKUP,
+  DET44_IN2OUT_NEXT_DROP,
+  DET44_IN2OUT_NEXT_ICMP_ERROR,
+  DET44_IN2OUT_N_NEXT,
+} det44_in2out_next_t;
+
+typedef struct
+{
+  u32 sw_if_index;
+  u32 next_index;
+  u32 session_index;
+} det44_in2out_trace_t;
+
+#define foreach_det44_in2out_error                 \
+_(UNSUPPORTED_PROTOCOL, "Unsupported protocol")    \
+_(NO_TRANSLATION, "No translation")                \
+_(BAD_ICMP_TYPE, "unsupported ICMP type")          \
+_(OUT_OF_PORTS, "Out of ports")                    \
+_(IN2OUT_PACKETS, "Good in2out packets processed")
+
+typedef enum
+{
+#define _(sym,str) DET44_IN2OUT_ERROR_##sym,
+  foreach_det44_in2out_error
+#undef _
+    DET44_IN2OUT_N_ERROR,
+} det44_in2out_error_t;
+
+static char *det44_in2out_error_strings[] = {
+#define _(sym,string) string,
+  foreach_det44_in2out_error
+#undef _
+};
+
+static u8 *
+format_det44_in2out_trace (u8 * s, va_list * args)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+  det44_in2out_trace_t *t = va_arg (*args, det44_in2out_trace_t *);
+
+  s = format (s, "DET44_IN2OUT: sw_if_index %d, next index %d, session %d",
+	      t->sw_if_index, t->next_index, t->session_index);
+
+  return s;
+}
+
+#ifndef CLIB_MARCH_VARIANT
+/**
+ * Get address and port values to be used for ICMP packet translation
+ * and create session if needed
+ *
+ * @param[in,out] node           NAT node runtime
+ * @param[in] thread_index       thread index
+ * @param[in,out] b0             buffer containing packet to be translated
+ * @param[in,out] ip0            ip header
+ * @param[out] p_proto           protocol used for matching
+ * @param[out] p_value           address and port after NAT translation
+ * @param[out] p_dont_translate  if packet should not be translated
+ * @param d                      optional parameter
+ * @param e                      optional parameter
+ */
+u32
+icmp_match_in2out_det (vlib_node_runtime_t * node,
+		       u32 thread_index, vlib_buffer_t * b0,
+		       ip4_header_t * ip0, ip4_address_t * addr,
+		       u16 * port, u32 * fib_index,
+		       nat_protocol_t * proto, void *d, void *e,
+		       u8 * dont_translate)
+{
+  det44_main_t *dm = &det44_main;
+  vlib_main_t *vm = vlib_get_main ();
+  icmp46_header_t *icmp0;
+  u32 sw_if_index0;
+  u32 rx_fib_index0;
+  nat_protocol_t protocol;
+  snat_det_out_key_t key0;
+  u32 next0 = ~0;
+  icmp_echo_header_t *echo0, *inner_echo0 = 0;
+  ip4_header_t *inner_ip0;
+  void *l4_header = 0;
+  icmp46_header_t *inner_icmp0;
+  snat_det_map_t *mp0 = 0;
+  ip4_address_t new_addr0;
+  u16 lo_port0, i0;
+  snat_det_session_t *ses0 = 0;
+  ip4_address_t in_addr;
+  u16 in_port;
+  *dont_translate = 0;
+
+  icmp0 = (icmp46_header_t *) ip4_next_header (ip0);
+  echo0 = (icmp_echo_header_t *) (icmp0 + 1);
+  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
+  rx_fib_index0 = ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
+
+  if (!icmp_type_is_error_message
+      (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags))
+    {
+      protocol = NAT_PROTOCOL_ICMP;
+      in_addr = ip0->src_address;
+      in_port = vnet_buffer (b0)->ip.reass.l4_src_port;
+    }
+  else
+    {
+      /* if error message, then it's not fragmented and we can access it */
+      inner_ip0 = (ip4_header_t *) (echo0 + 1);
+      l4_header = ip4_next_header (inner_ip0);
+      protocol = ip_proto_to_nat_proto (inner_ip0->protocol);
+      in_addr = inner_ip0->dst_address;
+      switch (protocol)
+	{
+	case NAT_PROTOCOL_ICMP:
+	  inner_icmp0 = (icmp46_header_t *) l4_header;
+	  inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
+	  in_port = inner_echo0->identifier;
+	  break;
+	case NAT_PROTOCOL_UDP:
+	case NAT_PROTOCOL_TCP:
+	  in_port = ((tcp_udp_header_t *) l4_header)->dst_port;
+	  break;
+	default:
+	  b0->error = node->errors[DET44_IN2OUT_ERROR_UNSUPPORTED_PROTOCOL];
+	  next0 = DET44_IN2OUT_NEXT_DROP;
+	  goto out;
+	}
+    }
+
+  mp0 = snat_det_map_by_user (&in_addr);
+  if (PREDICT_FALSE (!mp0))
+    {
+      if (PREDICT_FALSE (det44_translate (node, sw_if_index0, ip0,
+					  IP_PROTOCOL_ICMP, rx_fib_index0)))
+	{
+	  *dont_translate = 1;
+	  goto out;
+	}
+      next0 = DET44_IN2OUT_NEXT_DROP;
+      b0->error = node->errors[DET44_IN2OUT_ERROR_NO_TRANSLATION];
+      goto out;
+    }
+
+  snat_det_forward (mp0, &in_addr, &new_addr0, &lo_port0);
+
+  key0.ext_host_addr = ip0->dst_address;
+  key0.ext_host_port = 0;
+
+  ses0 = snat_det_find_ses_by_in (mp0, &in_addr, in_port, key0);
+  if (PREDICT_FALSE (!ses0))
+    {
+      if (PREDICT_FALSE (det44_translate (node, sw_if_index0, ip0,
+					  IP_PROTOCOL_ICMP, rx_fib_index0)))
+	{
+	  *dont_translate = 1;
+	  goto out;
+	}
+      if (icmp0->type != ICMP4_echo_request)
+	{
+	  b0->error = node->errors[DET44_IN2OUT_ERROR_BAD_ICMP_TYPE];
+	  next0 = DET44_IN2OUT_NEXT_DROP;
+	  goto out;
+	}
+      for (i0 = 0; i0 < mp0->ports_per_host; i0++)
+	{
+	  key0.out_port = clib_host_to_net_u16 (lo_port0 +
+						((i0 +
+						  clib_net_to_host_u16
+						  (echo0->identifier)) %
+						 mp0->ports_per_host));
+
+	  if (snat_det_get_ses_by_out (mp0, &in_addr, key0.as_u64))
+	    continue;
+
+	  ses0 =
+	    snat_det_ses_create (thread_index, mp0,
+				 &in_addr, echo0->identifier, &key0);
+	  break;
+	}
+      if (PREDICT_FALSE (!ses0))
+	{
+	  next0 = DET44_IN2OUT_NEXT_DROP;
+	  b0->error = node->errors[DET44_IN2OUT_ERROR_OUT_OF_PORTS];
+	  goto out;
+	}
+    }
+
+  if (PREDICT_FALSE
+      (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags != ICMP4_echo_request
+       && !icmp_type_is_error_message (vnet_buffer (b0)->ip.
+				       reass.icmp_type_or_tcp_flags)))
+    {
+      b0->error = node->errors[DET44_IN2OUT_ERROR_BAD_ICMP_TYPE];
+      next0 = DET44_IN2OUT_NEXT_DROP;
+      goto out;
+    }
+
+  u32 now = (u32) vlib_time_now (vm);
+
+  ses0->state = DET44_SESSION_ICMP_ACTIVE;
+  ses0->expire = now + dm->timeouts.icmp;
+
+out:
+  *proto = protocol;
+  if (ses0)
+    {
+      *addr = new_addr0;
+      *fib_index = dm->outside_fib_index;
+      *port = ses0->out.out_port;
+    }
+  if (d)
+    *(snat_det_session_t **) d = ses0;
+  if (e)
+    *(snat_det_map_t **) e = mp0;
+  return next0;
+}
+#endif
+
+#ifndef CLIB_MARCH_VARIANT
+u32
+det44_icmp_in2out (vlib_buffer_t * b0,
+		   ip4_header_t * ip0,
+		   icmp46_header_t * icmp0,
+		   u32 sw_if_index0,
+		   u32 rx_fib_index0,
+		   vlib_node_runtime_t * node,
+		   u32 next0, u32 thread_index, void *d, void *e)
+{
+  vlib_main_t *vm = vlib_get_main ();
+  u16 old_id0, new_id0, port, checksum0, old_checksum0, new_checksum0;
+  u32 new_addr0, old_addr0, next0_tmp, fib_index;
+  icmp_echo_header_t *echo0, *inner_echo0;
+  icmp46_header_t *inner_icmp0;
+  ip4_header_t *inner_ip0;
+  ip4_address_t addr;
+  void *l4_header;
+  u8 dont_translate;
+  ip_csum_t sum0;
+  nat_protocol_t protocol;
+
+  echo0 = (icmp_echo_header_t *) (icmp0 + 1);
+  next0_tmp = icmp_match_in2out_det (node, thread_index, b0, ip0,
+				     &addr, &port, &fib_index, &protocol,
+				     d, e, &dont_translate);
+  if (next0_tmp != ~0)
+    next0 = next0_tmp;
+  if (next0 == DET44_IN2OUT_NEXT_DROP || dont_translate)
+    goto out;
+
+  if (PREDICT_TRUE (!ip4_is_fragment (ip0)))
+    {
+      sum0 =
+	ip_incremental_checksum_buffer (vm, b0,
+					(u8 *) icmp0 -
+					(u8 *) vlib_buffer_get_current (b0),
+					ntohs (ip0->length) -
+					ip4_header_bytes (ip0), 0);
+      checksum0 = ~ip_csum_fold (sum0);
+      if (PREDICT_FALSE (checksum0 != 0 && checksum0 != 0xffff))
+	{
+	  next0 = DET44_IN2OUT_NEXT_DROP;
+	  goto out;
+	}
+    }
+
+  old_addr0 = ip0->src_address.as_u32;
+  new_addr0 = ip0->src_address.as_u32 = addr.as_u32;
+
+  sum0 = ip0->checksum;
+  sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
+			 src_address /* changed member */ );
+  ip0->checksum = ip_csum_fold (sum0);
+
+  if (!vnet_buffer (b0)->ip.reass.is_non_first_fragment)
+    {
+      if (icmp0->checksum == 0)
+	icmp0->checksum = 0xffff;
+
+      if (!icmp_type_is_error_message (icmp0->type))
+	{
+	  new_id0 = port;
+	  if (PREDICT_FALSE (new_id0 != echo0->identifier))
+	    {
+	      old_id0 = echo0->identifier;
+	      new_id0 = port;
+	      echo0->identifier = new_id0;
+
+	      sum0 = icmp0->checksum;
+	      sum0 =
+		ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
+				identifier);
+	      icmp0->checksum = ip_csum_fold (sum0);
+	    }
+	}
+      else
+	{
+	  inner_ip0 = (ip4_header_t *) (echo0 + 1);
+	  l4_header = ip4_next_header (inner_ip0);
+
+	  if (!ip4_header_checksum_is_valid (inner_ip0))
+	    {
+	      next0 = DET44_IN2OUT_NEXT_DROP;
+	      goto out;
+	    }
+
+	  /* update inner destination IP address */
+	  old_addr0 = inner_ip0->dst_address.as_u32;
+	  inner_ip0->dst_address = addr;
+	  new_addr0 = inner_ip0->dst_address.as_u32;
+	  sum0 = icmp0->checksum;
+	  sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
+				 dst_address /* changed member */ );
+	  icmp0->checksum = ip_csum_fold (sum0);
+
+	  /* update inner IP header checksum */
+	  old_checksum0 = inner_ip0->checksum;
+	  sum0 = inner_ip0->checksum;
+	  sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
+				 dst_address /* changed member */ );
+	  inner_ip0->checksum = ip_csum_fold (sum0);
+	  new_checksum0 = inner_ip0->checksum;
+	  sum0 = icmp0->checksum;
+	  sum0 =
+	    ip_csum_update (sum0, old_checksum0, new_checksum0, ip4_header_t,
+			    checksum);
+	  icmp0->checksum = ip_csum_fold (sum0);
+
+	  switch (protocol)
+	    {
+	    case NAT_PROTOCOL_ICMP:
+	      inner_icmp0 = (icmp46_header_t *) l4_header;
+	      inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
+
+	      old_id0 = inner_echo0->identifier;
+	      new_id0 = port;
+	      inner_echo0->identifier = new_id0;
+
+	      sum0 = icmp0->checksum;
+	      sum0 =
+		ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
+				identifier);
+	      icmp0->checksum = ip_csum_fold (sum0);
+	      break;
+	    case NAT_PROTOCOL_UDP:
+	    case NAT_PROTOCOL_TCP:
+	      old_id0 = ((tcp_udp_header_t *) l4_header)->dst_port;
+	      new_id0 = port;
+	      ((tcp_udp_header_t *) l4_header)->dst_port = new_id0;
+
+	      sum0 = icmp0->checksum;
+	      sum0 = ip_csum_update (sum0, old_id0, new_id0, tcp_udp_header_t,
+				     dst_port);
+	      icmp0->checksum = ip_csum_fold (sum0);
+	      break;
+	    default:
+	      ASSERT (0);
+	    }
+	}
+    }
+
+  if (vnet_buffer (b0)->sw_if_index[VLIB_TX] == ~0)
+    vnet_buffer (b0)->sw_if_index[VLIB_TX] = fib_index;
+out:
+  return next0;
+}
+#endif
+
+VLIB_NODE_FN (det44_in2out_node) (vlib_main_t * vm,
+				  vlib_node_runtime_t * node,
+				  vlib_frame_t * frame)
+{
+  u32 n_left_from, *from, *to_next;
+  det44_in2out_next_t next_index;
+  u32 pkts_processed = 0;
+  det44_main_t *dm = &det44_main;
+  u32 now = (u32) vlib_time_now (vm);
+  u32 thread_index = vm->thread_index;
+
+  from = vlib_frame_vector_args (frame);
+  n_left_from = frame->n_vectors;
+  next_index = node->cached_next_index;
+
+  while (n_left_from > 0)
+    {
+      u32 n_left_to_next;
+
+      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+      while (n_left_from >= 4 && n_left_to_next >= 2)
+	{
+	  u32 bi0, bi1;
+	  vlib_buffer_t *b0, *b1;
+	  u32 next0, next1;
+	  u32 sw_if_index0, sw_if_index1;
+	  ip4_header_t *ip0, *ip1;
+	  ip_csum_t sum0, sum1;
+	  ip4_address_t new_addr0, old_addr0, new_addr1, old_addr1;
+	  u16 old_port0, new_port0, lo_port0, i0;
+	  u16 old_port1, new_port1, lo_port1, i1;
+	  udp_header_t *udp0, *udp1;
+	  tcp_header_t *tcp0, *tcp1;
+	  u32 proto0, proto1;
+	  snat_det_out_key_t key0, key1;
+	  snat_det_map_t *mp0, *mp1;
+	  snat_det_session_t *ses0 = 0, *ses1 = 0;
+	  u32 rx_fib_index0, rx_fib_index1;
+	  icmp46_header_t *icmp0, *icmp1;
+
+	  /* Prefetch next iteration. */
+	  {
+	    vlib_buffer_t *p2, *p3;
+
+	    p2 = vlib_get_buffer (vm, from[2]);
+	    p3 = vlib_get_buffer (vm, from[3]);
+
+	    vlib_prefetch_buffer_header (p2, LOAD);
+	    vlib_prefetch_buffer_header (p3, LOAD);
+
+	    CLIB_PREFETCH (p2->data, CLIB_CACHE_LINE_BYTES, LOAD);
+	    CLIB_PREFETCH (p3->data, CLIB_CACHE_LINE_BYTES, LOAD);
+	  }
+
+	  /* speculatively enqueue b0 and b1 to the current next frame */
+	  to_next[0] = bi0 = from[0];
+	  to_next[1] = bi1 = from[1];
+	  from += 2;
+	  to_next += 2;
+	  n_left_from -= 2;
+	  n_left_to_next -= 2;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+	  b1 = vlib_get_buffer (vm, bi1);
+
+	  next0 = DET44_IN2OUT_NEXT_LOOKUP;
+	  next1 = DET44_IN2OUT_NEXT_LOOKUP;
+
+	  ip0 = vlib_buffer_get_current (b0);
+	  udp0 = ip4_next_header (ip0);
+	  tcp0 = (tcp_header_t *) udp0;
+
+	  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
+
+	  if (PREDICT_FALSE (ip0->ttl == 1))
+	    {
+	      vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+	      icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
+					   ICMP4_time_exceeded_ttl_exceeded_in_transit,
+					   0);
+	      next0 = DET44_IN2OUT_NEXT_ICMP_ERROR;
+	      goto trace0;
+	    }
+
+	  proto0 = ip_proto_to_nat_proto (ip0->protocol);
+
+	  if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
+	    {
+	      rx_fib_index0 =
+		ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
+	      icmp0 = (icmp46_header_t *) udp0;
+
+	      // TODO:
+	      next0 = det44_icmp_in2out (b0, ip0, icmp0, sw_if_index0,
+					 rx_fib_index0, node, next0,
+					 thread_index, &ses0, &mp0);
+	      goto trace0;
+	    }
+
+	  mp0 = snat_det_map_by_user (&ip0->src_address);
+	  if (PREDICT_FALSE (!mp0))
+	    {
+	      det44_log_info ("no match for internal host %U",
+			      format_ip4_address, &ip0->src_address);
+	      next0 = DET44_IN2OUT_NEXT_DROP;
+	      b0->error = node->errors[DET44_IN2OUT_ERROR_NO_TRANSLATION];
+	      goto trace0;
+	    }
+
+	  snat_det_forward (mp0, &ip0->src_address, &new_addr0, &lo_port0);
+
+	  key0.ext_host_addr = ip0->dst_address;
+	  key0.ext_host_port = tcp0->dst;
+
+	  ses0 =
+	    snat_det_find_ses_by_in (mp0, &ip0->src_address, tcp0->src, key0);
+	  if (PREDICT_FALSE (!ses0))
+	    {
+	      for (i0 = 0; i0 < mp0->ports_per_host; i0++)
+		{
+		  key0.out_port = clib_host_to_net_u16 (lo_port0 +
+							((i0 +
+							  clib_net_to_host_u16
+							  (tcp0->src)) %
+							 mp0->
+							 ports_per_host));
+
+		  if (snat_det_get_ses_by_out
+		      (mp0, &ip0->src_address, key0.as_u64))
+		    continue;
+
+		  ses0 =
+		    snat_det_ses_create (thread_index, mp0, &ip0->src_address,
+					 tcp0->src, &key0);
+		  break;
+		}
+	      if (PREDICT_FALSE (!ses0))
+		{
+		  /* too many sessions for user, send ICMP error packet */
+		  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+		  icmp4_error_set_vnet_buffer (b0,
+					       ICMP4_destination_unreachable,
+					       ICMP4_destination_unreachable_destination_unreachable_host,
+					       0);
+		  next0 = DET44_IN2OUT_NEXT_ICMP_ERROR;
+		  goto trace0;
+		}
+	    }
+
+	  old_port0 = udp0->src_port;
+	  udp0->src_port = new_port0 = ses0->out.out_port;
+
+	  old_addr0.as_u32 = ip0->src_address.as_u32;
+	  ip0->src_address.as_u32 = new_addr0.as_u32;
+	  vnet_buffer (b0)->sw_if_index[VLIB_TX] = dm->outside_fib_index;
+
+	  sum0 = ip0->checksum;
+	  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+				 ip4_header_t,
+				 src_address /* changed member */ );
+	  ip0->checksum = ip_csum_fold (sum0);
+
+	  if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
+	    {
+	      if (tcp0->flags & TCP_FLAG_SYN)
+		ses0->state = DET44_SESSION_TCP_SYN_SENT;
+	      else if (tcp0->flags & TCP_FLAG_ACK
+		       && ses0->state == DET44_SESSION_TCP_SYN_SENT)
+		ses0->state = DET44_SESSION_TCP_ESTABLISHED;
+	      else if (tcp0->flags & TCP_FLAG_FIN
+		       && ses0->state == DET44_SESSION_TCP_ESTABLISHED)
+		ses0->state = DET44_SESSION_TCP_FIN_WAIT;
+	      else if (tcp0->flags & TCP_FLAG_ACK
+		       && ses0->state == DET44_SESSION_TCP_FIN_WAIT)
+		snat_det_ses_close (mp0, ses0);
+	      else if (tcp0->flags & TCP_FLAG_FIN
+		       && ses0->state == DET44_SESSION_TCP_CLOSE_WAIT)
+		ses0->state = DET44_SESSION_TCP_LAST_ACK;
+	      else if (tcp0->flags == 0
+		       && ses0->state == DET44_SESSION_UNKNOWN)
+		ses0->state = DET44_SESSION_TCP_ESTABLISHED;
+
+	      sum0 = tcp0->checksum;
+	      sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+				     ip4_header_t,
+				     dst_address /* changed member */ );
+	      sum0 = ip_csum_update (sum0, old_port0, new_port0,
+				     ip4_header_t /* cheat */ ,
+				     length /* changed member */ );
+	      mss_clamping (dm->mss_clamping, tcp0, &sum0);
+	      tcp0->checksum = ip_csum_fold (sum0);
+	    }
+	  else
+	    {
+	      ses0->state = DET44_SESSION_UDP_ACTIVE;
+
+	      if (PREDICT_FALSE (udp0->checksum))
+		{
+		  sum0 = udp0->checksum;
+		  sum0 =
+		    ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+				    ip4_header_t,
+				    dst_address /* changed member */ );
+		  sum0 =
+		    ip_csum_update (sum0, old_port0, new_port0,
+				    ip4_header_t /* cheat */ ,
+				    length /* changed member */ );
+		  udp0->checksum = ip_csum_fold (sum0);
+		}
+	    }
+
+	  switch (ses0->state)
+	    {
+	    case DET44_SESSION_UDP_ACTIVE:
+	      ses0->expire = now + dm->timeouts.udp;
+	      break;
+	    case DET44_SESSION_TCP_SYN_SENT:
+	    case DET44_SESSION_TCP_FIN_WAIT:
+	    case DET44_SESSION_TCP_CLOSE_WAIT:
+	    case DET44_SESSION_TCP_LAST_ACK:
+	      ses0->expire = now + dm->timeouts.tcp.transitory;
+	      break;
+	    case DET44_SESSION_TCP_ESTABLISHED:
+	      ses0->expire = now + dm->timeouts.tcp.established;
+	      break;
+	    }
+
+	trace0:
+	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
+			     && (b0->flags & VLIB_BUFFER_IS_TRACED)))
+	    {
+	      det44_in2out_trace_t *t =
+		vlib_add_trace (vm, node, b0, sizeof (*t));
+	      t->sw_if_index = sw_if_index0;
+	      t->next_index = next0;
+	      t->session_index = ~0;
+	      if (ses0)
+		t->session_index = ses0 - mp0->sessions;
+	    }
+
+	  pkts_processed += next0 != DET44_IN2OUT_NEXT_DROP;
+
+	  ip1 = vlib_buffer_get_current (b1);
+	  udp1 = ip4_next_header (ip1);
+	  tcp1 = (tcp_header_t *) udp1;
+
+	  sw_if_index1 = vnet_buffer (b1)->sw_if_index[VLIB_RX];
+
+	  if (PREDICT_FALSE (ip1->ttl == 1))
+	    {
+	      vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+	      icmp4_error_set_vnet_buffer (b1, ICMP4_time_exceeded,
+					   ICMP4_time_exceeded_ttl_exceeded_in_transit,
+					   0);
+	      next1 = DET44_IN2OUT_NEXT_ICMP_ERROR;
+	      goto trace1;
+	    }
+
+	  proto1 = ip_proto_to_nat_proto (ip1->protocol);
+
+	  if (PREDICT_FALSE (proto1 == NAT_PROTOCOL_ICMP))
+	    {
+	      rx_fib_index1 =
+		ip4_fib_table_get_index_for_sw_if_index (sw_if_index1);
+	      icmp1 = (icmp46_header_t *) udp1;
+
+	      next1 = det44_icmp_in2out (b1, ip1, icmp1, sw_if_index1,
+					 rx_fib_index1, node, next1,
+					 thread_index, &ses1, &mp1);
+	      goto trace1;
+	    }
+
+	  mp1 = snat_det_map_by_user (&ip1->src_address);
+	  if (PREDICT_FALSE (!mp1))
+	    {
+	      det44_log_info ("no match for internal host %U",
+			      format_ip4_address, &ip0->src_address);
+	      next1 = DET44_IN2OUT_NEXT_DROP;
+	      b1->error = node->errors[DET44_IN2OUT_ERROR_NO_TRANSLATION];
+	      goto trace1;
+	    }
+
+	  snat_det_forward (mp1, &ip1->src_address, &new_addr1, &lo_port1);
+
+	  key1.ext_host_addr = ip1->dst_address;
+	  key1.ext_host_port = tcp1->dst;
+
+	  ses1 =
+	    snat_det_find_ses_by_in (mp1, &ip1->src_address, tcp1->src, key1);
+	  if (PREDICT_FALSE (!ses1))
+	    {
+	      for (i1 = 0; i1 < mp1->ports_per_host; i1++)
+		{
+		  key1.out_port = clib_host_to_net_u16 (lo_port1 +
+							((i1 +
+							  clib_net_to_host_u16
+							  (tcp1->src)) %
+							 mp1->
+							 ports_per_host));
+
+		  if (snat_det_get_ses_by_out
+		      (mp1, &ip1->src_address, key1.as_u64))
+		    continue;
+
+		  ses1 =
+		    snat_det_ses_create (thread_index, mp1, &ip1->src_address,
+					 tcp1->src, &key1);
+		  break;
+		}
+	      if (PREDICT_FALSE (!ses1))
+		{
+		  /* too many sessions for user, send ICMP error packet */
+		  vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+		  icmp4_error_set_vnet_buffer (b1,
+					       ICMP4_destination_unreachable,
+					       ICMP4_destination_unreachable_destination_unreachable_host,
+					       0);
+		  next1 = DET44_IN2OUT_NEXT_ICMP_ERROR;
+		  goto trace1;
+		}
+	    }
+
+	  old_port1 = udp1->src_port;
+	  udp1->src_port = new_port1 = ses1->out.out_port;
+
+	  old_addr1.as_u32 = ip1->src_address.as_u32;
+	  ip1->src_address.as_u32 = new_addr1.as_u32;
+	  vnet_buffer (b1)->sw_if_index[VLIB_TX] = dm->outside_fib_index;
+
+	  sum1 = ip1->checksum;
+	  sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
+				 ip4_header_t,
+				 src_address /* changed member */ );
+	  ip1->checksum = ip_csum_fold (sum1);
+
+	  if (PREDICT_TRUE (proto1 == NAT_PROTOCOL_TCP))
+	    {
+	      if (tcp1->flags & TCP_FLAG_SYN)
+		ses1->state = DET44_SESSION_TCP_SYN_SENT;
+	      else if (tcp1->flags & TCP_FLAG_ACK
+		       && ses1->state == DET44_SESSION_TCP_SYN_SENT)
+		ses1->state = DET44_SESSION_TCP_ESTABLISHED;
+	      else if (tcp1->flags & TCP_FLAG_FIN
+		       && ses1->state == DET44_SESSION_TCP_ESTABLISHED)
+		ses1->state = DET44_SESSION_TCP_FIN_WAIT;
+	      else if (tcp1->flags & TCP_FLAG_ACK
+		       && ses1->state == DET44_SESSION_TCP_FIN_WAIT)
+		snat_det_ses_close (mp1, ses1);
+	      else if (tcp1->flags & TCP_FLAG_FIN
+		       && ses1->state == DET44_SESSION_TCP_CLOSE_WAIT)
+		ses1->state = DET44_SESSION_TCP_LAST_ACK;
+	      else if (tcp1->flags == 0
+		       && ses1->state == DET44_SESSION_UNKNOWN)
+		ses1->state = DET44_SESSION_TCP_ESTABLISHED;
+
+	      sum1 = tcp1->checksum;
+	      sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
+				     ip4_header_t,
+				     dst_address /* changed member */ );
+	      sum1 = ip_csum_update (sum1, old_port1, new_port1,
+				     ip4_header_t /* cheat */ ,
+				     length /* changed member */ );
+	      mss_clamping (dm->mss_clamping, tcp1, &sum1);
+	      tcp1->checksum = ip_csum_fold (sum1);
+	    }
+	  else
+	    {
+	      ses1->state = DET44_SESSION_UDP_ACTIVE;
+
+	      if (PREDICT_FALSE (udp1->checksum))
+		{
+		  sum1 = udp1->checksum;
+		  sum1 =
+		    ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
+				    ip4_header_t,
+				    dst_address /* changed member */ );
+		  sum1 =
+		    ip_csum_update (sum1, old_port1, new_port1,
+				    ip4_header_t /* cheat */ ,
+				    length /* changed member */ );
+		  udp1->checksum = ip_csum_fold (sum1);
+		}
+	    }
+
+	  switch (ses1->state)
+	    {
+	    case DET44_SESSION_UDP_ACTIVE:
+	      ses1->expire = now + dm->timeouts.udp;
+	      break;
+	    case DET44_SESSION_TCP_SYN_SENT:
+	    case DET44_SESSION_TCP_FIN_WAIT:
+	    case DET44_SESSION_TCP_CLOSE_WAIT:
+	    case DET44_SESSION_TCP_LAST_ACK:
+	      ses1->expire = now + dm->timeouts.tcp.transitory;
+	      break;
+	    case DET44_SESSION_TCP_ESTABLISHED:
+	      ses1->expire = now + dm->timeouts.tcp.established;
+	      break;
+	    }
+
+	trace1:
+	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
+			     && (b1->flags & VLIB_BUFFER_IS_TRACED)))
+	    {
+	      det44_in2out_trace_t *t =
+		vlib_add_trace (vm, node, b1, sizeof (*t));
+	      t->sw_if_index = sw_if_index1;
+	      t->next_index = next1;
+	      t->session_index = ~0;
+	      if (ses1)
+		t->session_index = ses1 - mp1->sessions;
+	    }
+
+	  pkts_processed += next1 != DET44_IN2OUT_NEXT_DROP;
+
+	  /* verify speculative enqueues, maybe switch current next frame */
+	  vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
+					   to_next, n_left_to_next,
+					   bi0, bi1, next0, next1);
+	}
+
+      while (n_left_from > 0 && n_left_to_next > 0)
+	{
+	  u32 bi0;
+	  vlib_buffer_t *b0;
+	  u32 next0;
+	  u32 sw_if_index0;
+	  ip4_header_t *ip0;
+	  ip_csum_t sum0;
+	  ip4_address_t new_addr0, old_addr0;
+	  u16 old_port0, new_port0, lo_port0, i0;
+	  udp_header_t *udp0;
+	  tcp_header_t *tcp0;
+	  u32 proto0;
+	  snat_det_out_key_t key0;
+	  snat_det_map_t *mp0;
+	  snat_det_session_t *ses0 = 0;
+	  u32 rx_fib_index0;
+	  icmp46_header_t *icmp0;
+
+	  /* speculatively enqueue b0 to the current next frame */
+	  bi0 = from[0];
+	  to_next[0] = bi0;
+	  from += 1;
+	  to_next += 1;
+	  n_left_from -= 1;
+	  n_left_to_next -= 1;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+	  next0 = DET44_IN2OUT_NEXT_LOOKUP;
+
+	  ip0 = vlib_buffer_get_current (b0);
+	  udp0 = ip4_next_header (ip0);
+	  tcp0 = (tcp_header_t *) udp0;
+
+	  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
+
+	  if (PREDICT_FALSE (ip0->ttl == 1))
+	    {
+	      vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+	      icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
+					   ICMP4_time_exceeded_ttl_exceeded_in_transit,
+					   0);
+	      next0 = DET44_IN2OUT_NEXT_ICMP_ERROR;
+	      goto trace00;
+	    }
+
+	  proto0 = ip_proto_to_nat_proto (ip0->protocol);
+
+	  if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
+	    {
+	      rx_fib_index0 =
+		ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
+	      icmp0 = (icmp46_header_t *) udp0;
+
+	      next0 = det44_icmp_in2out (b0, ip0, icmp0, sw_if_index0,
+					 rx_fib_index0, node, next0,
+					 thread_index, &ses0, &mp0);
+	      goto trace00;
+	    }
+
+	  mp0 = snat_det_map_by_user (&ip0->src_address);
+	  if (PREDICT_FALSE (!mp0))
+	    {
+	      det44_log_info ("no match for internal host %U",
+			      format_ip4_address, &ip0->src_address);
+	      next0 = DET44_IN2OUT_NEXT_DROP;
+	      b0->error = node->errors[DET44_IN2OUT_ERROR_NO_TRANSLATION];
+	      goto trace00;
+	    }
+
+	  snat_det_forward (mp0, &ip0->src_address, &new_addr0, &lo_port0);
+
+	  key0.ext_host_addr = ip0->dst_address;
+	  key0.ext_host_port = tcp0->dst;
+
+	  ses0 =
+	    snat_det_find_ses_by_in (mp0, &ip0->src_address, tcp0->src, key0);
+	  if (PREDICT_FALSE (!ses0))
+	    {
+	      for (i0 = 0; i0 < mp0->ports_per_host; i0++)
+		{
+		  key0.out_port = clib_host_to_net_u16 (lo_port0 +
+							((i0 +
+							  clib_net_to_host_u16
+							  (tcp0->src)) %
+							 mp0->
+							 ports_per_host));
+
+		  if (snat_det_get_ses_by_out
+		      (mp0, &ip0->src_address, key0.as_u64))
+		    continue;
+
+		  ses0 =
+		    snat_det_ses_create (thread_index, mp0, &ip0->src_address,
+					 tcp0->src, &key0);
+		  break;
+		}
+	      if (PREDICT_FALSE (!ses0))
+		{
+		  /* too many sessions for user, send ICMP error packet */
+		  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+		  icmp4_error_set_vnet_buffer (b0,
+					       ICMP4_destination_unreachable,
+					       ICMP4_destination_unreachable_destination_unreachable_host,
+					       0);
+		  next0 = DET44_IN2OUT_NEXT_ICMP_ERROR;
+		  goto trace00;
+		}
+	    }
+
+	  old_port0 = udp0->src_port;
+	  udp0->src_port = new_port0 = ses0->out.out_port;
+
+	  old_addr0.as_u32 = ip0->src_address.as_u32;
+	  ip0->src_address.as_u32 = new_addr0.as_u32;
+	  vnet_buffer (b0)->sw_if_index[VLIB_TX] = dm->outside_fib_index;
+
+	  sum0 = ip0->checksum;
+	  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+				 ip4_header_t,
+				 src_address /* changed member */ );
+	  ip0->checksum = ip_csum_fold (sum0);
+
+	  if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
+	    {
+	      if (tcp0->flags & TCP_FLAG_SYN)
+		ses0->state = DET44_SESSION_TCP_SYN_SENT;
+	      else if (tcp0->flags & TCP_FLAG_ACK
+		       && ses0->state == DET44_SESSION_TCP_SYN_SENT)
+		ses0->state = DET44_SESSION_TCP_ESTABLISHED;
+	      else if (tcp0->flags & TCP_FLAG_FIN
+		       && ses0->state == DET44_SESSION_TCP_ESTABLISHED)
+		ses0->state = DET44_SESSION_TCP_FIN_WAIT;
+	      else if (tcp0->flags & TCP_FLAG_ACK
+		       && ses0->state == DET44_SESSION_TCP_FIN_WAIT)
+		snat_det_ses_close (mp0, ses0);
+	      else if (tcp0->flags & TCP_FLAG_FIN
+		       && ses0->state == DET44_SESSION_TCP_CLOSE_WAIT)
+		ses0->state = DET44_SESSION_TCP_LAST_ACK;
+	      else if (tcp0->flags == 0
+		       && ses0->state == DET44_SESSION_UNKNOWN)
+		ses0->state = DET44_SESSION_TCP_ESTABLISHED;
+
+	      sum0 = tcp0->checksum;
+	      sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+				     ip4_header_t,
+				     dst_address /* changed member */ );
+	      sum0 = ip_csum_update (sum0, old_port0, new_port0,
+				     ip4_header_t /* cheat */ ,
+				     length /* changed member */ );
+	      mss_clamping (dm->mss_clamping, tcp0, &sum0);
+	      tcp0->checksum = ip_csum_fold (sum0);
+	    }
+	  else
+	    {
+	      ses0->state = DET44_SESSION_UDP_ACTIVE;
+
+	      if (PREDICT_FALSE (udp0->checksum))
+		{
+		  sum0 = udp0->checksum;
+		  sum0 =
+		    ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+				    ip4_header_t,
+				    dst_address /* changed member */ );
+		  sum0 =
+		    ip_csum_update (sum0, old_port0, new_port0,
+				    ip4_header_t /* cheat */ ,
+				    length /* changed member */ );
+		  udp0->checksum = ip_csum_fold (sum0);
+		}
+	    }
+
+	  switch (ses0->state)
+	    {
+	    case DET44_SESSION_UDP_ACTIVE:
+	      ses0->expire = now + dm->timeouts.udp;
+	      break;
+	    case DET44_SESSION_TCP_SYN_SENT:
+	    case DET44_SESSION_TCP_FIN_WAIT:
+	    case DET44_SESSION_TCP_CLOSE_WAIT:
+	    case DET44_SESSION_TCP_LAST_ACK:
+	      ses0->expire = now + dm->timeouts.tcp.transitory;
+	      break;
+	    case DET44_SESSION_TCP_ESTABLISHED:
+	      ses0->expire = now + dm->timeouts.tcp.established;
+	      break;
+	    }
+
+	trace00:
+	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
+			     && (b0->flags & VLIB_BUFFER_IS_TRACED)))
+	    {
+	      det44_in2out_trace_t *t =
+		vlib_add_trace (vm, node, b0, sizeof (*t));
+	      t->sw_if_index = sw_if_index0;
+	      t->next_index = next0;
+	      t->session_index = ~0;
+	      if (ses0)
+		t->session_index = ses0 - mp0->sessions;
+	    }
+
+	  pkts_processed += next0 != DET44_IN2OUT_NEXT_DROP;
+
+	  /* verify speculative enqueue, maybe switch current next frame */
+	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
+					   to_next, n_left_to_next,
+					   bi0, next0);
+	}
+
+      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+    }
+
+  vlib_node_increment_counter (vm, dm->in2out_node_index,
+			       DET44_IN2OUT_ERROR_IN2OUT_PACKETS,
+			       pkts_processed);
+  return frame->n_vectors;
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (det44_in2out_node) = {
+  .name = "det44-in2out",
+  .vector_size = sizeof (u32),
+  .format_trace = format_det44_in2out_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+  .n_errors = ARRAY_LEN(det44_in2out_error_strings),
+  .error_strings = det44_in2out_error_strings,
+  .runtime_data_bytes = sizeof (det44_runtime_t),
+  .n_next_nodes = DET44_IN2OUT_N_NEXT,
+  /* edit / add dispositions here */
+  .next_nodes = {
+    [DET44_IN2OUT_NEXT_DROP] = "error-drop",
+    [DET44_IN2OUT_NEXT_LOOKUP] = "ip4-lookup",
+    [DET44_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error",
+  },
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/nat/det44/det44_inlines.h b/src/plugins/nat/det44/det44_inlines.h
new file mode 100644
index 0000000..e4be469
--- /dev/null
+++ b/src/plugins/nat/det44/det44_inlines.h
@@ -0,0 +1,130 @@
+/*
+ * det44.h - deterministic NAT definitions
+ *
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file
+ * @brief Deterministic NAT (CGN) inlines
+ */
+
+#ifndef __included_det44_inlines_h__
+#define __included_det44_inlines_h__
+
+static_always_inline int
+det44_is_interface_addr (vlib_node_runtime_t * node,
+			 u32 sw_if_index0, u32 ip4_addr)
+{
+  det44_runtime_t *rt = (det44_runtime_t *) node->runtime_data;
+  det44_main_t *dm = &det44_main;
+  ip4_address_t *first_int_addr;
+
+  if (PREDICT_FALSE (rt->cached_sw_if_index != sw_if_index0))
+    {
+      first_int_addr = ip4_interface_first_address (dm->ip4_main,
+						    sw_if_index0, 0);
+      rt->cached_sw_if_index = sw_if_index0;
+      if (first_int_addr)
+	rt->cached_ip4_address = first_int_addr->as_u32;
+      else
+	rt->cached_ip4_address = 0;
+    }
+  if (PREDICT_FALSE (rt->cached_ip4_address == ip4_addr))
+    return 0;
+  return 1;
+}
+
+/**
+ * @brief Check if packet should be translated
+ *
+ * Packets aimed at outside interface and external address with active session
+ * should be translated.
+ *
+ * @param node          NAT runtime data
+ * @param sw_if_index0  index of the inside interface
+ * @param ip0           IPv4 header
+ * @param proto0        NAT protocol
+ * @param rx_fib_index0 RX FIB index
+ *
+ * @returns 0 if packet should be translated otherwise 1
+ */
+static_always_inline int
+det44_translate (vlib_node_runtime_t * node, u32 sw_if_index0,
+		 ip4_header_t * ip0, u32 proto0, u32 rx_fib_index0)
+{
+  det44_main_t *dm = &det44_main;
+  fib_node_index_t fei = FIB_NODE_INDEX_INVALID;
+  det44_fib_t *outside_fib;
+  fib_prefix_t pfx = {
+    .fp_proto = FIB_PROTOCOL_IP4,
+    .fp_len = 32,
+    .fp_addr = {
+		.ip4.as_u32 = ip0->dst_address.as_u32,
+		}
+    ,
+  };
+
+  /* Don't NAT packet aimed at the interface address */
+  if (PREDICT_FALSE (!det44_is_interface_addr (node, sw_if_index0,
+					       ip0->dst_address.as_u32)))
+    {
+      return 1;
+    }
+
+  /* find out if there is outside feature enabled for this destination */
+  fei = fib_table_lookup (rx_fib_index0, &pfx);
+  if (FIB_NODE_INDEX_INVALID != fei)
+    {
+      u32 sw_if_index = fib_entry_get_resolving_interface (fei);
+      if (sw_if_index == ~0)
+	{
+	  // TODO: go over use cases
+          /* *INDENT-OFF* */
+	  vec_foreach (outside_fib, dm->outside_fibs)
+	    {
+	      fei = fib_table_lookup (outside_fib->fib_index, &pfx);
+	      if (FIB_NODE_INDEX_INVALID != fei)
+	        {
+		  sw_if_index = fib_entry_get_resolving_interface (fei);
+		  if (sw_if_index != ~0)
+		    break;
+	        }
+	    }
+          /* *INDENT-ON* */
+	}
+      if (sw_if_index != ~0)
+	{
+	  det44_interface_t *i;
+          /* *INDENT-OFF* */
+          pool_foreach (i, dm->interfaces, ({
+            /* NAT packet aimed at outside interface */
+	    if ((det44_interface_is_outside (i)) && (sw_if_index == i->sw_if_index))
+              return 0;
+          }));
+          /* *INDENT-ON* */
+	}
+    }
+  return 1;
+}
+
+#endif /* __included_det44_inlines_h__ */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/nat/det44/det44_out2in.c b/src/plugins/nat/det44/det44_out2in.c
new file mode 100644
index 0000000..5ee2877
--- /dev/null
+++ b/src/plugins/nat/det44/det44_out2in.c
@@ -0,0 +1,866 @@
+/*
+ * Copyright (c) 2020 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * @file
+ * @brief Deterministic NAT (CGN) outside to inside translation
+ */
+
+#include <vlib/vlib.h>
+#include <vnet/vnet.h>
+#include <vnet/ip/ip.h>
+#include <vnet/fib/ip4_fib.h>
+#include <vppinfra/error.h>
+#include <vppinfra/elog.h>
+
+#include <nat/det44/det44.h>
+#include <nat/det44/det44_inlines.h>
+
+#include <nat/lib/lib.h>
+#include <nat/lib/inlines.h>
+#include <nat/lib/nat_inlines.h>
+
+typedef enum
+{
+  DET44_OUT2IN_NEXT_DROP,
+  DET44_OUT2IN_NEXT_LOOKUP,
+  DET44_OUT2IN_NEXT_ICMP_ERROR,
+  DET44_OUT2IN_N_NEXT,
+} det44_out2in_next_t;
+
+typedef struct
+{
+  u32 sw_if_index;
+  u32 next_index;
+  u32 session_index;
+} det44_out2in_trace_t;
+
+#define foreach_det44_out2in_error                 \
+_(UNSUPPORTED_PROTOCOL, "Unsupported protocol")    \
+_(NO_TRANSLATION, "No translation")                \
+_(BAD_ICMP_TYPE, "unsupported ICMP type")          \
+_(OUT2IN_PACKETS, "Good out2in packets processed")
+
+typedef enum
+{
+#define _(sym,str) DET44_OUT2IN_ERROR_##sym,
+  foreach_det44_out2in_error
+#undef _
+    DET44_OUT2IN_N_ERROR,
+} det44_out2in_error_t;
+
+static char *det44_out2in_error_strings[] = {
+#define _(sym,string) string,
+  foreach_det44_out2in_error
+#undef _
+};
+
+static u8 *
+format_det44_out2in_trace (u8 * s, va_list * args)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+  det44_out2in_trace_t *t = va_arg (*args, det44_out2in_trace_t *);
+
+  s =
+    format (s,
+	    "DET44_OUT2IN: sw_if_index %d, next index %d, session index %d",
+	    t->sw_if_index, t->next_index, t->session_index);
+  return s;
+}
+
+#ifndef CLIB_MARCH_VARIANT
+/**
+ * Get address and port values to be used for ICMP packet translation
+ * and create session if needed
+ *
+ * @param[in,out] node           NAT node runtime
+ * @param[in] thread_index       thread index
+ * @param[in,out] b0             buffer containing packet to be translated
+ * @param[in,out] ip0            ip header
+ * @param[out] p_proto           protocol used for matching
+ * @param[out] p_value           address and port after NAT translation
+ * @param[out] p_dont_translate  if packet should not be translated
+ * @param d                      optional parameter
+ * @param e                      optional parameter
+ */
+u32
+icmp_match_out2in_det (vlib_node_runtime_t * node,
+		       u32 thread_index, vlib_buffer_t * b0,
+		       ip4_header_t * ip0, ip4_address_t * addr,
+		       u16 * port, u32 * fib_index,
+		       nat_protocol_t * proto, void *d, void *e,
+		       u8 * dont_translate)
+{
+  det44_main_t *dm = &det44_main;
+  icmp46_header_t *icmp0;
+  u32 sw_if_index0;
+  u8 protocol;
+  snat_det_out_key_t key0;
+  u32 next0 = ~0;
+  icmp_echo_header_t *echo0, *inner_echo0 = 0;
+  ip4_header_t *inner_ip0;
+  void *l4_header = 0;
+  icmp46_header_t *inner_icmp0;
+  snat_det_map_t *mp0 = 0;
+  ip4_address_t new_addr0 = { {0} };
+  snat_det_session_t *ses0 = 0;
+  ip4_address_t out_addr;
+  *dont_translate = 0;
+
+  icmp0 = (icmp46_header_t *) ip4_next_header (ip0);
+  echo0 = (icmp_echo_header_t *) (icmp0 + 1);
+  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
+
+  if (!icmp_type_is_error_message
+      (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags))
+    {
+      protocol = NAT_PROTOCOL_ICMP;
+      key0.ext_host_addr = ip0->src_address;
+      key0.ext_host_port = 0;
+      key0.out_port = vnet_buffer (b0)->ip.reass.l4_src_port;
+      out_addr = ip0->dst_address;
+    }
+  else
+    {
+      /* if error message, then it's not fragmented and we can access it */
+      inner_ip0 = (ip4_header_t *) (echo0 + 1);
+      l4_header = ip4_next_header (inner_ip0);
+      protocol = ip_proto_to_nat_proto (inner_ip0->protocol);
+      key0.ext_host_addr = inner_ip0->dst_address;
+      out_addr = inner_ip0->src_address;
+      switch (protocol)
+	{
+	case NAT_PROTOCOL_ICMP:
+	  inner_icmp0 = (icmp46_header_t *) l4_header;
+	  inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
+	  key0.ext_host_port = 0;
+	  key0.out_port = inner_echo0->identifier;
+	  break;
+	case NAT_PROTOCOL_UDP:
+	case NAT_PROTOCOL_TCP:
+	  key0.ext_host_port = ((tcp_udp_header_t *) l4_header)->dst_port;
+	  key0.out_port = ((tcp_udp_header_t *) l4_header)->src_port;
+	  break;
+	default:
+	  b0->error = node->errors[DET44_OUT2IN_ERROR_UNSUPPORTED_PROTOCOL];
+	  next0 = DET44_OUT2IN_NEXT_DROP;
+	  goto out;
+	}
+    }
+
+  mp0 = snat_det_map_by_out (&out_addr);
+  if (PREDICT_FALSE (!mp0))
+    {
+      /* Don't NAT packet aimed at the intfc address */
+      if (PREDICT_FALSE (!det44_is_interface_addr (node, sw_if_index0,
+						   ip0->dst_address.as_u32)))
+	{
+	  *dont_translate = 1;
+	  goto out;
+	}
+      det44_log_info ("unknown dst address:  %U",
+		      format_ip4_address, &ip0->dst_address);
+      goto out;
+    }
+
+  snat_det_reverse (mp0, &ip0->dst_address,
+		    clib_net_to_host_u16 (key0.out_port), &new_addr0);
+
+  ses0 = snat_det_get_ses_by_out (mp0, &new_addr0, key0.as_u64);
+  if (PREDICT_FALSE (!ses0))
+    {
+      /* Don't NAT packet aimed at the intfc address */
+      if (PREDICT_FALSE (!det44_is_interface_addr (node, sw_if_index0,
+						   ip0->dst_address.as_u32)))
+	{
+	  *dont_translate = 1;
+	  goto out;
+	}
+      det44_log_info ("no match src %U:%d dst %U:%d for user %U",
+		      format_ip4_address, &key0.ext_host_addr,
+		      clib_net_to_host_u16 (key0.ext_host_port),
+		      format_ip4_address, &out_addr,
+		      clib_net_to_host_u16 (key0.out_port),
+		      format_ip4_address, &new_addr0);
+      b0->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION];
+      next0 = DET44_OUT2IN_NEXT_DROP;
+      goto out;
+    }
+
+  if (PREDICT_FALSE
+      (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags != ICMP4_echo_reply
+       && !icmp_type_is_error_message (vnet_buffer (b0)->ip.
+				       reass.icmp_type_or_tcp_flags)))
+    {
+      b0->error = node->errors[DET44_OUT2IN_ERROR_BAD_ICMP_TYPE];
+      next0 = DET44_OUT2IN_NEXT_DROP;
+      goto out;
+    }
+
+  goto out;
+
+out:
+  *proto = protocol;
+  if (ses0)
+    {
+      *addr = new_addr0;
+      *fib_index = dm->inside_fib_index;
+      *port = ses0->in_port;
+    }
+  if (d)
+    *(snat_det_session_t **) d = ses0;
+  if (e)
+    *(snat_det_map_t **) e = mp0;
+  return next0;
+}
+#endif
+
+#ifndef CLIB_MARCH_VARIANT
+u32
+det44_icmp_out2in (vlib_buffer_t * b0,
+		   ip4_header_t * ip0,
+		   icmp46_header_t * icmp0,
+		   u32 sw_if_index0,
+		   u32 rx_fib_index0,
+		   vlib_node_runtime_t * node,
+		   u32 next0, u32 thread_index, void *d, void *e)
+{
+  vlib_main_t *vm = vlib_get_main ();
+  u32 new_addr0, old_addr0, next0_tmp, fib_index;
+  u16 old_id0, new_id0, port, checksum0;
+  icmp_echo_header_t *echo0, *inner_echo0;
+  icmp46_header_t *inner_icmp0;
+  ip4_header_t *inner_ip0;
+  ip4_address_t addr;
+  void *l4_header;
+  u8 dont_translate;
+  ip_csum_t sum0;
+  nat_protocol_t proto;
+
+  echo0 = (icmp_echo_header_t *) (icmp0 + 1);
+  next0_tmp = icmp_match_out2in_det (node, thread_index, b0, ip0,
+				     &addr, &port, &fib_index, &proto,
+				     d, e, &dont_translate);
+  if (next0_tmp != ~0)
+    next0 = next0_tmp;
+  if (next0 == DET44_OUT2IN_NEXT_DROP || dont_translate)
+    goto out;
+
+  if (PREDICT_TRUE (!ip4_is_fragment (ip0)))
+    {
+      sum0 =
+	ip_incremental_checksum_buffer (vm, b0,
+					(u8 *) icmp0 -
+					(u8 *) vlib_buffer_get_current (b0),
+					ntohs (ip0->length) -
+					ip4_header_bytes (ip0), 0);
+      checksum0 = ~ip_csum_fold (sum0);
+      if (checksum0 != 0 && checksum0 != 0xffff)
+	{
+	  next0 = DET44_OUT2IN_NEXT_DROP;
+	  goto out;
+	}
+    }
+
+  old_addr0 = ip0->dst_address.as_u32;
+  new_addr0 = ip0->dst_address.as_u32 = addr.as_u32;
+  vnet_buffer (b0)->sw_if_index[VLIB_TX] = fib_index;
+
+  sum0 = ip0->checksum;
+  sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
+			 dst_address /* changed member */ );
+  ip0->checksum = ip_csum_fold (sum0);
+
+
+  if (!vnet_buffer (b0)->ip.reass.is_non_first_fragment)
+    {
+      if (icmp0->checksum == 0)
+	icmp0->checksum = 0xffff;
+
+      if (!icmp_type_is_error_message (icmp0->type))
+	{
+	  new_id0 = port;
+	  if (PREDICT_FALSE (new_id0 != echo0->identifier))
+	    {
+	      old_id0 = echo0->identifier;
+	      new_id0 = port;
+	      echo0->identifier = new_id0;
+
+	      sum0 = icmp0->checksum;
+	      sum0 =
+		ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
+				identifier /* changed member */ );
+	      icmp0->checksum = ip_csum_fold (sum0);
+	    }
+	}
+      else
+	{
+	  inner_ip0 = (ip4_header_t *) (echo0 + 1);
+	  l4_header = ip4_next_header (inner_ip0);
+
+	  if (!ip4_header_checksum_is_valid (inner_ip0))
+	    {
+	      next0 = DET44_OUT2IN_NEXT_DROP;
+	      goto out;
+	    }
+
+	  old_addr0 = inner_ip0->src_address.as_u32;
+	  inner_ip0->src_address = addr;
+	  new_addr0 = inner_ip0->src_address.as_u32;
+
+	  sum0 = icmp0->checksum;
+	  sum0 = ip_csum_update (sum0, old_addr0, new_addr0, ip4_header_t,
+				 src_address /* changed member */ );
+	  icmp0->checksum = ip_csum_fold (sum0);
+
+	  switch (proto)
+	    {
+	    case NAT_PROTOCOL_ICMP:
+	      inner_icmp0 = (icmp46_header_t *) l4_header;
+	      inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
+
+	      old_id0 = inner_echo0->identifier;
+	      new_id0 = port;
+	      inner_echo0->identifier = new_id0;
+
+	      sum0 = icmp0->checksum;
+	      sum0 =
+		ip_csum_update (sum0, old_id0, new_id0, icmp_echo_header_t,
+				identifier);
+	      icmp0->checksum = ip_csum_fold (sum0);
+	      break;
+	    case NAT_PROTOCOL_UDP:
+	    case NAT_PROTOCOL_TCP:
+	      old_id0 = ((tcp_udp_header_t *) l4_header)->src_port;
+	      new_id0 = port;
+	      ((tcp_udp_header_t *) l4_header)->src_port = new_id0;
+
+	      sum0 = icmp0->checksum;
+	      sum0 = ip_csum_update (sum0, old_id0, new_id0, tcp_udp_header_t,
+				     src_port);
+	      icmp0->checksum = ip_csum_fold (sum0);
+	      break;
+	    default:
+	      ASSERT (0);
+	    }
+	}
+    }
+
+out:
+  return next0;
+}
+#endif
+
+VLIB_NODE_FN (det44_out2in_node) (vlib_main_t * vm,
+				  vlib_node_runtime_t * node,
+				  vlib_frame_t * frame)
+{
+  u32 n_left_from, *from, *to_next;
+  det44_out2in_next_t next_index;
+  u32 pkts_processed = 0;
+  det44_main_t *dm = &det44_main;
+  u32 thread_index = vm->thread_index;
+
+  from = vlib_frame_vector_args (frame);
+  n_left_from = frame->n_vectors;
+  next_index = node->cached_next_index;
+
+  while (n_left_from > 0)
+    {
+      u32 n_left_to_next;
+
+      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+      while (n_left_from >= 4 && n_left_to_next >= 2)
+	{
+	  u32 bi0, bi1;
+	  vlib_buffer_t *b0, *b1;
+	  u32 next0 = DET44_OUT2IN_NEXT_LOOKUP;
+	  u32 next1 = DET44_OUT2IN_NEXT_LOOKUP;
+	  u32 sw_if_index0, sw_if_index1;
+	  ip4_header_t *ip0, *ip1;
+	  ip_csum_t sum0, sum1;
+	  ip4_address_t new_addr0, old_addr0, new_addr1, old_addr1;
+	  u16 new_port0, old_port0, old_port1, new_port1;
+	  udp_header_t *udp0, *udp1;
+	  tcp_header_t *tcp0, *tcp1;
+	  u32 proto0, proto1;
+	  snat_det_out_key_t key0, key1;
+	  snat_det_map_t *mp0, *mp1;
+	  snat_det_session_t *ses0 = 0, *ses1 = 0;
+	  u32 rx_fib_index0, rx_fib_index1;
+	  icmp46_header_t *icmp0, *icmp1;
+
+	  /* Prefetch next iteration. */
+	  {
+	    vlib_buffer_t *p2, *p3;
+
+	    p2 = vlib_get_buffer (vm, from[2]);
+	    p3 = vlib_get_buffer (vm, from[3]);
+
+	    vlib_prefetch_buffer_header (p2, LOAD);
+	    vlib_prefetch_buffer_header (p3, LOAD);
+
+	    CLIB_PREFETCH (p2->data, CLIB_CACHE_LINE_BYTES, LOAD);
+	    CLIB_PREFETCH (p3->data, CLIB_CACHE_LINE_BYTES, LOAD);
+	  }
+
+	  /* speculatively enqueue b0 and b1 to the current next frame */
+	  to_next[0] = bi0 = from[0];
+	  to_next[1] = bi1 = from[1];
+	  from += 2;
+	  to_next += 2;
+	  n_left_from -= 2;
+	  n_left_to_next -= 2;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+	  b1 = vlib_get_buffer (vm, bi1);
+
+	  ip0 = vlib_buffer_get_current (b0);
+	  udp0 = ip4_next_header (ip0);
+	  tcp0 = (tcp_header_t *) udp0;
+
+	  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
+
+	  if (PREDICT_FALSE (ip0->ttl == 1))
+	    {
+	      vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+	      icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
+					   ICMP4_time_exceeded_ttl_exceeded_in_transit,
+					   0);
+	      next0 = DET44_OUT2IN_NEXT_ICMP_ERROR;
+	      goto trace0;
+	    }
+
+	  proto0 = ip_proto_to_nat_proto (ip0->protocol);
+
+	  if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
+	    {
+	      rx_fib_index0 =
+		ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
+	      icmp0 = (icmp46_header_t *) udp0;
+
+	      next0 = det44_icmp_out2in (b0, ip0, icmp0, sw_if_index0,
+					 rx_fib_index0, node, next0,
+					 thread_index, &ses0, &mp0);
+	      goto trace0;
+	    }
+
+	  key0.ext_host_addr = ip0->src_address;
+	  key0.ext_host_port = tcp0->src;
+	  key0.out_port = tcp0->dst;
+
+	  mp0 = snat_det_map_by_out (&ip0->dst_address);
+	  if (PREDICT_FALSE (!mp0))
+	    {
+	      det44_log_info ("unknown dst address:  %U",
+			      format_ip4_address, &ip0->dst_address);
+	      next0 = DET44_OUT2IN_NEXT_DROP;
+	      b0->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION];
+	      goto trace0;
+	    }
+
+	  snat_det_reverse (mp0, &ip0->dst_address,
+			    clib_net_to_host_u16 (tcp0->dst), &new_addr0);
+
+	  ses0 = snat_det_get_ses_by_out (mp0, &new_addr0, key0.as_u64);
+	  if (PREDICT_FALSE (!ses0))
+	    {
+	      det44_log_info ("no match src %U:%d dst %U:%d for user %U",
+			      format_ip4_address, &ip0->src_address,
+			      clib_net_to_host_u16 (tcp0->src),
+			      format_ip4_address, &ip0->dst_address,
+			      clib_net_to_host_u16 (tcp0->dst),
+			      format_ip4_address, &new_addr0);
+	      next0 = DET44_OUT2IN_NEXT_DROP;
+	      b0->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION];
+	      goto trace0;
+	    }
+	  old_port0 = udp0->dst_port;
+	  udp0->dst_port = new_port0 = ses0->in_port;
+
+	  old_addr0 = ip0->dst_address;
+	  ip0->dst_address = new_addr0;
+	  vnet_buffer (b0)->sw_if_index[VLIB_TX] = dm->inside_fib_index;
+
+	  sum0 = ip0->checksum;
+	  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+				 ip4_header_t,
+				 dst_address /* changed member */ );
+	  ip0->checksum = ip_csum_fold (sum0);
+
+	  if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
+	    {
+	      if (tcp0->flags & TCP_FLAG_FIN
+		  && ses0->state == DET44_SESSION_TCP_ESTABLISHED)
+		ses0->state = DET44_SESSION_TCP_CLOSE_WAIT;
+	      else if (tcp0->flags & TCP_FLAG_ACK
+		       && ses0->state == DET44_SESSION_TCP_LAST_ACK)
+		snat_det_ses_close (mp0, ses0);
+
+	      sum0 = tcp0->checksum;
+	      sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+				     ip4_header_t,
+				     dst_address /* changed member */ );
+	      sum0 = ip_csum_update (sum0, old_port0, new_port0,
+				     ip4_header_t /* cheat */ ,
+				     length /* changed member */ );
+	      tcp0->checksum = ip_csum_fold (sum0);
+	    }
+	  else if (udp0->checksum)
+	    {
+	      sum0 = udp0->checksum;
+	      sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+				     ip4_header_t,
+				     dst_address /* changed member */ );
+	      sum0 = ip_csum_update (sum0, old_port0, new_port0,
+				     ip4_header_t /* cheat */ ,
+				     length /* changed member */ );
+	      udp0->checksum = ip_csum_fold (sum0);
+	    }
+
+	trace0:
+
+	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
+			     && (b0->flags & VLIB_BUFFER_IS_TRACED)))
+	    {
+	      det44_out2in_trace_t *t =
+		vlib_add_trace (vm, node, b0, sizeof (*t));
+	      t->sw_if_index = sw_if_index0;
+	      t->next_index = next0;
+	      t->session_index = ~0;
+	      if (ses0)
+		t->session_index = ses0 - mp0->sessions;
+	    }
+
+	  pkts_processed += next0 != DET44_OUT2IN_NEXT_DROP;
+
+	  b1 = vlib_get_buffer (vm, bi1);
+
+	  ip1 = vlib_buffer_get_current (b1);
+	  udp1 = ip4_next_header (ip1);
+	  tcp1 = (tcp_header_t *) udp1;
+
+	  sw_if_index1 = vnet_buffer (b1)->sw_if_index[VLIB_RX];
+
+	  if (PREDICT_FALSE (ip1->ttl == 1))
+	    {
+	      vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+	      icmp4_error_set_vnet_buffer (b1, ICMP4_time_exceeded,
+					   ICMP4_time_exceeded_ttl_exceeded_in_transit,
+					   0);
+	      next1 = DET44_OUT2IN_NEXT_ICMP_ERROR;
+	      goto trace1;
+	    }
+
+	  proto1 = ip_proto_to_nat_proto (ip1->protocol);
+
+	  if (PREDICT_FALSE (proto1 == NAT_PROTOCOL_ICMP))
+	    {
+	      rx_fib_index1 =
+		ip4_fib_table_get_index_for_sw_if_index (sw_if_index1);
+	      icmp1 = (icmp46_header_t *) udp1;
+
+	      next1 = det44_icmp_out2in (b1, ip1, icmp1, sw_if_index1,
+					 rx_fib_index1, node, next1,
+					 thread_index, &ses1, &mp1);
+	      goto trace1;
+	    }
+
+	  key1.ext_host_addr = ip1->src_address;
+	  key1.ext_host_port = tcp1->src;
+	  key1.out_port = tcp1->dst;
+
+	  mp1 = snat_det_map_by_out (&ip1->dst_address);
+	  if (PREDICT_FALSE (!mp1))
+	    {
+	      det44_log_info ("unknown dst address:  %U",
+			      format_ip4_address, &ip1->dst_address);
+	      next1 = DET44_OUT2IN_NEXT_DROP;
+	      b1->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION];
+	      goto trace1;
+	    }
+
+	  snat_det_reverse (mp1, &ip1->dst_address,
+			    clib_net_to_host_u16 (tcp1->dst), &new_addr1);
+
+	  ses1 = snat_det_get_ses_by_out (mp1, &new_addr1, key1.as_u64);
+	  if (PREDICT_FALSE (!ses1))
+	    {
+	      det44_log_info ("no match src %U:%d dst %U:%d for user %U",
+			      format_ip4_address, &ip1->src_address,
+			      clib_net_to_host_u16 (tcp1->src),
+			      format_ip4_address, &ip1->dst_address,
+			      clib_net_to_host_u16 (tcp1->dst),
+			      format_ip4_address, &new_addr1);
+	      next1 = DET44_OUT2IN_NEXT_DROP;
+	      b1->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION];
+	      goto trace1;
+	    }
+	  old_port1 = udp1->dst_port;
+	  udp1->dst_port = new_port1 = ses1->in_port;
+
+	  old_addr1 = ip1->dst_address;
+	  ip1->dst_address = new_addr1;
+	  vnet_buffer (b1)->sw_if_index[VLIB_TX] = dm->inside_fib_index;
+
+	  sum1 = ip1->checksum;
+	  sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
+				 ip4_header_t,
+				 dst_address /* changed member */ );
+	  ip1->checksum = ip_csum_fold (sum1);
+
+	  if (PREDICT_TRUE (proto1 == NAT_PROTOCOL_TCP))
+	    {
+	      if (tcp1->flags & TCP_FLAG_FIN
+		  && ses1->state == DET44_SESSION_TCP_ESTABLISHED)
+		ses1->state = DET44_SESSION_TCP_CLOSE_WAIT;
+	      else if (tcp1->flags & TCP_FLAG_ACK
+		       && ses1->state == DET44_SESSION_TCP_LAST_ACK)
+		snat_det_ses_close (mp1, ses1);
+
+	      sum1 = tcp1->checksum;
+	      sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
+				     ip4_header_t,
+				     dst_address /* changed member */ );
+	      sum1 = ip_csum_update (sum1, old_port1, new_port1,
+				     ip4_header_t /* cheat */ ,
+				     length /* changed member */ );
+	      tcp1->checksum = ip_csum_fold (sum1);
+	    }
+	  else if (udp1->checksum)
+	    {
+	      sum1 = udp1->checksum;
+	      sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
+				     ip4_header_t,
+				     dst_address /* changed member */ );
+	      sum1 = ip_csum_update (sum1, old_port1, new_port1,
+				     ip4_header_t /* cheat */ ,
+				     length /* changed member */ );
+	      udp1->checksum = ip_csum_fold (sum1);
+	    }
+
+	trace1:
+
+	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
+			     && (b1->flags & VLIB_BUFFER_IS_TRACED)))
+	    {
+	      det44_out2in_trace_t *t =
+		vlib_add_trace (vm, node, b1, sizeof (*t));
+	      t->sw_if_index = sw_if_index1;
+	      t->next_index = next1;
+	      t->session_index = ~0;
+	      if (ses1)
+		t->session_index = ses1 - mp1->sessions;
+	    }
+
+	  pkts_processed += next1 != DET44_OUT2IN_NEXT_DROP;
+
+	  /* verify speculative enqueues, maybe switch current next frame */
+	  vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
+					   to_next, n_left_to_next,
+					   bi0, bi1, next0, next1);
+	}
+
+      while (n_left_from > 0 && n_left_to_next > 0)
+	{
+	  u32 bi0;
+	  vlib_buffer_t *b0;
+	  u32 next0 = DET44_OUT2IN_NEXT_LOOKUP;
+	  u32 sw_if_index0;
+	  ip4_header_t *ip0;
+	  ip_csum_t sum0;
+	  ip4_address_t new_addr0, old_addr0;
+	  u16 new_port0, old_port0;
+	  udp_header_t *udp0;
+	  tcp_header_t *tcp0;
+	  u32 proto0;
+	  snat_det_out_key_t key0;
+	  snat_det_map_t *mp0;
+	  snat_det_session_t *ses0 = 0;
+	  u32 rx_fib_index0;
+	  icmp46_header_t *icmp0;
+
+	  /* speculatively enqueue b0 to the current next frame */
+	  bi0 = from[0];
+	  to_next[0] = bi0;
+	  from += 1;
+	  to_next += 1;
+	  n_left_from -= 1;
+	  n_left_to_next -= 1;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+
+	  ip0 = vlib_buffer_get_current (b0);
+	  udp0 = ip4_next_header (ip0);
+	  tcp0 = (tcp_header_t *) udp0;
+
+	  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
+
+	  if (PREDICT_FALSE (ip0->ttl == 1))
+	    {
+	      vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
+	      icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
+					   ICMP4_time_exceeded_ttl_exceeded_in_transit,
+					   0);
+	      next0 = DET44_OUT2IN_NEXT_ICMP_ERROR;
+	      goto trace00;
+	    }
+
+	  proto0 = ip_proto_to_nat_proto (ip0->protocol);
+
+	  if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
+	    {
+	      rx_fib_index0 =
+		ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
+	      icmp0 = (icmp46_header_t *) udp0;
+
+	      next0 = det44_icmp_out2in (b0, ip0, icmp0, sw_if_index0,
+					 rx_fib_index0, node, next0,
+					 thread_index, &ses0, &mp0);
+	      goto trace00;
+	    }
+
+	  key0.ext_host_addr = ip0->src_address;
+	  key0.ext_host_port = tcp0->src;
+	  key0.out_port = tcp0->dst;
+
+	  mp0 = snat_det_map_by_out (&ip0->dst_address);
+	  if (PREDICT_FALSE (!mp0))
+	    {
+	      det44_log_info ("unknown dst address:  %U",
+			      format_ip4_address, &ip0->dst_address);
+	      next0 = DET44_OUT2IN_NEXT_DROP;
+	      b0->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION];
+	      goto trace00;
+	    }
+
+	  snat_det_reverse (mp0, &ip0->dst_address,
+			    clib_net_to_host_u16 (tcp0->dst), &new_addr0);
+
+	  ses0 = snat_det_get_ses_by_out (mp0, &new_addr0, key0.as_u64);
+	  if (PREDICT_FALSE (!ses0))
+	    {
+	      det44_log_info ("no match src %U:%d dst %U:%d for user %U",
+			      format_ip4_address, &ip0->src_address,
+			      clib_net_to_host_u16 (tcp0->src),
+			      format_ip4_address, &ip0->dst_address,
+			      clib_net_to_host_u16 (tcp0->dst),
+			      format_ip4_address, &new_addr0);
+	      next0 = DET44_OUT2IN_NEXT_DROP;
+	      b0->error = node->errors[DET44_OUT2IN_ERROR_NO_TRANSLATION];
+	      goto trace00;
+	    }
+	  old_port0 = udp0->dst_port;
+	  udp0->dst_port = new_port0 = ses0->in_port;
+
+	  old_addr0 = ip0->dst_address;
+	  ip0->dst_address = new_addr0;
+	  vnet_buffer (b0)->sw_if_index[VLIB_TX] = dm->inside_fib_index;
+
+	  sum0 = ip0->checksum;
+	  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+				 ip4_header_t,
+				 dst_address /* changed member */ );
+	  ip0->checksum = ip_csum_fold (sum0);
+
+	  if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
+	    {
+	      if (tcp0->flags & TCP_FLAG_FIN
+		  && ses0->state == DET44_SESSION_TCP_ESTABLISHED)
+		ses0->state = DET44_SESSION_TCP_CLOSE_WAIT;
+	      else if (tcp0->flags & TCP_FLAG_ACK
+		       && ses0->state == DET44_SESSION_TCP_LAST_ACK)
+		snat_det_ses_close (mp0, ses0);
+
+	      sum0 = tcp0->checksum;
+	      sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+				     ip4_header_t,
+				     dst_address /* changed member */ );
+	      sum0 = ip_csum_update (sum0, old_port0, new_port0,
+				     ip4_header_t /* cheat */ ,
+				     length /* changed member */ );
+	      tcp0->checksum = ip_csum_fold (sum0);
+	    }
+	  else if (udp0->checksum)
+	    {
+	      sum0 = udp0->checksum;
+	      sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
+				     ip4_header_t,
+				     dst_address /* changed member */ );
+	      sum0 = ip_csum_update (sum0, old_port0, new_port0,
+				     ip4_header_t /* cheat */ ,
+				     length /* changed member */ );
+	      udp0->checksum = ip_csum_fold (sum0);
+	    }
+
+	trace00:
+
+	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
+			     && (b0->flags & VLIB_BUFFER_IS_TRACED)))
+	    {
+	      det44_out2in_trace_t *t =
+		vlib_add_trace (vm, node, b0, sizeof (*t));
+	      t->sw_if_index = sw_if_index0;
+	      t->next_index = next0;
+	      t->session_index = ~0;
+	      if (ses0)
+		t->session_index = ses0 - mp0->sessions;
+	    }
+
+	  pkts_processed += next0 != DET44_OUT2IN_NEXT_DROP;
+
+	  /* verify speculative enqueue, maybe switch current next frame */
+	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
+					   to_next, n_left_to_next,
+					   bi0, next0);
+	}
+
+      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+    }
+
+  vlib_node_increment_counter (vm, dm->out2in_node_index,
+			       DET44_OUT2IN_ERROR_OUT2IN_PACKETS,
+			       pkts_processed);
+  return frame->n_vectors;
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (det44_out2in_node) = {
+  .name = "det44-out2in",
+  .vector_size = sizeof (u32),
+  .format_trace = format_det44_out2in_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+  .n_errors = ARRAY_LEN(det44_out2in_error_strings),
+  .error_strings = det44_out2in_error_strings,
+  .runtime_data_bytes = sizeof (det44_runtime_t),
+  .n_next_nodes = DET44_OUT2IN_N_NEXT,
+  /* edit / add dispositions here */
+  .next_nodes = {
+    [DET44_OUT2IN_NEXT_DROP] = "error-drop",
+    [DET44_OUT2IN_NEXT_LOOKUP] = "ip4-lookup",
+    [DET44_OUT2IN_NEXT_ICMP_ERROR] = "ip4-icmp-error",
+  },
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/nat/dslite/dslite.api b/src/plugins/nat/dslite/dslite.api
index b5f8c5b..29c2100 100644
--- a/src/plugins/nat/dslite/dslite.api
+++ b/src/plugins/nat/dslite/dslite.api
@@ -18,7 +18,7 @@
 import "vnet/interface_types.api";
 
 /**
- * @file nat.api
+ * @file dslite.api
  * @brief VPP control-plane API messages.
  *
  * This file defines VPP control-plane API messages which are generally
diff --git a/src/plugins/nat/dslite/dslite.c b/src/plugins/nat/dslite/dslite.c
index ebf8afa..4ca24a4 100644
--- a/src/plugins/nat/dslite/dslite.c
+++ b/src/plugins/nat/dslite/dslite.c
@@ -267,9 +267,13 @@
 
 VLIB_INIT_FUNCTION (dslite_init);
 
+/* *INDENT-OFF* */
 VLIB_PLUGIN_REGISTER () =
 {
-.version = VPP_BUILD_VER,.description = "Dual-Stack Lite",};
+  .version = VPP_BUILD_VER,
+  .description = "Dual-Stack Lite",
+};
+/* *INDENT-ON* */
 
 /*
  * fd.io coding-style-patch-verification: ON
diff --git a/src/plugins/nat/in2out.c b/src/plugins/nat/in2out.c
index fe81b02..39957259 100644
--- a/src/plugins/nat/in2out.c
+++ b/src/plugins/nat/in2out.c
@@ -789,8 +789,7 @@
 
   if (vnet_buffer (b0)->sw_if_index[VLIB_TX] == ~0)
     {
-      if (sm->deterministic ||
-	  0 != snat_icmp_hairpinning (sm, b0, ip0, icmp0,
+      if (0 != snat_icmp_hairpinning (sm, b0, ip0, icmp0,
 				      sm->endpoint_dependent))
 	vnet_buffer (b0)->sw_if_index[VLIB_TX] = fib_index;
     }
diff --git a/src/plugins/nat/nat.api b/src/plugins/nat/nat.api
index cd50c19..7e6f359 100644
--- a/src/plugins/nat/nat.api
+++ b/src/plugins/nat/nat.api
@@ -989,174 +989,6 @@
   bool enabled;
 };
 
-
-/*
- * Deterministic NAT (CGN) APIs
- */
-
-/** \brief Add/delete NAT deterministic mapping
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-    @param is_add - true if add, false if delete
-    @param in_addr - inside IPv4 address
-    @param in_plen - inside IPv4 address prefix length
-    @param out_addr - outside IPv4 address
-    @param out_plen - outside IPv4 address prefix length
-*/
-autoreply define nat_det_add_del_map {
-  u32 client_index;
-  u32 context;
-  bool is_add;
-  vl_api_ip4_address_t in_addr;
-  u8 in_plen;
-  vl_api_ip4_address_t out_addr;
-  u8 out_plen;
-};
-
-/** \brief Get outside address and port range from inside address
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-    @param in_addr - inside IP address
-*/
-define nat_det_forward {
-  u32 client_index;
-  u32 context;
-  vl_api_ip4_address_t in_addr;
-};
-
-/** \brief Get outside address and port range from inside address
-    @param context - sender context, to match reply w/ request
-    @param retval - return code
-    @param out_port_lo - outside port range start
-    @param out_port_hi - outside port range end
-    @param out_addr - outside IPv4 address
-*/
-define nat_det_forward_reply {
-  u32 context;
-  i32 retval;
-  u16 out_port_lo;
-  u16 out_port_hi;
-  vl_api_ip4_address_t out_addr;
-};
-
-/** \brief Get inside address from outside address and port
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-    @param out_port - outside port
-    @param out_addr - outside IPv4 address
-*/
-define nat_det_reverse {
-  u32 client_index;
-  u32 context;
-  u16 out_port;
-  vl_api_ip4_address_t out_addr;
-};
-
-/** \brief Get inside address from outside address and port reply
-    @param context - sender context, to match reply w/ request
-    @param retval - return code
-    @param in_addr - inside IP address
-*/
-define nat_det_reverse_reply {
-  u32 context;
-  i32 retval;
-  vl_api_ip4_address_t in_addr;
-};
-
-/** \brief Dump NAT deterministic mappings
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-*/
-define nat_det_map_dump {
-  u32 client_index;
-  u32 context;
-};
-
-/** \brief NAT users response
-    @param context - sender context, to match reply w/ request
-    @param in_addr - inside IPv4 address
-    @param in_plen - inside IPv4 address prefix length
-    @param out_addr - outside IPv4 address
-    @param out_plen - outside IPv4 address prefix length
-    @param sharing_ratio - outside to inside address sharing ratio
-    @param ports_per_host - number of ports available to a host
-    @param ses_num - number of sessions belonging to this mapping
-*/
-define nat_det_map_details {
-  u32 context;
-  vl_api_ip4_address_t in_addr;
-  u8 in_plen;
-  vl_api_ip4_address_t out_addr;
-  u8 out_plen;
-  u32 sharing_ratio;
-  u16 ports_per_host;
-  u32 ses_num;
-};
-
-/** \brief Close deterministic NAT session by outside address and port
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-    @param out_addr - outside IPv4 address
-    @param out_port - outside port
-    @param ext_addr - external host IPv4 address
-    @param ext_port - external host port
-*/
-autoreply define nat_det_close_session_out {
-  u32 client_index;
-  u32 context;
-  vl_api_ip4_address_t out_addr;
-  u16 out_port;
-  vl_api_ip4_address_t ext_addr;
-  u16 ext_port;
-};
-
-/** \brief Close deterministic NAT session by inside address and port
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-    @param in_addr - inside IP address
-    @param in_port - inside port
-    @param ext_addr - external host IP address
-    @param ext_port - external host port
-*/
-autoreply define nat_det_close_session_in {
-  u32 client_index;
-  u32 context;
-  vl_api_ip4_address_t in_addr;
-  u16 in_port;
-  vl_api_ip4_address_t ext_addr;
-  u16 ext_port;
-};
-
-/** \brief Dump determinstic NAT sessions
-    @param client_index - opaque cookie to identify the sender
-    @param context - sender context, to match reply w/ request
-    @param user_addr - address of an inside user whose sessions to dump
-*/
-define nat_det_session_dump {
-  u32 client_index;
-  u32 context;
-  vl_api_ip4_address_t user_addr;
-};
-
-/** \brief Deterministic NAT sessions reply
-    @param context - sender context, to match reply w/ request
-    @param in_port - inside port
-    @param ext_addr - external host IPv4 address
-    @param ext_port - external host port
-    @param out_port - outside NAT port
-    @param state - session state
-    @param expire - session expiration timestamp
-*/
-define nat_det_session_details {
-  u32 context;
-  u16 in_port;
-  vl_api_ip4_address_t ext_addr;
-  u16 ext_port;
-  u16 out_port;
-  u8 state;
-  u32 expire;
-};
-
 /*
  * NAT64 APIs
  */
diff --git a/src/plugins/nat/nat.c b/src/plugins/nat/nat.c
index a0c1de2..ea1add6 100644
--- a/src/plugins/nat/nat.c
+++ b/src/plugins/nat/nat.c
@@ -22,7 +22,6 @@
 #include <nat/nat.h>
 #include <nat/nat_dpo.h>
 #include <nat/nat_ipfix_logging.h>
-#include <nat/nat_det.h>
 #include <nat/nat64.h>
 #include <nat/nat_inlines.h>
 #include <nat/nat44/inlines.h>
@@ -84,22 +83,6 @@
   .node_name = "nat44-classify",
   .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa","ip4-sv-reassembly-feature"),
 };
-VNET_FEATURE_INIT (ip4_snat_det_in2out, static) = {
-  .arc_name = "ip4-unicast",
-  .node_name = "nat44-det-in2out",
-  .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa","ip4-sv-reassembly-feature"),
-};
-VNET_FEATURE_INIT (ip4_snat_det_out2in, static) = {
-  .arc_name = "ip4-unicast",
-  .node_name = "nat44-det-out2in",
-  .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa","ip4-sv-reassembly-feature",
-                               "ip4-dhcp-client-detect"),
-};
-VNET_FEATURE_INIT (ip4_nat_det_classify, static) = {
-  .arc_name = "ip4-unicast",
-  .node_name = "nat44-det-classify",
-  .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa","ip4-sv-reassembly-feature"),
-};
 VNET_FEATURE_INIT (ip4_nat44_ed_in2out, static) = {
   .arc_name = "ip4-unicast",
   .node_name = "nat44-ed-in2out",
@@ -1839,7 +1822,6 @@
   const char *feature_name, *del_feature_name;
   snat_address_t *ap;
   snat_static_mapping_t *m;
-  snat_det_map_t *dm;
   nat_outside_fib_t *outside_fib;
   u32 fib_index = fib_table_get_index_for_sw_if_index (FIB_PROTOCOL_IP4,
 						       sw_if_index);
@@ -1859,12 +1841,10 @@
     feature_name = is_inside ? "nat44-in2out-fast" : "nat44-out2in-fast";
   else
     {
-      if (sm->num_workers > 1 && !sm->deterministic)
+      if (sm->num_workers > 1)
 	feature_name =
 	  is_inside ? "nat44-in2out-worker-handoff" :
 	  "nat44-out2in-worker-handoff";
-      else if (sm->deterministic)
-	feature_name = is_inside ? "nat44-det-in2out" : "nat44-det-out2in";
       else if (sm->endpoint_dependent)
 	{
 	  feature_name = is_inside ? "nat-pre-in2out" : "nat-pre-out2in";
@@ -1873,11 +1853,11 @@
 	feature_name = is_inside ? "nat44-in2out" : "nat44-out2in";
     }
 
-  if (sm->fq_in2out_index == ~0 && !sm->deterministic && sm->num_workers > 1)
+  if (sm->fq_in2out_index == ~0 && sm->num_workers > 1)
     sm->fq_in2out_index =
       vlib_frame_queue_main_init (sm->in2out_node_index, NAT_FQ_NELTS);
 
-  if (sm->fq_out2in_index == ~0 && !sm->deterministic && sm->num_workers > 1)
+  if (sm->fq_out2in_index == ~0 && sm->num_workers > 1)
     sm->fq_out2in_index =
       vlib_frame_queue_main_init (sm->out2in_node_index, NAT_FQ_NELTS);
 
@@ -1922,18 +1902,12 @@
                 else
                   i->flags &= ~NAT_INTERFACE_FLAG_IS_OUTSIDE;
 
-                if (sm->num_workers > 1 && !sm->deterministic)
+                if (sm->num_workers > 1)
                   {
                     del_feature_name = "nat44-handoff-classify";
                     feature_name = !is_inside ?  "nat44-in2out-worker-handoff" :
                                                  "nat44-out2in-worker-handoff";
                   }
-                else if (sm->deterministic)
-                  {
-                    del_feature_name = "nat44-det-classify";
-                    feature_name = !is_inside ?  "nat44-det-in2out" :
-                                                 "nat44-det-out2in";
-                  }
                 else if (sm->endpoint_dependent)
                   {
                     del_feature_name = "nat44-ed-classify";
@@ -1959,7 +1933,7 @@
                       vnet_feature_enable_disable ("ip4-local",
                                                    "nat44-ed-hairpinning",
                                                    sw_if_index, 1, 0, 0);
-                    else if (!sm->deterministic)
+                    else
                       vnet_feature_enable_disable ("ip4-local",
                                                    "nat44-hairpinning",
                                                    sw_if_index, 1, 0, 0);
@@ -1979,7 +1953,7 @@
                       vnet_feature_enable_disable ("ip4-local",
                                                    "nat44-ed-hairpinning",
                                                    sw_if_index, 0, 0, 0);
-                    else if (!sm->deterministic)
+                    else
                       vnet_feature_enable_disable ("ip4-local",
                                                    "nat44-hairpinning",
                                                    sw_if_index, 0, 0, 0);
@@ -1992,18 +1966,12 @@
                 (nat_interface_is_outside(i) && !is_inside))
               return 0;
 
-            if (sm->num_workers > 1 && !sm->deterministic)
+            if (sm->num_workers > 1)
               {
                 del_feature_name = !is_inside ?  "nat44-in2out-worker-handoff" :
                                                  "nat44-out2in-worker-handoff";
                 feature_name = "nat44-handoff-classify";
               }
-            else if (sm->deterministic)
-              {
-                del_feature_name = !is_inside ?  "nat44-det-in2out" :
-                                                 "nat44-det-out2in";
-                feature_name = "nat44-det-classify";
-              }
             else if (sm->endpoint_dependent)
               {
                 del_feature_name = !is_inside ?  "nat-pre-in2out" :
@@ -2029,7 +1997,7 @@
                 if (sm->endpoint_dependent)
                   vnet_feature_enable_disable ("ip4-local", "nat44-ed-hairpinning",
                                                sw_if_index, 0, 0, 0);
-                else if (!sm->deterministic)
+                else
                   vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning",
                                                sw_if_index, 0, 0, 0);
               }
@@ -2061,7 +2029,7 @@
       if (sm->endpoint_dependent)
 	vnet_feature_enable_disable ("ip4-local", "nat44-ed-hairpinning",
 				     sw_if_index, 1, 0, 0);
-      else if (!sm->deterministic)
+      else
 	vnet_feature_enable_disable ("ip4-local", "nat44-hairpinning",
 				     sw_if_index, 1, 0, 0);
     }
@@ -2088,11 +2056,6 @@
 
     snat_add_del_addr_to_fib(&m->external_addr, 32, sw_if_index, !is_del);
   }));
-
-  pool_foreach (dm, sm->det_maps,
-  ({
-    snat_add_del_addr_to_fib(&dm->out_addr, dm->out_plen, sw_if_index, !is_del);
-  }));
   /* *INDENT-ON* */
 
   return 0;
@@ -2111,8 +2074,7 @@
 						       sw_if_index);
 
 
-  if (sm->deterministic ||
-      (sm->static_mapping_only && !(sm->static_mapping_connection_tracking)))
+  if (sm->static_mapping_only && !(sm->static_mapping_connection_tracking))
     return VNET_API_ERROR_UNSUPPORTED;
 
   /* *INDENT-OFF* */
@@ -2551,11 +2513,6 @@
   node = vlib_get_node_by_name (vm, (u8 *) "nat44-ed-out2in-slowpath");
   sm->ed_out2in_slowpath_node_index = node->index;
 
-  node = vlib_get_node_by_name (vm, (u8 *) "nat44-det-in2out");
-  sm->det_in2out_node_index = node->index;
-  node = vlib_get_node_by_name (vm, (u8 *) "nat44-det-out2in");
-  sm->det_out2in_node_index = node->index;
-
   node = vlib_get_node_by_name (vm, (u8 *) "nat44-hairpinning");
   sm->hairpinning_node_index = node->index;
   node = vlib_get_node_by_name (vm, (u8 *) "nat44-hairpin-dst");
@@ -4006,7 +3963,6 @@
   u32 tcp_transitory_timeout = SNAT_TCP_TRANSITORY_TIMEOUT;
   u32 tcp_established_timeout = SNAT_TCP_ESTABLISHED_TIMEOUT;
 
-  sm->deterministic = 0;
   sm->out2in_dpo = 0;
   sm->endpoint_dependent = 0;
 
@@ -4047,8 +4003,6 @@
 	  if (unformat (input, "connection tracking"))
 	    static_mapping_connection_tracking = 1;
 	}
-      else if (unformat (input, "deterministic"))
-	sm->deterministic = 1;
       else if (unformat (input, "nat64 bib hash buckets %d",
 			 &nat64_bib_buckets))
 	;
@@ -4070,15 +4024,11 @@
 				  format_unformat_error, input);
     }
 
-  if (sm->deterministic && sm->endpoint_dependent)
-    return clib_error_return (0,
-			      "deterministic and endpoint-dependent modes are mutually exclusive");
-
-  if (static_mapping_only && (sm->deterministic || sm->endpoint_dependent))
+  if (static_mapping_only && (sm->endpoint_dependent))
     return clib_error_return (0,
 			      "static mapping only mode available only for simple nat");
 
-  if (sm->out2in_dpo && (sm->deterministic || sm->endpoint_dependent))
+  if (sm->out2in_dpo && (sm->endpoint_dependent))
     return clib_error_return (0,
 			      "out2in dpo mode available only for simple nat");
   if (sm->endpoint_dependent && max_users_per_thread > 0)
@@ -4148,79 +4098,67 @@
   nat64_set_hash (nat64_bib_buckets, nat64_bib_memory_size, nat64_st_buckets,
 		  nat64_st_memory_size);
 
-  if (sm->deterministic)
+  if (sm->endpoint_dependent)
     {
-      sm->in2out_node_index = snat_det_in2out_node.index;
-      sm->in2out_output_node_index = ~0;
-      sm->out2in_node_index = snat_det_out2in_node.index;
-      sm->icmp_match_in2out_cb = icmp_match_in2out_det;
-      sm->icmp_match_out2in_cb = icmp_match_out2in_det;
+      sm->worker_in2out_cb = nat44_ed_get_worker_in2out_cb;
+      sm->worker_out2in_cb = nat44_ed_get_worker_out2in_cb;
+
+      sm->in2out_node_index = nat44_ed_in2out_node.index;
+      sm->in2out_output_node_index = nat44_ed_in2out_output_node.index;
+      sm->out2in_node_index = nat44_ed_out2in_node.index;
+
+      sm->icmp_match_in2out_cb = icmp_match_in2out_ed;
+      sm->icmp_match_out2in_cb = icmp_match_out2in_ed;
+      nat_affinity_init (vm);
+      nat_ha_init (vm, nat_ha_sadd_ed_cb, nat_ha_sdel_ed_cb,
+		   nat_ha_sref_ed_cb);
+      clib_bihash_init_16_8 (&sm->out2in_ed, "out2in-ed",
+			     clib_max (1, sm->num_workers) *
+			     sm->translation_buckets,
+			     clib_max (1, sm->num_workers) *
+			     sm->translation_memory_size);
+      clib_bihash_set_kvp_format_fn_16_8 (&sm->out2in_ed,
+					  format_ed_session_kvp);
     }
   else
     {
-      if (sm->endpoint_dependent)
-	{
-	  sm->worker_in2out_cb = nat44_ed_get_worker_in2out_cb;
-	  sm->worker_out2in_cb = nat44_ed_get_worker_out2in_cb;
+      sm->worker_in2out_cb = snat_get_worker_in2out_cb;
+      sm->worker_out2in_cb = snat_get_worker_out2in_cb;
 
-	  sm->in2out_node_index = nat44_ed_in2out_node.index;
-	  sm->in2out_output_node_index = nat44_ed_in2out_output_node.index;
-	  sm->out2in_node_index = nat44_ed_out2in_node.index;
+      sm->in2out_node_index = snat_in2out_node.index;
+      sm->in2out_output_node_index = snat_in2out_output_node.index;
+      sm->out2in_node_index = snat_out2in_node.index;
 
-	  sm->icmp_match_in2out_cb = icmp_match_in2out_ed;
-	  sm->icmp_match_out2in_cb = icmp_match_out2in_ed;
-	  nat_affinity_init (vm);
-	  nat_ha_init (vm, nat_ha_sadd_ed_cb, nat_ha_sdel_ed_cb,
-		       nat_ha_sref_ed_cb);
-	  clib_bihash_init_16_8 (&sm->out2in_ed, "out2in-ed",
-				 clib_max (1, sm->num_workers) *
-				 sm->translation_buckets,
-				 clib_max (1, sm->num_workers) *
-				 sm->translation_memory_size);
-	  clib_bihash_set_kvp_format_fn_16_8 (&sm->out2in_ed,
-					      format_ed_session_kvp);
-	}
-      else
-	{
-	  sm->worker_in2out_cb = snat_get_worker_in2out_cb;
-	  sm->worker_out2in_cb = snat_get_worker_out2in_cb;
-
-	  sm->in2out_node_index = snat_in2out_node.index;
-	  sm->in2out_output_node_index = snat_in2out_output_node.index;
-	  sm->out2in_node_index = snat_out2in_node.index;
-
-	  sm->icmp_match_in2out_cb = icmp_match_in2out_slow;
-	  sm->icmp_match_out2in_cb = icmp_match_out2in_slow;
-	  nat_ha_init (vm, nat_ha_sadd_cb, nat_ha_sdel_cb, nat_ha_sref_cb);
-	}
-      if (!static_mapping_only ||
-	  (static_mapping_only && static_mapping_connection_tracking))
-	{
+      sm->icmp_match_in2out_cb = icmp_match_in2out_slow;
+      sm->icmp_match_out2in_cb = icmp_match_out2in_slow;
+      nat_ha_init (vm, nat_ha_sadd_cb, nat_ha_sdel_cb, nat_ha_sref_cb);
+    }
+  if (!static_mapping_only ||
+      (static_mapping_only && static_mapping_connection_tracking))
+    {
           /* *INDENT-OFF* */
           vec_foreach (tsm, sm->per_thread_data)
             {
               nat44_db_init (tsm);
             }
           /* *INDENT-ON* */
-	}
-      else
-	{
-	  sm->icmp_match_in2out_cb = icmp_match_in2out_fast;
-	  sm->icmp_match_out2in_cb = icmp_match_out2in_fast;
-	}
-      clib_bihash_init_8_8 (&sm->static_mapping_by_local,
-			    "static_mapping_by_local", static_mapping_buckets,
-			    static_mapping_memory_size);
-      clib_bihash_set_kvp_format_fn_8_8 (&sm->static_mapping_by_local,
-					 format_static_mapping_kvp);
-
-      clib_bihash_init_8_8 (&sm->static_mapping_by_external,
-			    "static_mapping_by_external",
-			    static_mapping_buckets,
-			    static_mapping_memory_size);
-      clib_bihash_set_kvp_format_fn_8_8 (&sm->static_mapping_by_external,
-					 format_static_mapping_kvp);
     }
+  else
+    {
+      sm->icmp_match_in2out_cb = icmp_match_in2out_fast;
+      sm->icmp_match_out2in_cb = icmp_match_out2in_fast;
+    }
+  clib_bihash_init_8_8 (&sm->static_mapping_by_local,
+			"static_mapping_by_local", static_mapping_buckets,
+			static_mapping_memory_size);
+  clib_bihash_set_kvp_format_fn_8_8 (&sm->static_mapping_by_local,
+				     format_static_mapping_kvp);
+
+  clib_bihash_init_8_8 (&sm->static_mapping_by_external,
+			"static_mapping_by_external",
+			static_mapping_buckets, static_mapping_memory_size);
+  clib_bihash_set_kvp_format_fn_8_8 (&sm->static_mapping_by_external,
+				     format_static_mapping_kvp);
 
   return 0;
 }
diff --git a/src/plugins/nat/nat.h b/src/plugins/nat/nat.h
index 324dc26..ddcf4c9 100644
--- a/src/plugins/nat/nat.h
+++ b/src/plugins/nat/nat.h
@@ -68,21 +68,6 @@
   u32 arc_next_index;
 } nat_pre_trace_t;
 
-/* deterministic session outside key */
-typedef struct
-{
-  union
-  {
-    struct
-    {
-      ip4_address_t ext_host_addr;
-      u16 ext_host_port;
-      u16 out_port;
-    };
-    u64 as_u64;
-  };
-} snat_det_out_key_t;
-
 /* user (internal host) key */
 typedef struct
 {
@@ -308,36 +293,6 @@
 
 typedef struct
 {
-  /* Inside network port */
-  u16 in_port;
-  /* Outside network address and port */
-  snat_det_out_key_t out;
-  /* Session state */
-  u8 state;
-  /* Expire timeout */
-  u32 expire;
-} snat_det_session_t;
-
-typedef struct
-{
-  /* inside IP address range */
-  ip4_address_t in_addr;
-  u8 in_plen;
-  /* outside IP address range */
-  ip4_address_t out_addr;
-  u8 out_plen;
-  /* inside IP addresses / outside IP addresses */
-  u32 sharing_ratio;
-  /* number of ports available to internal host */
-  u16 ports_per_host;
-  /* session counter */
-  u32 ses_num;
-  /* vector of sessions */
-  snat_det_session_t *sessions;
-} snat_det_map_t;
-
-typedef struct
-{
   /* backend IP address */
   ip4_address_t addr;
   /* backend port number */
@@ -590,8 +545,6 @@
   u32 out2in_fast_node_index;
   u32 ed_out2in_node_index;
   u32 ed_out2in_slowpath_node_index;
-  u32 det_in2out_node_index;
-  u32 det_out2in_node_index;
 
   u32 hairpinning_node_index;
   u32 hairpin_dst_node_index;
@@ -600,17 +553,12 @@
   u32 ed_hairpin_dst_node_index;
   u32 ed_hairpin_src_node_index;
 
-
-  /* Deterministic NAT mappings */
-  snat_det_map_t *det_maps;
-
   /* If forwarding is enabled */
   u8 forwarding_enabled;
 
   /* Config parameters */
   u8 static_mapping_only;
   u8 static_mapping_connection_tracking;
-  u8 deterministic;
   u8 out2in_dpo;
   u8 endpoint_dependent;
 
@@ -736,8 +684,6 @@
 extern vlib_node_registration_t snat_in2out_worker_handoff_node;
 extern vlib_node_registration_t snat_in2out_output_worker_handoff_node;
 extern vlib_node_registration_t snat_out2in_worker_handoff_node;
-extern vlib_node_registration_t snat_det_in2out_node;
-extern vlib_node_registration_t snat_det_out2in_node;
 extern vlib_node_registration_t nat44_ed_in2out_node;
 extern vlib_node_registration_t nat44_ed_in2out_output_node;
 extern vlib_node_registration_t nat44_ed_out2in_node;
@@ -750,7 +696,6 @@
 format_function_t format_snat_static_mapping;
 format_function_t format_snat_static_map_to_resolve;
 format_function_t format_snat_session;
-format_function_t format_det_map_ses;
 format_function_t format_snat_key;
 format_function_t format_static_mapping_key;
 format_function_t format_nat_protocol;
@@ -1068,20 +1013,6 @@
 			    nat_protocol_t * proto, void *d, void *e,
 			    u8 * dont_translate);
 
-/* ICMP deterministic NAT session match functions */
-u32 icmp_match_out2in_det (snat_main_t * sm, vlib_node_runtime_t * node,
-			   u32 thread_index, vlib_buffer_t * b0,
-			   ip4_header_t * ip0, ip4_address_t * addr,
-			   u16 * port, u32 * fib_index,
-			   nat_protocol_t * proto, void *d, void *e,
-			   u8 * dont_translate);
-u32 icmp_match_in2out_det (snat_main_t * sm, vlib_node_runtime_t * node,
-			   u32 thread_index, vlib_buffer_t * b0,
-			   ip4_header_t * ip0, ip4_address_t * addr,
-			   u16 * port, u32 * fib_index,
-			   nat_protocol_t * proto, void *d, void *e,
-			   u8 * dont_translate);
-
 /* ICMP endpoint-dependent session match functions */
 u32 icmp_match_out2in_ed (snat_main_t * sm, vlib_node_runtime_t * node,
 			  u32 thread_index, vlib_buffer_t * b0,
diff --git a/src/plugins/nat/nat44/inlines.h b/src/plugins/nat/nat44/inlines.h
index 8bfc740..459bada 100644
--- a/src/plugins/nat/nat44/inlines.h
+++ b/src/plugins/nat/nat44/inlines.h
@@ -100,7 +100,7 @@
   snat_user_key_t user_key;
   clib_bihash_kv_8_8_t kv, value;
 
-  if (sm->deterministic || sm->endpoint_dependent)
+  if (sm->endpoint_dependent)
     return rv;
 
   user_key.addr.as_u32 = addr->as_u32;
diff --git a/src/plugins/nat/nat44_classify.c b/src/plugins/nat/nat44_classify.c
index a239c67..6cdb577 100644
--- a/src/plugins/nat/nat44_classify.c
+++ b/src/plugins/nat/nat44_classify.c
@@ -458,28 +458,6 @@
 };
 /* *INDENT-ON* */
 
-VLIB_NODE_FN (nat44_det_classify_node) (vlib_main_t * vm,
-					vlib_node_runtime_t * node,
-					vlib_frame_t * frame)
-{
-  return nat44_classify_node_fn_inline (vm, node, frame);
-}
-
-/* *INDENT-OFF* */
-VLIB_REGISTER_NODE (nat44_det_classify_node) = {
-  .name = "nat44-det-classify",
-  .vector_size = sizeof (u32),
-  .format_trace = format_nat44_classify_trace,
-  .type = VLIB_NODE_TYPE_INTERNAL,
-  .n_next_nodes = NAT44_CLASSIFY_N_NEXT,
-  .next_nodes = {
-    [NAT44_CLASSIFY_NEXT_IN2OUT] = "nat44-det-in2out",
-    [NAT44_CLASSIFY_NEXT_OUT2IN] = "nat44-det-out2in",
-    [NAT44_CLASSIFY_NEXT_DROP] = "error-drop",
-  },
-};
-/* *INDENT-ON* */
-
 VLIB_NODE_FN (nat44_handoff_classify_node) (vlib_main_t * vm,
 					    vlib_node_runtime_t * node,
 					    vlib_frame_t * frame)
diff --git a/src/plugins/nat/nat44_cli.c b/src/plugins/nat/nat44_cli.c
index 7d74f36..64529af 100644
--- a/src/plugins/nat/nat44_cli.c
+++ b/src/plugins/nat/nat44_cli.c
@@ -19,7 +19,6 @@
 
 #include <nat/nat.h>
 #include <nat/nat_ipfix_logging.h>
-#include <nat/nat_det.h>
 #include <nat/nat64.h>
 #include <nat/nat_inlines.h>
 #include <nat/nat44/inlines.h>
@@ -27,31 +26,20 @@
 #include <vnet/fib/fib_table.h>
 #include <nat/nat_ha.h>
 
-
-#define UNSUPPORTED_IN_DET_OR_ED_MODE_STR \
-  "This command is unsupported in deterministic or endpoint dependent mode"
-#define UNSUPPORTED_IN_DET_OR_NON_ED_MODE_STR \
-  "This command is unsupported in deterministic or non endpoint dependent mode"
-#define UNSUPPORTED_IN_DET_MODE_STR \
-  "This command is unsupported in deterministic mode"
+#define UNSUPPORTED_IN_ED_MODE_STR \
+  "This command is unsupported in endpoint dependent mode"
 #define SUPPORTED_ONLY_IN_ED_MODE_STR \
   "This command is supported only in endpoint dependent mode"
-#define SUPPORTED_ONLY_IN_DET_MODE_STR \
-  "This command is supported only in deterministic mode"
 
 static clib_error_t *
 set_workers_command_fn (vlib_main_t * vm,
 			unformat_input_t * input, vlib_cli_command_t * cmd)
 {
   unformat_input_t _line_input, *line_input = &_line_input;
-  snat_main_t *sm = &snat_main;
   uword *bitmap = 0;
   int rv = 0;
   clib_error_t *error = 0;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -104,9 +92,6 @@
   snat_main_t *sm = &snat_main;
   u32 *worker;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   if (sm->num_workers > 1)
     {
       vlib_cli_output (vm, "%d workers", vec_len (sm->workers));
@@ -272,13 +257,9 @@
 					      vlib_cli_command_t * cmd)
 {
   unformat_input_t _line_input, *line_input = &_line_input;
-  snat_main_t *sm = &snat_main;
   clib_error_t *error = 0;
   u32 psid, psid_offset, psid_length, port_start, port_end;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -328,9 +309,6 @@
 {
   snat_main_t *sm = &snat_main;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   vlib_cli_output (vm, "NAT address and port: %U",
 		   format_nat_addr_and_port_alloc_alg,
 		   sm->addr_and_port_alloc_alg);
@@ -550,9 +528,6 @@
   clib_error_t *error = 0;
   u8 twice_nat = 0;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -651,8 +626,8 @@
   snat_main_t *sm = &snat_main;
   snat_session_t *s;
 
-  if (sm->deterministic || !sm->endpoint_dependent)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_OR_NON_ED_MODE_STR);
+  if (!sm->endpoint_dependent)
+    return clib_error_return (0, SUPPORTED_ONLY_IN_ED_MODE_STR);
 
   vlib_cli_output (vm, "max translations per thread: %u",
 		   sm->max_translations_per_thread);
@@ -813,9 +788,6 @@
   snat_main_t *sm = &snat_main;
   snat_address_t *ap;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   vlib_cli_output (vm, "NAT44 pool addresses:");
   /* *INDENT-OFF* */
   vec_foreach (ap, sm->addresses)
@@ -998,7 +970,6 @@
 			       vlib_cli_command_t * cmd)
 {
   unformat_input_t _line_input, *line_input = &_line_input;
-  snat_main_t *sm = &snat_main;
   clib_error_t *error = 0;
   ip4_address_t l_addr, e_addr;
   u32 l_port = 0, e_port = 0, vrf_id = ~0;
@@ -1012,9 +983,6 @@
   twice_nat_type_t twice_nat = TWICE_NAT_DISABLED;
   u8 out2in_only = 0;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -1126,7 +1094,6 @@
 				 vlib_cli_command_t * cmd)
 {
   unformat_input_t _line_input, *line_input = &_line_input;
-  snat_main_t *sm = &snat_main;
   clib_error_t *error = 0;
   ip4_address_t addr;
   u32 port = 0, vrf_id = ~0;
@@ -1137,9 +1104,6 @@
   int rv;
   nat_protocol_t proto;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   addr.as_u32 = 0;
 
   /* Get a line of input. */
@@ -1206,7 +1170,6 @@
 				  vlib_cli_command_t * cmd)
 {
   unformat_input_t _line_input, *line_input = &_line_input;
-  snat_main_t *sm = &snat_main;
   clib_error_t *error = 0;
   ip4_address_t l_addr, e_addr;
   u32 l_port = 0, e_port = 0, vrf_id = 0, probability = 0, affinity = 0;
@@ -1218,9 +1181,6 @@
   twice_nat_type_t twice_nat = TWICE_NAT_DISABLED;
   u8 out2in_only = 0;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -1321,7 +1281,6 @@
 			   unformat_input_t * input, vlib_cli_command_t * cmd)
 {
   unformat_input_t _line_input, *line_input = &_line_input;
-  snat_main_t *sm = &snat_main;
   clib_error_t *error = 0;
   ip4_address_t l_addr, e_addr;
   u32 l_port = 0, e_port = 0, vrf_id = 0, probability = 0;
@@ -1330,9 +1289,6 @@
   nat_protocol_t proto;
   u8 proto_set = 0;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -1417,9 +1373,6 @@
   snat_static_mapping_t *m;
   snat_static_map_resolve_t *rp;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   vlib_cli_output (vm, "NAT44 static mappings:");
   /* *INDENT-OFF* */
   pool_foreach (m, sm->static_mappings,
@@ -1446,9 +1399,6 @@
   clib_error_t *error = 0;
   u8 twice_nat = 0;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -1498,9 +1448,6 @@
   vnet_main_t *vnm = vnet_get_main ();
   u32 *sw_if_index;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   /* *INDENT-OFF* */
   vlib_cli_output (vm, "NAT44 pool address interfaces:");
   vec_foreach (sw_if_index, sm->auto_add_sw_if_indices)
@@ -1532,9 +1479,6 @@
   int detail = 0;
   int i = 0;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   if (!unformat_user (input, unformat_line_input, line_input))
     goto print;
 
@@ -1592,15 +1536,11 @@
 				    unformat_input_t * input,
 				    vlib_cli_command_t * cmd)
 {
-  snat_main_t *sm = &snat_main;
   unformat_input_t _line_input, *line_input = &_line_input;
   clib_error_t *error = 0;
 
   u32 session_limit = 0, vrf_id = 0;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -1641,8 +1581,8 @@
   u32 fib_index = 0;
   int rv;
 
-  if (sm->deterministic || sm->endpoint_dependent)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_OR_ED_MODE_STR);
+  if (sm->endpoint_dependent)
+    return clib_error_return (0, UNSUPPORTED_IN_ED_MODE_STR);
 
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
@@ -1680,12 +1620,7 @@
 				 unformat_input_t * input,
 				 vlib_cli_command_t * cmd)
 {
-  snat_main_t *sm = &snat_main;
   clib_error_t *error = 0;
-
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   nat44_sessions_clear ();
   return error;
 }
@@ -1704,9 +1639,6 @@
   nat_protocol_t proto;
   int rv;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
     return 0;
@@ -1779,9 +1711,6 @@
   u8 forwarding_enable_set = 0;
   clib_error_t *error = 0;
 
-  if (sm->deterministic)
-    return clib_error_return (0, UNSUPPORTED_IN_DET_MODE_STR);
-
   /* Get a line of input. */
   if (!unformat_user (input, unformat_line_input, line_input))
     return clib_error_return (0, "'enable' or 'disable' expected");
@@ -1821,193 +1750,6 @@
 }
 
 static clib_error_t *
-snat_det_map_command_fn (vlib_main_t * vm,
-			 unformat_input_t * input, vlib_cli_command_t * cmd)
-{
-  snat_main_t *sm = &snat_main;
-  unformat_input_t _line_input, *line_input = &_line_input;
-  ip4_address_t in_addr, out_addr;
-  u32 in_plen, out_plen;
-  int is_add = 1, rv;
-  clib_error_t *error = 0;
-
-  if (!sm->deterministic)
-    return clib_error_return (0, SUPPORTED_ONLY_IN_DET_MODE_STR);
-
-  /* Get a line of input. */
-  if (!unformat_user (input, unformat_line_input, line_input))
-    return 0;
-
-  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
-    {
-      if (unformat
-	  (line_input, "in %U/%u", unformat_ip4_address, &in_addr, &in_plen))
-	;
-      else
-	if (unformat
-	    (line_input, "out %U/%u", unformat_ip4_address, &out_addr,
-	     &out_plen))
-	;
-      else if (unformat (line_input, "del"))
-	is_add = 0;
-      else
-	{
-	  error = clib_error_return (0, "unknown input '%U'",
-				     format_unformat_error, line_input);
-	  goto done;
-	}
-    }
-
-  if (in_plen > 32 || out_plen > 32)
-    {
-      error = clib_error_return (0, "network prefix length must be <= 32");
-      goto done;
-    }
-
-  rv = snat_det_add_map (sm, &in_addr, in_plen, &out_addr, out_plen, is_add);
-
-  if (rv)
-    {
-      error = clib_error_return (0, "snat_det_add_map return %d", rv);
-      goto done;
-    }
-
-done:
-  unformat_free (line_input);
-
-  return error;
-}
-
-static clib_error_t *
-nat44_det_show_mappings_command_fn (vlib_main_t * vm,
-				    unformat_input_t * input,
-				    vlib_cli_command_t * cmd)
-{
-  snat_main_t *sm = &snat_main;
-  snat_det_map_t *dm;
-
-  if (!sm->deterministic)
-    return clib_error_return (0, SUPPORTED_ONLY_IN_DET_MODE_STR);
-
-  vlib_cli_output (vm, "NAT44 deterministic mappings:");
-  /* *INDENT-OFF* */
-  pool_foreach (dm, sm->det_maps,
-  ({
-    vlib_cli_output (vm, " in %U/%d out %U/%d\n",
-                     format_ip4_address, &dm->in_addr, dm->in_plen,
-                     format_ip4_address, &dm->out_addr, dm->out_plen);
-    vlib_cli_output (vm, "  outside address sharing ratio: %d\n",
-                     dm->sharing_ratio);
-    vlib_cli_output (vm, "  number of ports per inside host: %d\n",
-                     dm->ports_per_host);
-    vlib_cli_output (vm, "  sessions number: %d\n", dm->ses_num);
-  }));
-  /* *INDENT-ON* */
-
-  return 0;
-}
-
-static clib_error_t *
-snat_det_forward_command_fn (vlib_main_t * vm,
-			     unformat_input_t * input,
-			     vlib_cli_command_t * cmd)
-{
-  snat_main_t *sm = &snat_main;
-  unformat_input_t _line_input, *line_input = &_line_input;
-  ip4_address_t in_addr, out_addr;
-  u16 lo_port;
-  snat_det_map_t *dm;
-  clib_error_t *error = 0;
-
-  if (!sm->deterministic)
-    return clib_error_return (0, SUPPORTED_ONLY_IN_DET_MODE_STR);
-
-  /* Get a line of input. */
-  if (!unformat_user (input, unformat_line_input, line_input))
-    return 0;
-
-  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
-    {
-      if (unformat (line_input, "%U", unformat_ip4_address, &in_addr))
-	;
-      else
-	{
-	  error = clib_error_return (0, "unknown input '%U'",
-				     format_unformat_error, line_input);
-	  goto done;
-	}
-    }
-
-  dm = snat_det_map_by_user (sm, &in_addr);
-  if (!dm)
-    vlib_cli_output (vm, "no match");
-  else
-    {
-      snat_det_forward (dm, &in_addr, &out_addr, &lo_port);
-      vlib_cli_output (vm, "%U:<%d-%d>", format_ip4_address, &out_addr,
-		       lo_port, lo_port + dm->ports_per_host - 1);
-    }
-
-done:
-  unformat_free (line_input);
-
-  return error;
-}
-
-static clib_error_t *
-snat_det_reverse_command_fn (vlib_main_t * vm,
-			     unformat_input_t * input,
-			     vlib_cli_command_t * cmd)
-{
-  snat_main_t *sm = &snat_main;
-  unformat_input_t _line_input, *line_input = &_line_input;
-  ip4_address_t in_addr, out_addr;
-  u32 out_port;
-  snat_det_map_t *dm;
-  clib_error_t *error = 0;
-
-  if (!sm->deterministic)
-    return clib_error_return (0, SUPPORTED_ONLY_IN_DET_MODE_STR);
-
-  /* Get a line of input. */
-  if (!unformat_user (input, unformat_line_input, line_input))
-    return 0;
-
-  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
-    {
-      if (unformat
-	  (line_input, "%U:%d", unformat_ip4_address, &out_addr, &out_port))
-	;
-      else
-	{
-	  error = clib_error_return (0, "unknown input '%U'",
-				     format_unformat_error, line_input);
-	  goto done;
-	}
-    }
-
-  if (out_port < 1024 || out_port > 65535)
-    {
-      error = clib_error_return (0, "wrong port, must be <1024-65535>");
-      goto done;
-    }
-
-  dm = snat_det_map_by_out (sm, &out_addr);
-  if (!dm)
-    vlib_cli_output (vm, "no match");
-  else
-    {
-      snat_det_reverse (dm, &out_addr, (u16) out_port, &in_addr);
-      vlib_cli_output (vm, "%U", format_ip4_address, &in_addr);
-    }
-
-done:
-  unformat_free (line_input);
-
-  return error;
-}
-
-static clib_error_t *
 set_timeout_command_fn (vlib_main_t * vm,
 			unformat_input_t * input, vlib_cli_command_t * cmd)
 {
@@ -2100,150 +1842,6 @@
   return 0;
 }
 
-static clib_error_t *
-nat44_det_show_sessions_command_fn (vlib_main_t * vm,
-				    unformat_input_t * input,
-				    vlib_cli_command_t * cmd)
-{
-  snat_main_t *sm = &snat_main;
-  snat_det_map_t *dm;
-  snat_det_session_t *ses;
-  int i;
-
-  if (!sm->deterministic)
-    return clib_error_return (0, SUPPORTED_ONLY_IN_DET_MODE_STR);
-
-  vlib_cli_output (vm, "NAT44 deterministic sessions:");
-  /* *INDENT-OFF* */
-  pool_foreach (dm, sm->det_maps,
-  ({
-    vec_foreach_index (i, dm->sessions)
-      {
-        ses = vec_elt_at_index (dm->sessions, i);
-        if (ses->in_port)
-          vlib_cli_output (vm, "  %U", format_det_map_ses, dm, ses, &i);
-      }
-  }));
-  /* *INDENT-ON* */
-  return 0;
-}
-
-static clib_error_t *
-snat_det_close_session_out_fn (vlib_main_t * vm,
-			       unformat_input_t * input,
-			       vlib_cli_command_t * cmd)
-{
-  snat_main_t *sm = &snat_main;
-  unformat_input_t _line_input, *line_input = &_line_input;
-  ip4_address_t out_addr, ext_addr, in_addr;
-  u32 out_port, ext_port;
-  snat_det_map_t *dm;
-  snat_det_session_t *ses;
-  snat_det_out_key_t key;
-  clib_error_t *error = 0;
-
-  if (!sm->deterministic)
-    return clib_error_return (0, SUPPORTED_ONLY_IN_DET_MODE_STR);
-
-  /* Get a line of input. */
-  if (!unformat_user (input, unformat_line_input, line_input))
-    return 0;
-
-  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
-    {
-      if (unformat (line_input, "%U:%d %U:%d",
-		    unformat_ip4_address, &out_addr, &out_port,
-		    unformat_ip4_address, &ext_addr, &ext_port))
-	;
-      else
-	{
-	  error = clib_error_return (0, "unknown input '%U'",
-				     format_unformat_error, line_input);
-	  goto done;
-	}
-    }
-
-  unformat_free (line_input);
-
-  dm = snat_det_map_by_out (sm, &out_addr);
-  if (!dm)
-    vlib_cli_output (vm, "no match");
-  else
-    {
-      snat_det_reverse (dm, &ext_addr, (u16) out_port, &in_addr);
-      key.ext_host_addr = out_addr;
-      key.ext_host_port = ntohs ((u16) ext_port);
-      key.out_port = ntohs ((u16) out_port);
-      ses = snat_det_get_ses_by_out (dm, &out_addr, key.as_u64);
-      if (!ses)
-	vlib_cli_output (vm, "no match");
-      else
-	snat_det_ses_close (dm, ses);
-    }
-
-done:
-  unformat_free (line_input);
-
-  return error;
-}
-
-static clib_error_t *
-snat_det_close_session_in_fn (vlib_main_t * vm,
-			      unformat_input_t * input,
-			      vlib_cli_command_t * cmd)
-{
-  snat_main_t *sm = &snat_main;
-  unformat_input_t _line_input, *line_input = &_line_input;
-  ip4_address_t in_addr, ext_addr;
-  u32 in_port, ext_port;
-  snat_det_map_t *dm;
-  snat_det_session_t *ses;
-  snat_det_out_key_t key;
-  clib_error_t *error = 0;
-
-  if (!sm->deterministic)
-    return clib_error_return (0, SUPPORTED_ONLY_IN_DET_MODE_STR);
-
-  /* Get a line of input. */
-  if (!unformat_user (input, unformat_line_input, line_input))
-    return 0;
-
-  while (unformat_check_input (line_input) != UNFORMAT_END_OF_INPUT)
-    {
-      if (unformat (line_input, "%U:%d %U:%d",
-		    unformat_ip4_address, &in_addr, &in_port,
-		    unformat_ip4_address, &ext_addr, &ext_port))
-	;
-      else
-	{
-	  error = clib_error_return (0, "unknown input '%U'",
-				     format_unformat_error, line_input);
-	  goto done;
-	}
-    }
-
-  unformat_free (line_input);
-
-  dm = snat_det_map_by_user (sm, &in_addr);
-  if (!dm)
-    vlib_cli_output (vm, "no match");
-  else
-    {
-      key.ext_host_addr = ext_addr;
-      key.ext_host_port = ntohs ((u16) ext_port);
-      ses =
-	snat_det_find_ses_by_in (dm, &in_addr, ntohs ((u16) in_port), key);
-      if (!ses)
-	vlib_cli_output (vm, "no match");
-      else
-	snat_det_ses_close (dm, ses);
-    }
-
-done:
-  unformat_free (line_input);
-
-  return error;
-}
 /* *INDENT-OFF* */
 
 /*?
@@ -2281,7 +1879,7 @@
  * Set values of timeouts for NAT sessions (in seconds), use:
  *  vpp# set nat timeout udp 120 tcp-established 7500 tcp-transitory 250 icmp 90
  * To reset default values use:
- *  vpp# set nat44 deterministic timeout reset
+ *  vpp# set nat timeout reset
  * @cliexend
 ?*/
 VLIB_CLI_COMMAND (set_timeout_command, static) = {
@@ -2780,119 +2378,6 @@
   .function = snat_forwarding_set_command_fn,
 };
 
-/*?
- * @cliexpar
- * @cliexstart{nat44 deterministic add}
- * Create bijective mapping of inside address to outside address and port range
- * pairs, with the purpose of enabling deterministic NAT to reduce logging in
- * CGN deployments.
- * To create deterministic mapping between inside network 10.0.0.0/18 and
- * outside network 1.1.1.0/30 use:
- * # vpp# nat44 deterministic add in 10.0.0.0/18 out 1.1.1.0/30
- * @cliexend
-?*/
-VLIB_CLI_COMMAND (snat_det_map_command, static) = {
-    .path = "nat44 deterministic add",
-    .short_help = "nat44 deterministic add in <addr>/<plen> out <addr>/<plen> [del]",
-    .function = snat_det_map_command_fn,
-};
-
-/*?
- * @cliexpar
- * @cliexpstart{show nat44 deterministic mappings}
- * Show NAT44 deterministic mappings
- * vpp# show nat44 deterministic mappings
- * NAT44 deterministic mappings:
- *  in 10.0.0.0/24 out 1.1.1.1/32
- *   outside address sharing ratio: 256
- *   number of ports per inside host: 252
- *   sessions number: 0
- * @cliexend
-?*/
-VLIB_CLI_COMMAND (nat44_det_show_mappings_command, static) = {
-    .path = "show nat44 deterministic mappings",
-    .short_help = "show nat44 deterministic mappings",
-    .function = nat44_det_show_mappings_command_fn,
-};
-
-/*?
- * @cliexpar
- * @cliexstart{nat44 deterministic forward}
- * Return outside address and port range from inside address for deterministic
- * NAT.
- * To obtain outside address and port of inside host use:
- *  vpp# nat44 deterministic forward 10.0.0.2
- *  1.1.1.0:<1054-1068>
- * @cliexend
-?*/
-VLIB_CLI_COMMAND (snat_det_forward_command, static) = {
-    .path = "nat44 deterministic forward",
-    .short_help = "nat44 deterministic forward <addr>",
-    .function = snat_det_forward_command_fn,
-};
-
-/*?
- * @cliexpar
- * @cliexstart{nat44 deterministic reverse}
- * Return inside address from outside address and port for deterministic NAT.
- * To obtain inside host address from outside address and port use:
- *  #vpp nat44 deterministic reverse 1.1.1.1:1276
- *  10.0.16.16
- * @cliexend
-?*/
-VLIB_CLI_COMMAND (snat_det_reverse_command, static) = {
-    .path = "nat44 deterministic reverse",
-    .short_help = "nat44 deterministic reverse <addr>:<port>",
-    .function = snat_det_reverse_command_fn,
-};
-
-/*?
- * @cliexpar
- * @cliexstart{show nat44 deterministic sessions}
- * Show NAT44 deterministic sessions.
- * vpp# show nat44 deterministic sessions
- * NAT44 deterministic sessions:
- *   in 10.0.0.3:3005 out 1.1.1.2:1146 external host 172.16.1.2:3006 state: udp-active expire: 306
- *   in 10.0.0.3:3000 out 1.1.1.2:1141 external host 172.16.1.2:3001 state: udp-active expire: 306
- *   in 10.0.0.4:3005 out 1.1.1.2:1177 external host 172.16.1.2:3006 state: udp-active expire: 306
- * @cliexend
-?*/
-VLIB_CLI_COMMAND (nat44_det_show_sessions_command, static) = {
-  .path = "show nat44 deterministic sessions",
-  .short_help = "show nat44 deterministic sessions",
-  .function = nat44_det_show_sessions_command_fn,
-};
-
-/*?
- * @cliexpar
- * @cliexstart{nat44 deterministic close session out}
- * Close session using outside ip address and port
- * and external ip address and port, use:
- *  vpp# nat44 deterministic close session out 1.1.1.1:1276 2.2.2.2:2387
- * @cliexend
-?*/
-VLIB_CLI_COMMAND (snat_det_close_sesion_out_command, static) = {
-  .path = "nat44 deterministic close session out",
-  .short_help = "nat44 deterministic close session out "
-                "<out_addr>:<out_port> <ext_addr>:<ext_port>",
-  .function = snat_det_close_session_out_fn,
-};
-
-/*?
- * @cliexpar
- * @cliexstart{nat44 deterministic close session in}
- * Close session using inside ip address and port
- * and external ip address and port, use:
- *  vpp# nat44 deterministic close session in 3.3.3.3:3487 2.2.2.2:2387
- * @cliexend
-?*/
-VLIB_CLI_COMMAND (snat_det_close_session_in_command, static) = {
-  .path = "nat44 deterministic close session in",
-  .short_help = "nat44 deterministic close session in "
-                "<in_addr>:<in_port> <ext_addr>:<ext_port>",
-  .function = snat_det_close_session_in_fn,
-};
-
 /* *INDENT-ON* */
 
 /*
diff --git a/src/plugins/nat/nat_api.c b/src/plugins/nat/nat_api.c
index b447395..5031432 100644
--- a/src/plugins/nat/nat_api.c
+++ b/src/plugins/nat/nat_api.c
@@ -19,7 +19,6 @@
  */
 
 #include <nat/nat.h>
-#include <nat/nat_det.h>
 #include <nat/nat64.h>
 #include <nat/nat_inlines.h>
 #include <nat/nat44/inlines.h>
@@ -31,6 +30,7 @@
 #include <vnet/fib/fib_table.h>
 #include <vnet/ip/ip_types_api.h>
 #include <nat/nat44/ed_inlines.h>
+#include <nat/nat_ipfix_logging.h>
 
 #define vl_api_nat44_add_del_lb_static_mapping_t_endian vl_noop_handler
 #define vl_api_nat44_nat44_lb_static_mapping_details_t_endian vl_noop_handler
@@ -113,7 +113,7 @@
     rmp->static_mapping_only = sm->static_mapping_only;
     rmp->static_mapping_connection_tracking =
       sm->static_mapping_connection_tracking;
-    rmp->deterministic = sm->deterministic;
+    rmp->deterministic = 0;
     rmp->endpoint_dependent = sm->endpoint_dependent;
     rmp->out2in_dpo = sm->out2in_dpo;
     //rmp->dslite_ce = dm->is_ce;
@@ -144,12 +144,6 @@
   uword *bitmap = 0;
   u64 mask;
 
-  if (sm->deterministic)
-    {
-      rv = VNET_API_ERROR_UNSUPPORTED;
-      goto send_reply;
-    }
-
   mask = clib_net_to_host_u64 (mp->worker_mask);
 
   if (sm->num_workers < 2)
@@ -218,9 +212,6 @@
   snat_main_t *sm = &snat_main;
   u32 *worker_index;
 
-  if (sm->deterministic)
-    return;
-
   reg = vl_api_client_index_to_registration (mp->client_index);
   if (!reg)
     return;
@@ -406,12 +397,6 @@
   int rv = 0;
   u16 port_start, port_end;
 
-  if (sm->deterministic)
-    {
-      rv = VNET_API_ERROR_UNSUPPORTED;
-      goto send_reply;
-    }
-
   switch (mp->alg)
     {
     case NAT_ADDR_AND_PORT_ALLOC_ALG_DEFAULT:
@@ -776,12 +761,6 @@
   int rv = 0;
   u32 *tmp;
 
-  if (sm->deterministic)
-    {
-      rv = VNET_API_ERROR_UNSUPPORTED;
-      goto send_reply;
-    }
-
   if (sm->static_mapping_only)
     {
       rv = VNET_API_ERROR_FEATURE_DISABLED;
@@ -875,9 +854,6 @@
   snat_main_t *sm = &snat_main;
   snat_address_t *a;
 
-  if (sm->deterministic)
-    return;
-
   reg = vl_api_client_index_to_registration (mp->client_index);
   if (!reg)
     return;
@@ -999,12 +975,6 @@
   u32 sw_if_index = ntohl (mp->sw_if_index);
   int rv = 0;
 
-  if (sm->deterministic)
-    {
-      rv = VNET_API_ERROR_UNSUPPORTED;
-      goto send_reply;
-    }
-
   VALIDATE_SW_IF_INDEX (mp);
 
   rv = snat_interface_add_del_output_feature (sw_if_index,
@@ -1012,7 +982,6 @@
 					      !mp->is_add);
 
   BAD_SW_IF_INDEX_LABEL;
-send_reply:
   REPLY_MACRO (VL_API_NAT44_INTERFACE_ADD_DEL_OUTPUT_FEATURE_REPLY);
 }
 
@@ -1059,9 +1028,6 @@
   snat_main_t *sm = &snat_main;
   snat_interface_t *i;
 
-  if (sm->deterministic)
-    return;
-
   reg = vl_api_client_index_to_registration (mp->client_index);
   if (!reg)
     return;
@@ -1098,12 +1064,6 @@
   nat_protocol_t proto;
   u8 *tag = 0;
 
-  if (sm->deterministic)
-    {
-      rv = VNET_API_ERROR_UNSUPPORTED;
-      goto send_reply;
-    }
-
   memcpy (&local_addr.as_u8, mp->local_ip_address, 4);
   memcpy (&external_addr.as_u8, mp->external_ip_address, 4);
 
@@ -1133,7 +1093,6 @@
 				mp->flags & NAT_API_IS_OUT2IN_ONLY, tag, 0);
   vec_free (tag);
 
-send_reply:
   REPLY_MACRO (VL_API_NAT44_ADD_DEL_STATIC_MAPPING_REPLY);
 }
 
@@ -1256,9 +1215,6 @@
   snat_static_map_resolve_t *rp;
   int j;
 
-  if (sm->deterministic)
-    return;
-
   reg = vl_api_client_index_to_registration (mp->client_index);
   if (!reg)
     return;
@@ -1303,12 +1259,6 @@
   nat_protocol_t proto = NAT_PROTOCOL_OTHER;
   u8 *tag = 0;
 
-  if (sm->deterministic)
-    {
-      rv = VNET_API_ERROR_UNSUPPORTED;
-      goto send_reply;
-    }
-
   if (!(mp->flags & NAT_API_IS_ADDR_ONLY))
     {
       port = mp->port;
@@ -1330,7 +1280,6 @@
 			     proto, mp->is_add, 0, 0, tag, 1);
   vec_free (tag);
 
-send_reply:
   REPLY_MACRO (VL_API_NAT44_ADD_DEL_IDENTITY_MAPPING_REPLY);
 }
 
@@ -1421,9 +1370,6 @@
   snat_static_map_resolve_t *rp;
   int j;
 
-  if (sm->deterministic)
-    return;
-
   reg = vl_api_client_index_to_registration (mp->client_index);
   if (!reg)
     return;
@@ -1469,12 +1415,6 @@
   int rv = 0;
   u8 is_del;
 
-  if (sm->deterministic)
-    {
-      rv = VNET_API_ERROR_UNSUPPORTED;
-      goto send_reply;
-    }
-
   is_del = !mp->is_add;
 
   VALIDATE_SW_IF_INDEX (mp);
@@ -1483,7 +1423,6 @@
 				   mp->flags & NAT_API_IS_TWICE_NAT);
 
   BAD_SW_IF_INDEX_LABEL;
-send_reply:
   REPLY_MACRO (VL_API_NAT44_ADD_DEL_INTERFACE_ADDR_REPLY);
 }
 
@@ -1529,9 +1468,6 @@
   snat_main_t *sm = &snat_main;
   u32 *i;
 
-  if (sm->deterministic)
-    return;
-
   reg = vl_api_client_index_to_registration (mp->client_index);
   if (!reg)
     return;
@@ -1645,9 +1581,6 @@
   snat_main_per_thread_data_t *tsm;
   snat_user_t *u;
 
-  if (sm->deterministic)
-    return;
-
   reg = vl_api_client_index_to_registration (mp->client_index);
   if (!reg)
     return;
@@ -1749,9 +1682,6 @@
   dlist_elt_t *head, *elt;
   ip4_header_t ip;
 
-  if (sm->deterministic)
-    return;
-
   reg = vl_api_client_index_to_registration (mp->client_index);
   if (!reg)
     return;
@@ -2043,12 +1973,6 @@
   u8 is_in;
   nat_protocol_t proto;
 
-  if (sm->deterministic)
-    {
-      rv = VNET_API_ERROR_UNSUPPORTED;
-      goto send_reply;
-    }
-
   memcpy (&addr.as_u8, mp->address, 4);
   port = mp->port;
   vrf_id = clib_net_to_host_u32 (mp->vrf_id);
@@ -2065,7 +1989,6 @@
   else
     rv = nat44_del_session (sm, &addr, port, proto, vrf_id, is_in);
 
-send_reply:
   REPLY_MACRO (VL_API_NAT44_DEL_SESSION_REPLY);
 }
 
@@ -2181,375 +2104,6 @@
   FINISH;
 }
 
-/*******************************/
-/*** Deterministic NAT (CGN) ***/
-/*******************************/
-
-static void
-vl_api_nat_det_add_del_map_t_handler (vl_api_nat_det_add_del_map_t * mp)
-{
-  snat_main_t *sm = &snat_main;
-  vl_api_nat_det_add_del_map_reply_t *rmp;
-  int rv = 0;
-  ip4_address_t in_addr, out_addr;
-
-  if (!sm->deterministic)
-    {
-      rv = VNET_API_ERROR_UNSUPPORTED;
-      goto send_reply;
-    }
-
-  clib_memcpy (&in_addr, mp->in_addr, 4);
-  clib_memcpy (&out_addr, mp->out_addr, 4);
-  rv = snat_det_add_map (sm, &in_addr, mp->in_plen, &out_addr,
-			 mp->out_plen, mp->is_add);
-
-send_reply:
-  REPLY_MACRO (VL_API_NAT_DET_ADD_DEL_MAP_REPLY);
-}
-
-static void *
-vl_api_nat_det_add_del_map_t_print (vl_api_nat_det_add_del_map_t * mp,
-				    void *handle)
-{
-  u8 *s;
-
-  s = format (0, "SCRIPT: nat_det_add_del_map ");
-  s = format (s, "inside address %U/%d outside address %U/%d\n",
-	      format_ip4_address, mp->in_addr, mp->in_plen,
-	      format_ip4_address, mp->out_addr, mp->out_plen);
-
-  FINISH;
-}
-
-static void
-vl_api_nat_det_forward_t_handler (vl_api_nat_det_forward_t * mp)
-{
-  snat_main_t *sm = &snat_main;
-  vl_api_nat_det_forward_reply_t *rmp;
-  int rv = 0;
-  u16 lo_port = 0, hi_port = 0;
-  snat_det_map_t *dm;
-  ip4_address_t in_addr, out_addr;
-
-  if (!sm->deterministic)
-    {
-      rv = VNET_API_ERROR_UNSUPPORTED;
-      REPLY_MACRO (VL_API_NAT_DET_FORWARD_REPLY);
-      return;
-    }
-
-  out_addr.as_u32 = 0;
-  clib_memcpy (&in_addr, mp->in_addr, 4);
-  dm = snat_det_map_by_user (sm, &in_addr);
-  if (!dm)
-    {
-      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
-      goto send_reply;
-    }
-
-  snat_det_forward (dm, &in_addr, &out_addr, &lo_port);
-  hi_port = lo_port + dm->ports_per_host - 1;
-
-send_reply:
-  /* *INDENT-OFF* */
-  REPLY_MACRO2 (VL_API_NAT_DET_FORWARD_REPLY,
-  ({
-    rmp->out_port_lo = ntohs (lo_port);
-    rmp->out_port_hi = ntohs (hi_port);
-    clib_memcpy (rmp->out_addr, &out_addr, 4);
-  }))
-  /* *INDENT-ON* */
-}
-
-static void *
-vl_api_nat_det_forward_t_print (vl_api_nat_det_forward_t * mp, void *handle)
-{
-  u8 *s;
-
-  s = format (0, "SCRIPT: nat_det_forward");
-  s = format (s, "inside ip address %U\n", format_ip4_address, mp->in_addr);
-
-  FINISH;
-}
-
-static void
-vl_api_nat_det_reverse_t_handler (vl_api_nat_det_reverse_t * mp)
-{
-  snat_main_t *sm = &snat_main;
-  vl_api_nat_det_reverse_reply_t *rmp;
-  int rv = 0;
-  ip4_address_t out_addr, in_addr;
-  snat_det_map_t *dm;
-
-  if (!sm->deterministic)
-    {
-      rv = VNET_API_ERROR_UNSUPPORTED;
-      REPLY_MACRO (VL_API_NAT_DET_REVERSE_REPLY);
-      return;
-    }
-
-  in_addr.as_u32 = 0;
-  clib_memcpy (&out_addr, mp->out_addr, 4);
-  dm = snat_det_map_by_out (sm, &out_addr);
-  if (!dm)
-    {
-      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
-      goto send_reply;
-    }
-
-  snat_det_reverse (dm, &out_addr, htons (mp->out_port), &in_addr);
-
-send_reply:
-  /* *INDENT-OFF* */
-  REPLY_MACRO2 (VL_API_NAT_DET_REVERSE_REPLY,
-  ({
-    clib_memcpy (rmp->in_addr, &in_addr, 4);
-  }))
-  /* *INDENT-ON* */
-}
-
-static void *
-vl_api_nat_det_reverse_t_print (vl_api_nat_det_reverse_t * mp, void *handle)
-{
-  u8 *s;
-
-  s = format (0, "SCRIPT: nat_det_reverse");
-  s = format (s, "outside ip address %U outside port %d",
-	      format_ip4_address, mp->out_addr, ntohs (mp->out_port));
-
-  FINISH;
-}
-
-static void
-sent_nat_det_map_details (snat_det_map_t * m, vl_api_registration_t * reg,
-			  u32 context)
-{
-  vl_api_nat_det_map_details_t *rmp;
-  snat_main_t *sm = &snat_main;
-
-  rmp = vl_msg_api_alloc (sizeof (*rmp));
-  clib_memset (rmp, 0, sizeof (*rmp));
-  rmp->_vl_msg_id = ntohs (VL_API_NAT_DET_MAP_DETAILS + sm->msg_id_base);
-  clib_memcpy (rmp->in_addr, &m->in_addr, 4);
-  rmp->in_plen = m->in_plen;
-  clib_memcpy (rmp->out_addr, &m->out_addr, 4);
-  rmp->out_plen = m->out_plen;
-  rmp->sharing_ratio = htonl (m->sharing_ratio);
-  rmp->ports_per_host = htons (m->ports_per_host);
-  rmp->ses_num = htonl (m->ses_num);
-  rmp->context = context;
-
-  vl_api_send_msg (reg, (u8 *) rmp);
-}
-
-static void
-vl_api_nat_det_map_dump_t_handler (vl_api_nat_det_map_dump_t * mp)
-{
-  vl_api_registration_t *reg;
-  snat_main_t *sm = &snat_main;
-  snat_det_map_t *m;
-
-  if (!sm->deterministic)
-    return;
-
-  reg = vl_api_client_index_to_registration (mp->client_index);
-  if (!reg)
-    return;
-
-  /* *INDENT-OFF* */
-  vec_foreach(m, sm->det_maps)
-    sent_nat_det_map_details(m, reg, mp->context);
-  /* *INDENT-ON* */
-}
-
-static void *
-vl_api_nat_det_map_dump_t_print (vl_api_nat_det_map_dump_t * mp, void *handle)
-{
-  u8 *s;
-
-  s = format (0, "SCRIPT: nat_det_map_dump ");
-
-  FINISH;
-}
-
-static void
-vl_api_nat_det_close_session_out_t_handler (vl_api_nat_det_close_session_out_t
-					    * mp)
-{
-  snat_main_t *sm = &snat_main;
-  vl_api_nat_det_close_session_out_reply_t *rmp;
-  ip4_address_t out_addr, ext_addr, in_addr;
-  snat_det_out_key_t key;
-  snat_det_map_t *dm;
-  snat_det_session_t *ses;
-  int rv = 0;
-
-  if (!sm->deterministic)
-    {
-      rv = VNET_API_ERROR_UNSUPPORTED;
-      goto send_reply;
-    }
-
-  clib_memcpy (&out_addr, mp->out_addr, 4);
-  clib_memcpy (&ext_addr, mp->ext_addr, 4);
-
-  dm = snat_det_map_by_out (sm, &out_addr);
-  if (!dm)
-    {
-      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
-      goto send_reply;
-    }
-  snat_det_reverse (dm, &ext_addr, ntohs (mp->out_port), &in_addr);
-  key.ext_host_addr = ext_addr;
-  key.ext_host_port = mp->ext_port;
-  key.out_port = mp->out_port;
-  ses = snat_det_get_ses_by_out (dm, &in_addr, key.as_u64);
-  if (!ses)
-    {
-      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
-      goto send_reply;
-    }
-  snat_det_ses_close (dm, ses);
-
-send_reply:
-  REPLY_MACRO (VL_API_NAT_DET_CLOSE_SESSION_OUT_REPLY);
-}
-
-static void *
-vl_api_nat_det_close_session_out_t_print (vl_api_nat_det_close_session_out_t *
-					  mp, void *handle)
-{
-  u8 *s;
-
-  s = format (0, "SCRIPT: nat_det_close_session_out ");
-  s = format (s, "out_addr %U out_port %d "
-	      "ext_addr %U ext_port %d\n",
-	      format_ip4_address, mp->out_addr, ntohs (mp->out_port),
-	      format_ip4_address, mp->ext_addr, ntohs (mp->ext_port));
-
-  FINISH;
-}
-
-static void
-vl_api_nat_det_close_session_in_t_handler (vl_api_nat_det_close_session_in_t *
-					   mp)
-{
-  snat_main_t *sm = &snat_main;
-  vl_api_nat_det_close_session_in_reply_t *rmp;
-  ip4_address_t in_addr, ext_addr;
-  snat_det_out_key_t key;
-  snat_det_map_t *dm;
-  snat_det_session_t *ses;
-  int rv = 0;
-
-  if (!sm->deterministic)
-    {
-      rv = VNET_API_ERROR_UNSUPPORTED;
-      goto send_reply;
-    }
-
-  clib_memcpy (&in_addr, mp->in_addr, 4);
-  clib_memcpy (&ext_addr, mp->ext_addr, 4);
-
-  dm = snat_det_map_by_user (sm, &in_addr);
-  if (!dm)
-    {
-      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
-      goto send_reply;
-    }
-  key.ext_host_addr = ext_addr;
-  key.ext_host_port = mp->ext_port;
-  ses = snat_det_find_ses_by_in (dm, &in_addr, mp->in_port, key);
-  if (!ses)
-    {
-      rv = VNET_API_ERROR_NO_SUCH_ENTRY;
-      goto send_reply;
-    }
-  snat_det_ses_close (dm, ses);
-
-send_reply:
-  REPLY_MACRO (VL_API_NAT_DET_CLOSE_SESSION_OUT_REPLY);
-}
-
-static void *
-vl_api_nat_det_close_session_in_t_print (vl_api_nat_det_close_session_in_t *
-					 mp, void *handle)
-{
-  u8 *s;
-  s = format (0, "SCRIPT: nat_det_close_session_in ");
-  s = format (s, "in_addr %U in_port %d ext_addr %U ext_port %d\n",
-	      format_ip4_address, mp->in_addr, ntohs (mp->in_port),
-	      format_ip4_address, mp->ext_addr, ntohs (mp->ext_port));
-
-  FINISH;
-}
-
-static void
-send_nat_det_session_details (snat_det_session_t * s,
-			      vl_api_registration_t * reg, u32 context)
-{
-  vl_api_nat_det_session_details_t *rmp;
-  snat_main_t *sm = &snat_main;
-
-  rmp = vl_msg_api_alloc (sizeof (*rmp));
-  clib_memset (rmp, 0, sizeof (*rmp));
-  rmp->_vl_msg_id = ntohs (VL_API_NAT_DET_SESSION_DETAILS + sm->msg_id_base);
-  rmp->in_port = s->in_port;
-  clib_memcpy (rmp->ext_addr, &s->out.ext_host_addr, 4);
-  rmp->ext_port = s->out.ext_host_port;
-  rmp->out_port = s->out.out_port;
-  rmp->state = s->state;
-  rmp->expire = ntohl (s->expire);
-  rmp->context = context;
-
-  vl_api_send_msg (reg, (u8 *) rmp);
-}
-
-static void
-vl_api_nat_det_session_dump_t_handler (vl_api_nat_det_session_dump_t * mp)
-{
-  vl_api_registration_t *reg;
-  snat_main_t *sm = &snat_main;
-  ip4_address_t user_addr;
-  snat_det_map_t *dm;
-  snat_det_session_t *s, empty_ses;
-  u16 i;
-
-  if (!sm->deterministic)
-    return;
-
-  reg = vl_api_client_index_to_registration (mp->client_index);
-  if (!reg)
-    return;
-
-  clib_memset (&empty_ses, 0, sizeof (empty_ses));
-  clib_memcpy (&user_addr, mp->user_addr, 4);
-  dm = snat_det_map_by_user (sm, &user_addr);
-  if (!dm)
-    return;
-
-  s = dm->sessions + snat_det_user_ses_offset (&user_addr, dm->in_plen);
-  for (i = 0; i < SNAT_DET_SES_PER_USER; i++)
-    {
-      if (s->out.as_u64)
-	send_nat_det_session_details (s, reg, mp->context);
-      s++;
-    }
-}
-
-static void *
-vl_api_nat_det_session_dump_t_print (vl_api_nat_det_session_dump_t * mp,
-				     void *handle)
-{
-  u8 *s;
-
-  s = format (0, "SCRIPT: nat_det_session_dump ");
-  s = format (s, "user_addr %U\n", format_ip4_address, mp->user_addr);
-
-  FINISH;
-}
-
 /*************/
 /*** NAT64 ***/
 /*************/
@@ -3079,13 +2633,6 @@
 _(NAT44_DEL_SESSION, nat44_del_session)                                 \
 _(NAT44_FORWARDING_ENABLE_DISABLE, nat44_forwarding_enable_disable)     \
 _(NAT44_FORWARDING_IS_ENABLED, nat44_forwarding_is_enabled)             \
-_(NAT_DET_ADD_DEL_MAP, nat_det_add_del_map)                             \
-_(NAT_DET_FORWARD, nat_det_forward)                                     \
-_(NAT_DET_REVERSE, nat_det_reverse)                                     \
-_(NAT_DET_MAP_DUMP, nat_det_map_dump)                                   \
-_(NAT_DET_CLOSE_SESSION_OUT, nat_det_close_session_out)                 \
-_(NAT_DET_CLOSE_SESSION_IN, nat_det_close_session_in)                   \
-_(NAT_DET_SESSION_DUMP, nat_det_session_dump)                           \
 _(NAT64_ADD_DEL_POOL_ADDR_RANGE, nat64_add_del_pool_addr_range)         \
 _(NAT64_POOL_ADDR_DUMP, nat64_pool_addr_dump)                           \
 _(NAT64_ADD_DEL_INTERFACE, nat64_add_del_interface)                     \
diff --git a/src/plugins/nat/nat_det.c b/src/plugins/nat/nat_det.c
deleted file mode 100644
index 65a669b..0000000
--- a/src/plugins/nat/nat_det.c
+++ /dev/null
@@ -1,175 +0,0 @@
-/*
- * snat_det.c - deterministic NAT
- *
- * Copyright (c) 2017 Cisco and/or its affiliates.
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at:
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-/**
- * @file
- * @brief deterministic NAT
- */
-
-#include <nat/nat_det.h>
-
-
-/**
- * @brief Add/delete deterministic NAT mapping.
- *
- * Create bijective mapping of inside address to outside address and port range
- * pairs, with the purpose of enabling deterministic NAT to reduce logging in
- * CGN deployments.
- *
- * @param sm       SNAT main.
- * @param in_addr  Inside network address.
- * @param in_plen  Inside network prefix length.
- * @param out_addr Outside network address.
- * @param out_plen Outside network prefix length.
- * @param is_add   If 0 delete, otherwise add.
- */
-int
-snat_det_add_map (snat_main_t * sm, ip4_address_t * in_addr, u8 in_plen,
-		  ip4_address_t * out_addr, u8 out_plen, int is_add)
-{
-  snat_det_map_t *det_map;
-  static snat_det_session_t empty_snat_det_session = { 0 };
-  snat_interface_t *i;
-  ip4_address_t in_cmp, out_cmp;
-  u8 found = 0;
-
-  in_cmp.as_u32 = in_addr->as_u32 & ip4_main.fib_masks[in_plen];
-  out_cmp.as_u32 = out_addr->as_u32 & ip4_main.fib_masks[out_plen];
-  vec_foreach (det_map, sm->det_maps)
-  {
-    /* Checking for overlapping addresses to be added here */
-    if (det_map->in_addr.as_u32 == in_cmp.as_u32 &&
-	det_map->in_plen == in_plen &&
-	det_map->out_addr.as_u32 == out_cmp.as_u32 &&
-	det_map->out_plen == out_plen)
-      {
-	found = 1;
-	break;
-      }
-  }
-
-  /* If found, don't add again */
-  if (found && is_add)
-    return VNET_API_ERROR_VALUE_EXIST;
-
-  /* If not found, don't delete */
-  if (!found && !is_add)
-    return VNET_API_ERROR_NO_SUCH_ENTRY;
-
-  if (is_add)
-    {
-      u32 num_sessions = (1 << (32 - in_plen));
-      if (num_sessions > UINT32_MAX / 1000)
-	{
-	  // don't let it overflow
-	  return VNET_API_ERROR_INVALID_VALUE;
-	}
-      else
-	{
-	  num_sessions = num_sessions * 1000 - 1;
-	}
-
-      u32 sharing_ratio = (1 << (32 - in_plen)) / (1 << (32 - out_plen));
-      if (!sharing_ratio)
-	{
-	  // avoid division by zero
-	  return VNET_API_ERROR_INVALID_VALUE;
-	}
-
-      pool_get (sm->det_maps, det_map);
-      clib_memset (det_map, 0, sizeof (*det_map));
-      det_map->in_addr.as_u32 = in_cmp.as_u32;
-      det_map->in_plen = in_plen;
-      det_map->out_addr.as_u32 = out_cmp.as_u32;
-      det_map->out_plen = out_plen;
-      det_map->sharing_ratio = sharing_ratio;
-      det_map->ports_per_host = (65535 - 1023) / det_map->sharing_ratio;
-
-      vec_validate_init_empty (det_map->sessions, num_sessions,
-			       empty_snat_det_session);
-    }
-  else
-    {
-      vec_free (det_map->sessions);
-      vec_del1 (sm->det_maps, det_map - sm->det_maps);
-    }
-
-  /* Add/del external address range to FIB */
-  /* *INDENT-OFF* */
-  pool_foreach (i, sm->interfaces,
-  ({
-    if (nat_interface_is_inside(i))
-      continue;
-
-    snat_add_del_addr_to_fib(out_addr, out_plen, i->sw_if_index, is_add);
-    break;
-  }));
-  /* *INDENT-ON* */
-  return 0;
-}
-
-/**
- * @brief The 'nat-det-expire-walk' process's main loop.
- *
- * Check expire time for active sessions.
- */
-static uword
-snat_det_expire_walk_fn (vlib_main_t * vm, vlib_node_runtime_t * rt,
-			 vlib_frame_t * f)
-{
-  snat_main_t *sm = &snat_main;
-  snat_det_map_t *dm;
-  snat_det_session_t *ses;
-
-  while (sm->deterministic)
-    {
-      vlib_process_wait_for_event_or_clock (vm, 10.0);
-      vlib_process_get_events (vm, NULL);
-      u32 now = (u32) vlib_time_now (vm);
-      /* *INDENT-OFF* */
-      pool_foreach (dm, sm->det_maps,
-      ({
-        vec_foreach(ses, dm->sessions)
-          {
-            /* Delete if session expired */
-            if (ses->in_port && (ses->expire < now))
-              snat_det_ses_close (dm, ses);
-          }
-      }));
-      /* *INDENT-ON* */
-    }
-
-  return 0;
-}
-
-static vlib_node_registration_t snat_det_expire_walk_node;
-
-/* *INDENT-OFF* */
-VLIB_REGISTER_NODE (snat_det_expire_walk_node, static) = {
-    .function = snat_det_expire_walk_fn,
-    .type = VLIB_NODE_TYPE_PROCESS,
-    .name =
-    "nat-det-expire-walk",
-};
-/* *INDENT-ON* */
-
-/*
- * fd.io coding-style-patch-verification: ON
- *
- * Local Variables:
- * eval: (c-set-style "gnu")
- * End:
- */
diff --git a/src/plugins/nat/nat_det.h b/src/plugins/nat/nat_det.h
deleted file mode 100644
index d296635..0000000
--- a/src/plugins/nat/nat_det.h
+++ /dev/null
@@ -1,199 +0,0 @@
-/*
- * snat_det.h - deterministic NAT definitions
- *
- * Copyright (c) 2017 Cisco and/or its affiliates.
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at:
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-/**
- * @file
- * @brief deterministic NAT definitions
- */
-
-#ifndef __included_nat_det_h__
-#define __included_nat_det_h__
-
-#include <vnet/ip/ip.h>
-#include <nat/nat.h>
-#include <nat/nat_ipfix_logging.h>
-
-
-#define SNAT_DET_SES_PER_USER 1000
-
-
-int snat_det_add_map (snat_main_t * sm, ip4_address_t * in_addr, u8 in_plen,
-		      ip4_address_t * out_addr, u8 out_plen, int is_add);
-
-always_inline int
-is_addr_in_net (ip4_address_t * addr, ip4_address_t * net, u8 plen)
-{
-  if (net->as_u32 == (addr->as_u32 & ip4_main.fib_masks[plen]))
-    return 1;
-  return 0;
-}
-
-always_inline snat_det_map_t *
-snat_det_map_by_user (snat_main_t * sm, ip4_address_t * user_addr)
-{
-  snat_det_map_t *dm;
-
-  /* *INDENT-OFF* */
-  pool_foreach (dm, sm->det_maps,
-  ({
-    if (is_addr_in_net(user_addr, &dm->in_addr, dm->in_plen))
-      return dm;
-  }));
-  /* *INDENT-ON* */
-  return 0;
-}
-
-always_inline snat_det_map_t *
-snat_det_map_by_out (snat_main_t * sm, ip4_address_t * out_addr)
-{
-  snat_det_map_t *dm;
-
-  /* *INDENT-OFF* */
-  pool_foreach (dm, sm->det_maps,
-  ({
-    if (is_addr_in_net(out_addr, &dm->out_addr, dm->out_plen))
-      return dm;
-  }));
-  /* *INDENT-ON* */
-  return 0;
-}
-
-always_inline void
-snat_det_forward (snat_det_map_t * dm, ip4_address_t * in_addr,
-		  ip4_address_t * out_addr, u16 * lo_port)
-{
-  u32 in_offset, out_offset;
-
-  in_offset = clib_net_to_host_u32 (in_addr->as_u32) -
-    clib_net_to_host_u32 (dm->in_addr.as_u32);
-  out_offset = in_offset / dm->sharing_ratio;
-  out_addr->as_u32 =
-    clib_host_to_net_u32 (clib_net_to_host_u32 (dm->out_addr.as_u32) +
-			  out_offset);
-  *lo_port = 1024 + dm->ports_per_host * (in_offset % dm->sharing_ratio);
-}
-
-always_inline void
-snat_det_reverse (snat_det_map_t * dm, ip4_address_t * out_addr, u16 out_port,
-		  ip4_address_t * in_addr)
-{
-  u32 in_offset1, in_offset2, out_offset;
-
-  out_offset = clib_net_to_host_u32 (out_addr->as_u32) -
-    clib_net_to_host_u32 (dm->out_addr.as_u32);
-  in_offset1 = out_offset * dm->sharing_ratio;
-  in_offset2 = (out_port - 1024) / dm->ports_per_host;
-  in_addr->as_u32 =
-    clib_host_to_net_u32 (clib_net_to_host_u32 (dm->in_addr.as_u32) +
-			  in_offset1 + in_offset2);
-}
-
-always_inline u32
-snat_det_user_ses_offset (ip4_address_t * addr, u8 plen)
-{
-  return (clib_net_to_host_u32 (addr->as_u32) & pow2_mask (32 - plen)) *
-    SNAT_DET_SES_PER_USER;
-}
-
-always_inline snat_det_session_t *
-snat_det_get_ses_by_out (snat_det_map_t * dm, ip4_address_t * in_addr,
-			 u64 out_key)
-{
-  u32 user_offset;
-  u16 i;
-
-  user_offset = snat_det_user_ses_offset (in_addr, dm->in_plen);
-  for (i = 0; i < SNAT_DET_SES_PER_USER; i++)
-    {
-      if (dm->sessions[i + user_offset].out.as_u64 == out_key)
-	return &dm->sessions[i + user_offset];
-    }
-
-  return 0;
-}
-
-always_inline snat_det_session_t *
-snat_det_find_ses_by_in (snat_det_map_t * dm, ip4_address_t * in_addr,
-			 u16 in_port, snat_det_out_key_t out_key)
-{
-  snat_det_session_t *ses;
-  u32 user_offset;
-  u16 i;
-
-  user_offset = snat_det_user_ses_offset (in_addr, dm->in_plen);
-  for (i = 0; i < SNAT_DET_SES_PER_USER; i++)
-    {
-      ses = &dm->sessions[i + user_offset];
-      if (ses->in_port == in_port &&
-	  ses->out.ext_host_addr.as_u32 == out_key.ext_host_addr.as_u32 &&
-	  ses->out.ext_host_port == out_key.ext_host_port)
-	return &dm->sessions[i + user_offset];
-    }
-
-  return 0;
-}
-
-always_inline snat_det_session_t *
-snat_det_ses_create (u32 thread_index, snat_det_map_t * dm,
-		     ip4_address_t * in_addr, u16 in_port,
-		     snat_det_out_key_t * out)
-{
-  u32 user_offset;
-  u16 i;
-
-  user_offset = snat_det_user_ses_offset (in_addr, dm->in_plen);
-
-  for (i = 0; i < SNAT_DET_SES_PER_USER; i++)
-    {
-      if (!dm->sessions[i + user_offset].in_port)
-	{
-	  if (clib_atomic_bool_cmp_and_swap
-	      (&dm->sessions[i + user_offset].in_port, 0, in_port))
-	    {
-	      dm->sessions[i + user_offset].out.as_u64 = out->as_u64;
-	      dm->sessions[i + user_offset].state = SNAT_SESSION_UNKNOWN;
-	      dm->sessions[i + user_offset].expire = 0;
-	      clib_atomic_add_fetch (&dm->ses_num, 1);
-	      return &dm->sessions[i + user_offset];
-	    }
-	}
-    }
-
-  snat_ipfix_logging_max_entries_per_user (thread_index,
-					   SNAT_DET_SES_PER_USER,
-					   in_addr->as_u32);
-  return 0;
-}
-
-always_inline void
-snat_det_ses_close (snat_det_map_t * dm, snat_det_session_t * ses)
-{
-  if (clib_atomic_bool_cmp_and_swap (&ses->in_port, ses->in_port, 0))
-    {
-      ses->out.as_u64 = 0;
-      clib_atomic_add_fetch (&dm->ses_num, -1);
-    }
-}
-
-#endif /* __included_nat_det_h__ */
-
-/*
- * fd.io coding-style-patch-verification: ON
- *
- * Local Variables:
- * eval: (c-set-style "gnu")
- * End:
- */
diff --git a/src/plugins/nat/nat_det_in2out.c b/src/plugins/nat/nat_det_in2out.c
deleted file mode 100644
index 74b4149..0000000
--- a/src/plugins/nat/nat_det_in2out.c
+++ /dev/null
@@ -1,916 +0,0 @@
-/*
- * Copyright (c) 2018 Cisco and/or its affiliates.
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at:
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-/**
- * @file
- * @brief Deterministic/CGN NAT44 inside to outside network translation
- */
-
-#include <vlib/vlib.h>
-#include <vnet/vnet.h>
-#include <vnet/ip/ip.h>
-#include <vnet/fib/ip4_fib.h>
-#include <vppinfra/error.h>
-#include <vppinfra/elog.h>
-#include <nat/nat.h>
-#include <nat/nat_det.h>
-#include <nat/nat_inlines.h>
-#include <nat/lib/nat_inlines.h>
-
-typedef struct
-{
-  u32 sw_if_index;
-  u32 next_index;
-  u32 session_index;
-} nat_det_in2out_trace_t;
-
-typedef enum
-{
-  NAT_DET_IN2OUT_NEXT_LOOKUP,
-  NAT_DET_IN2OUT_NEXT_DROP,
-  NAT_DET_IN2OUT_NEXT_ICMP_ERROR,
-  NAT_DET_IN2OUT_N_NEXT,
-} nat_det_in2out_next_t;
-
-#define foreach_nat_det_in2out_error                    \
-_(UNSUPPORTED_PROTOCOL, "Unsupported protocol")         \
-_(NO_TRANSLATION, "No translation")                     \
-_(BAD_ICMP_TYPE, "unsupported ICMP type")               \
-_(OUT_OF_PORTS, "Out of ports")                         \
-_(IN2OUT_PACKETS, "Good in2out packets processed")
-
-typedef enum
-{
-#define _(sym,str) NAT_DET_IN2OUT_ERROR_##sym,
-  foreach_nat_det_in2out_error
-#undef _
-    NAT_DET_IN2OUT_N_ERROR,
-} nat_det_in2out_error_t;
-
-static char *nat_det_in2out_error_strings[] = {
-#define _(sym,string) string,
-  foreach_nat_det_in2out_error
-#undef _
-};
-
-static u8 *
-format_nat_det_in2out_trace (u8 * s, va_list * args)
-{
-  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
-  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
-  nat_det_in2out_trace_t *t = va_arg (*args, nat_det_in2out_trace_t *);
-
-  s = format (s, "NAT_DET_IN2OUT: sw_if_index %d, next index %d, session %d",
-	      t->sw_if_index, t->next_index, t->session_index);
-
-  return s;
-}
-
-#ifndef CLIB_MARCH_VARIANT
-/**
- * Get address and port values to be used for ICMP packet translation
- * and create session if needed
- *
- * @param[in,out] sm             NAT main
- * @param[in,out] node           NAT node runtime
- * @param[in] thread_index       thread index
- * @param[in,out] b0             buffer containing packet to be translated
- * @param[in,out] ip0            ip header
- * @param[out] p_proto           protocol used for matching
- * @param[out] p_value           address and port after NAT translation
- * @param[out] p_dont_translate  if packet should not be translated
- * @param d                      optional parameter
- * @param e                      optional parameter
- */
-u32
-icmp_match_in2out_det (snat_main_t * sm, vlib_node_runtime_t * node,
-		       u32 thread_index, vlib_buffer_t * b0,
-		       ip4_header_t * ip0, ip4_address_t * addr,
-		       u16 * port, u32 * fib_index,
-		       nat_protocol_t * proto, void *d, void *e,
-		       u8 * dont_translate)
-{
-  vlib_main_t *vm = vlib_get_main ();
-  icmp46_header_t *icmp0;
-  u32 sw_if_index0;
-  u32 rx_fib_index0;
-  nat_protocol_t protocol;
-  snat_det_out_key_t key0;
-  u32 next0 = ~0;
-  icmp_echo_header_t *echo0, *inner_echo0 = 0;
-  ip4_header_t *inner_ip0;
-  void *l4_header = 0;
-  icmp46_header_t *inner_icmp0;
-  snat_det_map_t *dm0 = 0;
-  ip4_address_t new_addr0;
-  u16 lo_port0, i0;
-  snat_det_session_t *ses0 = 0;
-  ip4_address_t in_addr;
-  u16 in_port;
-  *dont_translate = 0;
-
-  icmp0 = (icmp46_header_t *) ip4_next_header (ip0);
-  echo0 = (icmp_echo_header_t *) (icmp0 + 1);
-  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
-  rx_fib_index0 = ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
-
-  if (!icmp_type_is_error_message
-      (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags))
-    {
-      protocol = NAT_PROTOCOL_ICMP;
-      in_addr = ip0->src_address;
-      in_port = vnet_buffer (b0)->ip.reass.l4_src_port;
-    }
-  else
-    {
-      /* if error message, then it's not fragmented and we can access it */
-      inner_ip0 = (ip4_header_t *) (echo0 + 1);
-      l4_header = ip4_next_header (inner_ip0);
-      protocol = ip_proto_to_nat_proto (inner_ip0->protocol);
-      in_addr = inner_ip0->dst_address;
-      switch (protocol)
-	{
-	case NAT_PROTOCOL_ICMP:
-	  inner_icmp0 = (icmp46_header_t *) l4_header;
-	  inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
-	  in_port = inner_echo0->identifier;
-	  break;
-	case NAT_PROTOCOL_UDP:
-	case NAT_PROTOCOL_TCP:
-	  in_port = ((tcp_udp_header_t *) l4_header)->dst_port;
-	  break;
-	default:
-	  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_UNSUPPORTED_PROTOCOL];
-	  next0 = NAT_DET_IN2OUT_NEXT_DROP;
-	  goto out;
-	}
-    }
-
-  dm0 = snat_det_map_by_user (sm, &in_addr);
-  if (PREDICT_FALSE (!dm0))
-    {
-      nat_log_info ("no match for internal host %U",
-		    format_ip4_address, &in_addr);
-      if (PREDICT_FALSE (snat_not_translate_fast (sm, node, sw_if_index0, ip0,
-						  IP_PROTOCOL_ICMP,
-						  rx_fib_index0)))
-	{
-	  *dont_translate = 1;
-	  goto out;
-	}
-      next0 = NAT_DET_IN2OUT_NEXT_DROP;
-      b0->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
-      goto out;
-    }
-
-  snat_det_forward (dm0, &in_addr, &new_addr0, &lo_port0);
-
-  key0.ext_host_addr = ip0->dst_address;
-  key0.ext_host_port = 0;
-
-  ses0 = snat_det_find_ses_by_in (dm0, &in_addr, in_port, key0);
-  if (PREDICT_FALSE (!ses0))
-    {
-      if (PREDICT_FALSE (snat_not_translate_fast (sm, node, sw_if_index0, ip0,
-						  IP_PROTOCOL_ICMP,
-						  rx_fib_index0)))
-	{
-	  *dont_translate = 1;
-	  goto out;
-	}
-      if (icmp0->type != ICMP4_echo_request)
-	{
-	  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_BAD_ICMP_TYPE];
-	  next0 = NAT_DET_IN2OUT_NEXT_DROP;
-	  goto out;
-	}
-      for (i0 = 0; i0 < dm0->ports_per_host; i0++)
-	{
-	  key0.out_port = clib_host_to_net_u16 (lo_port0 +
-						((i0 +
-						  clib_net_to_host_u16
-						  (echo0->identifier)) %
-						 dm0->ports_per_host));
-
-	  if (snat_det_get_ses_by_out (dm0, &in_addr, key0.as_u64))
-	    continue;
-
-	  ses0 =
-	    snat_det_ses_create (thread_index, dm0,
-				 &in_addr, echo0->identifier, &key0);
-	  break;
-	}
-      if (PREDICT_FALSE (!ses0))
-	{
-	  next0 = NAT_DET_IN2OUT_NEXT_DROP;
-	  b0->error = node->errors[NAT_DET_IN2OUT_ERROR_OUT_OF_PORTS];
-	  goto out;
-	}
-    }
-
-  if (PREDICT_FALSE
-      (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags != ICMP4_echo_request
-       && !icmp_type_is_error_message (vnet_buffer (b0)->ip.
-				       reass.icmp_type_or_tcp_flags)))
-    {
-      b0->error = node->errors[NAT_DET_IN2OUT_ERROR_BAD_ICMP_TYPE];
-      next0 = NAT_DET_IN2OUT_NEXT_DROP;
-      goto out;
-    }
-
-  u32 now = (u32) vlib_time_now (vm);
-
-  ses0->state = SNAT_SESSION_ICMP_ACTIVE;
-  ses0->expire = now + sm->icmp_timeout;
-
-out:
-  *proto = protocol;
-  if (ses0)
-    {
-      *addr = new_addr0;
-      *fib_index = sm->outside_fib_index;
-      *port = ses0->out.out_port;
-    }
-  if (d)
-    *(snat_det_session_t **) d = ses0;
-  if (e)
-    *(snat_det_map_t **) e = dm0;
-  return next0;
-}
-#endif
-
-VLIB_NODE_FN (snat_det_in2out_node) (vlib_main_t * vm,
-				     vlib_node_runtime_t * node,
-				     vlib_frame_t * frame)
-{
-  u32 n_left_from, *from, *to_next;
-  nat_det_in2out_next_t next_index;
-  u32 pkts_processed = 0;
-  snat_main_t *sm = &snat_main;
-  u32 now = (u32) vlib_time_now (vm);
-  u32 thread_index = vm->thread_index;
-
-  from = vlib_frame_vector_args (frame);
-  n_left_from = frame->n_vectors;
-  next_index = node->cached_next_index;
-
-  while (n_left_from > 0)
-    {
-      u32 n_left_to_next;
-
-      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
-
-      while (n_left_from >= 4 && n_left_to_next >= 2)
-	{
-	  u32 bi0, bi1;
-	  vlib_buffer_t *b0, *b1;
-	  u32 next0, next1;
-	  u32 sw_if_index0, sw_if_index1;
-	  ip4_header_t *ip0, *ip1;
-	  ip_csum_t sum0, sum1;
-	  ip4_address_t new_addr0, old_addr0, new_addr1, old_addr1;
-	  u16 old_port0, new_port0, lo_port0, i0;
-	  u16 old_port1, new_port1, lo_port1, i1;
-	  udp_header_t *udp0, *udp1;
-	  tcp_header_t *tcp0, *tcp1;
-	  u32 proto0, proto1;
-	  snat_det_out_key_t key0, key1;
-	  snat_det_map_t *dm0, *dm1;
-	  snat_det_session_t *ses0 = 0, *ses1 = 0;
-	  u32 rx_fib_index0, rx_fib_index1;
-	  icmp46_header_t *icmp0, *icmp1;
-
-	  /* Prefetch next iteration. */
-	  {
-	    vlib_buffer_t *p2, *p3;
-
-	    p2 = vlib_get_buffer (vm, from[2]);
-	    p3 = vlib_get_buffer (vm, from[3]);
-
-	    vlib_prefetch_buffer_header (p2, LOAD);
-	    vlib_prefetch_buffer_header (p3, LOAD);
-
-	    CLIB_PREFETCH (p2->data, CLIB_CACHE_LINE_BYTES, LOAD);
-	    CLIB_PREFETCH (p3->data, CLIB_CACHE_LINE_BYTES, LOAD);
-	  }
-
-	  /* speculatively enqueue b0 and b1 to the current next frame */
-	  to_next[0] = bi0 = from[0];
-	  to_next[1] = bi1 = from[1];
-	  from += 2;
-	  to_next += 2;
-	  n_left_from -= 2;
-	  n_left_to_next -= 2;
-
-	  b0 = vlib_get_buffer (vm, bi0);
-	  b1 = vlib_get_buffer (vm, bi1);
-
-	  next0 = NAT_DET_IN2OUT_NEXT_LOOKUP;
-	  next1 = NAT_DET_IN2OUT_NEXT_LOOKUP;
-
-	  ip0 = vlib_buffer_get_current (b0);
-	  udp0 = ip4_next_header (ip0);
-	  tcp0 = (tcp_header_t *) udp0;
-
-	  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
-
-	  if (PREDICT_FALSE (ip0->ttl == 1))
-	    {
-	      vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
-	      icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
-					   ICMP4_time_exceeded_ttl_exceeded_in_transit,
-					   0);
-	      next0 = NAT_DET_IN2OUT_NEXT_ICMP_ERROR;
-	      goto trace0;
-	    }
-
-	  proto0 = ip_proto_to_nat_proto (ip0->protocol);
-
-	  if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
-	    {
-	      rx_fib_index0 =
-		ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
-	      icmp0 = (icmp46_header_t *) udp0;
-
-	      next0 = icmp_in2out (sm, b0, ip0, icmp0, sw_if_index0,
-				   rx_fib_index0, node, next0, thread_index,
-				   &ses0, &dm0);
-	      goto trace0;
-	    }
-
-	  dm0 = snat_det_map_by_user (sm, &ip0->src_address);
-	  if (PREDICT_FALSE (!dm0))
-	    {
-	      nat_log_info ("no match for internal host %U",
-			    format_ip4_address, &ip0->src_address);
-	      next0 = NAT_DET_IN2OUT_NEXT_DROP;
-	      b0->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
-	      goto trace0;
-	    }
-
-	  snat_det_forward (dm0, &ip0->src_address, &new_addr0, &lo_port0);
-
-	  key0.ext_host_addr = ip0->dst_address;
-	  key0.ext_host_port = tcp0->dst;
-
-	  ses0 =
-	    snat_det_find_ses_by_in (dm0, &ip0->src_address, tcp0->src, key0);
-	  if (PREDICT_FALSE (!ses0))
-	    {
-	      for (i0 = 0; i0 < dm0->ports_per_host; i0++)
-		{
-		  key0.out_port = clib_host_to_net_u16 (lo_port0 +
-							((i0 +
-							  clib_net_to_host_u16
-							  (tcp0->src)) %
-							 dm0->
-							 ports_per_host));
-
-		  if (snat_det_get_ses_by_out
-		      (dm0, &ip0->src_address, key0.as_u64))
-		    continue;
-
-		  ses0 =
-		    snat_det_ses_create (thread_index, dm0, &ip0->src_address,
-					 tcp0->src, &key0);
-		  break;
-		}
-	      if (PREDICT_FALSE (!ses0))
-		{
-		  /* too many sessions for user, send ICMP error packet */
-		  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
-		  icmp4_error_set_vnet_buffer (b0,
-					       ICMP4_destination_unreachable,
-					       ICMP4_destination_unreachable_destination_unreachable_host,
-					       0);
-		  next0 = NAT_DET_IN2OUT_NEXT_ICMP_ERROR;
-		  goto trace0;
-		}
-	    }
-
-	  old_port0 = udp0->src_port;
-	  udp0->src_port = new_port0 = ses0->out.out_port;
-
-	  old_addr0.as_u32 = ip0->src_address.as_u32;
-	  ip0->src_address.as_u32 = new_addr0.as_u32;
-	  vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->outside_fib_index;
-
-	  sum0 = ip0->checksum;
-	  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
-				 ip4_header_t,
-				 src_address /* changed member */ );
-	  ip0->checksum = ip_csum_fold (sum0);
-
-	  if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
-	    {
-	      if (tcp0->flags & TCP_FLAG_SYN)
-		ses0->state = SNAT_SESSION_TCP_SYN_SENT;
-	      else if (tcp0->flags & TCP_FLAG_ACK
-		       && ses0->state == SNAT_SESSION_TCP_SYN_SENT)
-		ses0->state = SNAT_SESSION_TCP_ESTABLISHED;
-	      else if (tcp0->flags & TCP_FLAG_FIN
-		       && ses0->state == SNAT_SESSION_TCP_ESTABLISHED)
-		ses0->state = SNAT_SESSION_TCP_FIN_WAIT;
-	      else if (tcp0->flags & TCP_FLAG_ACK
-		       && ses0->state == SNAT_SESSION_TCP_FIN_WAIT)
-		snat_det_ses_close (dm0, ses0);
-	      else if (tcp0->flags & TCP_FLAG_FIN
-		       && ses0->state == SNAT_SESSION_TCP_CLOSE_WAIT)
-		ses0->state = SNAT_SESSION_TCP_LAST_ACK;
-	      else if (tcp0->flags == 0
-		       && ses0->state == SNAT_SESSION_UNKNOWN)
-		ses0->state = SNAT_SESSION_TCP_ESTABLISHED;
-
-	      sum0 = tcp0->checksum;
-	      sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
-				     ip4_header_t,
-				     dst_address /* changed member */ );
-	      sum0 = ip_csum_update (sum0, old_port0, new_port0,
-				     ip4_header_t /* cheat */ ,
-				     length /* changed member */ );
-	      mss_clamping (sm->mss_clamping, tcp0, &sum0);
-	      tcp0->checksum = ip_csum_fold (sum0);
-	    }
-	  else
-	    {
-	      ses0->state = SNAT_SESSION_UDP_ACTIVE;
-
-	      if (PREDICT_FALSE (udp0->checksum))
-		{
-		  sum0 = udp0->checksum;
-		  sum0 =
-		    ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
-				    ip4_header_t,
-				    dst_address /* changed member */ );
-		  sum0 =
-		    ip_csum_update (sum0, old_port0, new_port0,
-				    ip4_header_t /* cheat */ ,
-				    length /* changed member */ );
-		  udp0->checksum = ip_csum_fold (sum0);
-		}
-	    }
-
-	  switch (ses0->state)
-	    {
-	    case SNAT_SESSION_UDP_ACTIVE:
-	      ses0->expire = now + sm->udp_timeout;
-	      break;
-	    case SNAT_SESSION_TCP_SYN_SENT:
-	    case SNAT_SESSION_TCP_FIN_WAIT:
-	    case SNAT_SESSION_TCP_CLOSE_WAIT:
-	    case SNAT_SESSION_TCP_LAST_ACK:
-	      ses0->expire = now + sm->tcp_transitory_timeout;
-	      break;
-	    case SNAT_SESSION_TCP_ESTABLISHED:
-	      ses0->expire = now + sm->tcp_established_timeout;
-	      break;
-	    }
-
-	trace0:
-	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
-			     && (b0->flags & VLIB_BUFFER_IS_TRACED)))
-	    {
-	      nat_det_in2out_trace_t *t =
-		vlib_add_trace (vm, node, b0, sizeof (*t));
-	      t->sw_if_index = sw_if_index0;
-	      t->next_index = next0;
-	      t->session_index = ~0;
-	      if (ses0)
-		t->session_index = ses0 - dm0->sessions;
-	    }
-
-	  pkts_processed += next0 != NAT_DET_IN2OUT_NEXT_DROP;
-
-	  ip1 = vlib_buffer_get_current (b1);
-	  udp1 = ip4_next_header (ip1);
-	  tcp1 = (tcp_header_t *) udp1;
-
-	  sw_if_index1 = vnet_buffer (b1)->sw_if_index[VLIB_RX];
-
-	  if (PREDICT_FALSE (ip1->ttl == 1))
-	    {
-	      vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
-	      icmp4_error_set_vnet_buffer (b1, ICMP4_time_exceeded,
-					   ICMP4_time_exceeded_ttl_exceeded_in_transit,
-					   0);
-	      next1 = NAT_DET_IN2OUT_NEXT_ICMP_ERROR;
-	      goto trace1;
-	    }
-
-	  proto1 = ip_proto_to_nat_proto (ip1->protocol);
-
-	  if (PREDICT_FALSE (proto1 == NAT_PROTOCOL_ICMP))
-	    {
-	      rx_fib_index1 =
-		ip4_fib_table_get_index_for_sw_if_index (sw_if_index1);
-	      icmp1 = (icmp46_header_t *) udp1;
-
-	      next1 = icmp_in2out (sm, b1, ip1, icmp1, sw_if_index1,
-				   rx_fib_index1, node, next1, thread_index,
-				   &ses1, &dm1);
-	      goto trace1;
-	    }
-
-	  dm1 = snat_det_map_by_user (sm, &ip1->src_address);
-	  if (PREDICT_FALSE (!dm1))
-	    {
-	      nat_log_info ("no match for internal host %U",
-			    format_ip4_address, &ip0->src_address);
-	      next1 = NAT_DET_IN2OUT_NEXT_DROP;
-	      b1->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
-	      goto trace1;
-	    }
-
-	  snat_det_forward (dm1, &ip1->src_address, &new_addr1, &lo_port1);
-
-	  key1.ext_host_addr = ip1->dst_address;
-	  key1.ext_host_port = tcp1->dst;
-
-	  ses1 =
-	    snat_det_find_ses_by_in (dm1, &ip1->src_address, tcp1->src, key1);
-	  if (PREDICT_FALSE (!ses1))
-	    {
-	      for (i1 = 0; i1 < dm1->ports_per_host; i1++)
-		{
-		  key1.out_port = clib_host_to_net_u16 (lo_port1 +
-							((i1 +
-							  clib_net_to_host_u16
-							  (tcp1->src)) %
-							 dm1->
-							 ports_per_host));
-
-		  if (snat_det_get_ses_by_out
-		      (dm1, &ip1->src_address, key1.as_u64))
-		    continue;
-
-		  ses1 =
-		    snat_det_ses_create (thread_index, dm1, &ip1->src_address,
-					 tcp1->src, &key1);
-		  break;
-		}
-	      if (PREDICT_FALSE (!ses1))
-		{
-		  /* too many sessions for user, send ICMP error packet */
-		  vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
-		  icmp4_error_set_vnet_buffer (b1,
-					       ICMP4_destination_unreachable,
-					       ICMP4_destination_unreachable_destination_unreachable_host,
-					       0);
-		  next1 = NAT_DET_IN2OUT_NEXT_ICMP_ERROR;
-		  goto trace1;
-		}
-	    }
-
-	  old_port1 = udp1->src_port;
-	  udp1->src_port = new_port1 = ses1->out.out_port;
-
-	  old_addr1.as_u32 = ip1->src_address.as_u32;
-	  ip1->src_address.as_u32 = new_addr1.as_u32;
-	  vnet_buffer (b1)->sw_if_index[VLIB_TX] = sm->outside_fib_index;
-
-	  sum1 = ip1->checksum;
-	  sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
-				 ip4_header_t,
-				 src_address /* changed member */ );
-	  ip1->checksum = ip_csum_fold (sum1);
-
-	  if (PREDICT_TRUE (proto1 == NAT_PROTOCOL_TCP))
-	    {
-	      if (tcp1->flags & TCP_FLAG_SYN)
-		ses1->state = SNAT_SESSION_TCP_SYN_SENT;
-	      else if (tcp1->flags & TCP_FLAG_ACK
-		       && ses1->state == SNAT_SESSION_TCP_SYN_SENT)
-		ses1->state = SNAT_SESSION_TCP_ESTABLISHED;
-	      else if (tcp1->flags & TCP_FLAG_FIN
-		       && ses1->state == SNAT_SESSION_TCP_ESTABLISHED)
-		ses1->state = SNAT_SESSION_TCP_FIN_WAIT;
-	      else if (tcp1->flags & TCP_FLAG_ACK
-		       && ses1->state == SNAT_SESSION_TCP_FIN_WAIT)
-		snat_det_ses_close (dm1, ses1);
-	      else if (tcp1->flags & TCP_FLAG_FIN
-		       && ses1->state == SNAT_SESSION_TCP_CLOSE_WAIT)
-		ses1->state = SNAT_SESSION_TCP_LAST_ACK;
-	      else if (tcp1->flags == 0
-		       && ses1->state == SNAT_SESSION_UNKNOWN)
-		ses1->state = SNAT_SESSION_TCP_ESTABLISHED;
-
-	      sum1 = tcp1->checksum;
-	      sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
-				     ip4_header_t,
-				     dst_address /* changed member */ );
-	      sum1 = ip_csum_update (sum1, old_port1, new_port1,
-				     ip4_header_t /* cheat */ ,
-				     length /* changed member */ );
-	      mss_clamping (sm->mss_clamping, tcp1, &sum1);
-	      tcp1->checksum = ip_csum_fold (sum1);
-	    }
-	  else
-	    {
-	      ses1->state = SNAT_SESSION_UDP_ACTIVE;
-
-	      if (PREDICT_FALSE (udp1->checksum))
-		{
-		  sum1 = udp1->checksum;
-		  sum1 =
-		    ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
-				    ip4_header_t,
-				    dst_address /* changed member */ );
-		  sum1 =
-		    ip_csum_update (sum1, old_port1, new_port1,
-				    ip4_header_t /* cheat */ ,
-				    length /* changed member */ );
-		  udp1->checksum = ip_csum_fold (sum1);
-		}
-	    }
-
-	  switch (ses1->state)
-	    {
-	    case SNAT_SESSION_UDP_ACTIVE:
-	      ses1->expire = now + sm->udp_timeout;
-	      break;
-	    case SNAT_SESSION_TCP_SYN_SENT:
-	    case SNAT_SESSION_TCP_FIN_WAIT:
-	    case SNAT_SESSION_TCP_CLOSE_WAIT:
-	    case SNAT_SESSION_TCP_LAST_ACK:
-	      ses1->expire = now + sm->tcp_transitory_timeout;
-	      break;
-	    case SNAT_SESSION_TCP_ESTABLISHED:
-	      ses1->expire = now + sm->tcp_established_timeout;
-	      break;
-	    }
-
-	trace1:
-	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
-			     && (b1->flags & VLIB_BUFFER_IS_TRACED)))
-	    {
-	      nat_det_in2out_trace_t *t =
-		vlib_add_trace (vm, node, b1, sizeof (*t));
-	      t->sw_if_index = sw_if_index1;
-	      t->next_index = next1;
-	      t->session_index = ~0;
-	      if (ses1)
-		t->session_index = ses1 - dm1->sessions;
-	    }
-
-	  pkts_processed += next1 != NAT_DET_IN2OUT_NEXT_DROP;
-
-	  /* verify speculative enqueues, maybe switch current next frame */
-	  vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
-					   to_next, n_left_to_next,
-					   bi0, bi1, next0, next1);
-	}
-
-      while (n_left_from > 0 && n_left_to_next > 0)
-	{
-	  u32 bi0;
-	  vlib_buffer_t *b0;
-	  u32 next0;
-	  u32 sw_if_index0;
-	  ip4_header_t *ip0;
-	  ip_csum_t sum0;
-	  ip4_address_t new_addr0, old_addr0;
-	  u16 old_port0, new_port0, lo_port0, i0;
-	  udp_header_t *udp0;
-	  tcp_header_t *tcp0;
-	  u32 proto0;
-	  snat_det_out_key_t key0;
-	  snat_det_map_t *dm0;
-	  snat_det_session_t *ses0 = 0;
-	  u32 rx_fib_index0;
-	  icmp46_header_t *icmp0;
-
-	  /* speculatively enqueue b0 to the current next frame */
-	  bi0 = from[0];
-	  to_next[0] = bi0;
-	  from += 1;
-	  to_next += 1;
-	  n_left_from -= 1;
-	  n_left_to_next -= 1;
-
-	  b0 = vlib_get_buffer (vm, bi0);
-	  next0 = NAT_DET_IN2OUT_NEXT_LOOKUP;
-
-	  ip0 = vlib_buffer_get_current (b0);
-	  udp0 = ip4_next_header (ip0);
-	  tcp0 = (tcp_header_t *) udp0;
-
-	  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
-
-	  if (PREDICT_FALSE (ip0->ttl == 1))
-	    {
-	      vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
-	      icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
-					   ICMP4_time_exceeded_ttl_exceeded_in_transit,
-					   0);
-	      next0 = NAT_DET_IN2OUT_NEXT_ICMP_ERROR;
-	      goto trace00;
-	    }
-
-	  proto0 = ip_proto_to_nat_proto (ip0->protocol);
-
-	  if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
-	    {
-	      rx_fib_index0 =
-		ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
-	      icmp0 = (icmp46_header_t *) udp0;
-
-	      next0 = icmp_in2out (sm, b0, ip0, icmp0, sw_if_index0,
-				   rx_fib_index0, node, next0, thread_index,
-				   &ses0, &dm0);
-	      goto trace00;
-	    }
-
-	  dm0 = snat_det_map_by_user (sm, &ip0->src_address);
-	  if (PREDICT_FALSE (!dm0))
-	    {
-	      nat_log_info ("no match for internal host %U",
-			    format_ip4_address, &ip0->src_address);
-	      next0 = NAT_DET_IN2OUT_NEXT_DROP;
-	      b0->error = node->errors[NAT_DET_IN2OUT_ERROR_NO_TRANSLATION];
-	      goto trace00;
-	    }
-
-	  snat_det_forward (dm0, &ip0->src_address, &new_addr0, &lo_port0);
-
-	  key0.ext_host_addr = ip0->dst_address;
-	  key0.ext_host_port = tcp0->dst;
-
-	  ses0 =
-	    snat_det_find_ses_by_in (dm0, &ip0->src_address, tcp0->src, key0);
-	  if (PREDICT_FALSE (!ses0))
-	    {
-	      for (i0 = 0; i0 < dm0->ports_per_host; i0++)
-		{
-		  key0.out_port = clib_host_to_net_u16 (lo_port0 +
-							((i0 +
-							  clib_net_to_host_u16
-							  (tcp0->src)) %
-							 dm0->
-							 ports_per_host));
-
-		  if (snat_det_get_ses_by_out
-		      (dm0, &ip0->src_address, key0.as_u64))
-		    continue;
-
-		  ses0 =
-		    snat_det_ses_create (thread_index, dm0, &ip0->src_address,
-					 tcp0->src, &key0);
-		  break;
-		}
-	      if (PREDICT_FALSE (!ses0))
-		{
-		  /* too many sessions for user, send ICMP error packet */
-		  vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
-		  icmp4_error_set_vnet_buffer (b0,
-					       ICMP4_destination_unreachable,
-					       ICMP4_destination_unreachable_destination_unreachable_host,
-					       0);
-		  next0 = NAT_DET_IN2OUT_NEXT_ICMP_ERROR;
-		  goto trace00;
-		}
-	    }
-
-	  old_port0 = udp0->src_port;
-	  udp0->src_port = new_port0 = ses0->out.out_port;
-
-	  old_addr0.as_u32 = ip0->src_address.as_u32;
-	  ip0->src_address.as_u32 = new_addr0.as_u32;
-	  vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->outside_fib_index;
-
-	  sum0 = ip0->checksum;
-	  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
-				 ip4_header_t,
-				 src_address /* changed member */ );
-	  ip0->checksum = ip_csum_fold (sum0);
-
-	  if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
-	    {
-	      if (tcp0->flags & TCP_FLAG_SYN)
-		ses0->state = SNAT_SESSION_TCP_SYN_SENT;
-	      else if (tcp0->flags & TCP_FLAG_ACK
-		       && ses0->state == SNAT_SESSION_TCP_SYN_SENT)
-		ses0->state = SNAT_SESSION_TCP_ESTABLISHED;
-	      else if (tcp0->flags & TCP_FLAG_FIN
-		       && ses0->state == SNAT_SESSION_TCP_ESTABLISHED)
-		ses0->state = SNAT_SESSION_TCP_FIN_WAIT;
-	      else if (tcp0->flags & TCP_FLAG_ACK
-		       && ses0->state == SNAT_SESSION_TCP_FIN_WAIT)
-		snat_det_ses_close (dm0, ses0);
-	      else if (tcp0->flags & TCP_FLAG_FIN
-		       && ses0->state == SNAT_SESSION_TCP_CLOSE_WAIT)
-		ses0->state = SNAT_SESSION_TCP_LAST_ACK;
-	      else if (tcp0->flags == 0
-		       && ses0->state == SNAT_SESSION_UNKNOWN)
-		ses0->state = SNAT_SESSION_TCP_ESTABLISHED;
-
-	      sum0 = tcp0->checksum;
-	      sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
-				     ip4_header_t,
-				     dst_address /* changed member */ );
-	      sum0 = ip_csum_update (sum0, old_port0, new_port0,
-				     ip4_header_t /* cheat */ ,
-				     length /* changed member */ );
-	      mss_clamping (sm->mss_clamping, tcp0, &sum0);
-	      tcp0->checksum = ip_csum_fold (sum0);
-	    }
-	  else
-	    {
-	      ses0->state = SNAT_SESSION_UDP_ACTIVE;
-
-	      if (PREDICT_FALSE (udp0->checksum))
-		{
-		  sum0 = udp0->checksum;
-		  sum0 =
-		    ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
-				    ip4_header_t,
-				    dst_address /* changed member */ );
-		  sum0 =
-		    ip_csum_update (sum0, old_port0, new_port0,
-				    ip4_header_t /* cheat */ ,
-				    length /* changed member */ );
-		  udp0->checksum = ip_csum_fold (sum0);
-		}
-	    }
-
-	  switch (ses0->state)
-	    {
-	    case SNAT_SESSION_UDP_ACTIVE:
-	      ses0->expire = now + sm->udp_timeout;
-	      break;
-	    case SNAT_SESSION_TCP_SYN_SENT:
-	    case SNAT_SESSION_TCP_FIN_WAIT:
-	    case SNAT_SESSION_TCP_CLOSE_WAIT:
-	    case SNAT_SESSION_TCP_LAST_ACK:
-	      ses0->expire = now + sm->tcp_transitory_timeout;
-	      break;
-	    case SNAT_SESSION_TCP_ESTABLISHED:
-	      ses0->expire = now + sm->tcp_established_timeout;
-	      break;
-	    }
-
-	trace00:
-	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
-			     && (b0->flags & VLIB_BUFFER_IS_TRACED)))
-	    {
-	      nat_det_in2out_trace_t *t =
-		vlib_add_trace (vm, node, b0, sizeof (*t));
-	      t->sw_if_index = sw_if_index0;
-	      t->next_index = next0;
-	      t->session_index = ~0;
-	      if (ses0)
-		t->session_index = ses0 - dm0->sessions;
-	    }
-
-	  pkts_processed += next0 != NAT_DET_IN2OUT_NEXT_DROP;
-
-	  /* verify speculative enqueue, maybe switch current next frame */
-	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
-					   to_next, n_left_to_next,
-					   bi0, next0);
-	}
-
-      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
-    }
-
-  vlib_node_increment_counter (vm, sm->det_in2out_node_index,
-			       NAT_DET_IN2OUT_ERROR_IN2OUT_PACKETS,
-			       pkts_processed);
-  return frame->n_vectors;
-}
-
-/* *INDENT-OFF* */
-VLIB_REGISTER_NODE (snat_det_in2out_node) = {
-  .name = "nat44-det-in2out",
-  .vector_size = sizeof (u32),
-  .format_trace = format_nat_det_in2out_trace,
-  .type = VLIB_NODE_TYPE_INTERNAL,
-  .n_errors = ARRAY_LEN(nat_det_in2out_error_strings),
-  .error_strings = nat_det_in2out_error_strings,
-  .n_next_nodes = NAT_DET_IN2OUT_N_NEXT,
-  /* edit / add dispositions here */
-  .next_nodes = {
-    [NAT_DET_IN2OUT_NEXT_DROP] = "error-drop",
-    [NAT_DET_IN2OUT_NEXT_LOOKUP] = "ip4-lookup",
-    [NAT_DET_IN2OUT_NEXT_ICMP_ERROR] = "ip4-icmp-error",
-  },
-};
-/* *INDENT-ON* */
-
-/*
- * fd.io coding-style-patch-verification: ON
- *
- * Local Variables:
- * eval: (c-set-style "gnu")
- * End:
- */
diff --git a/src/plugins/nat/nat_det_out2in.c b/src/plugins/nat/nat_det_out2in.c
deleted file mode 100644
index 6a133bc..0000000
--- a/src/plugins/nat/nat_det_out2in.c
+++ /dev/null
@@ -1,725 +0,0 @@
-/*
- * Copyright (c) 2018 Cisco and/or its affiliates.
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at:
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-/**
- * @file
- * @brief Deterministic/CGN NAT44 outside to inside network translation
- */
-
-#include <vlib/vlib.h>
-#include <vnet/vnet.h>
-#include <vnet/ip/ip.h>
-#include <vnet/fib/ip4_fib.h>
-#include <vppinfra/error.h>
-#include <vppinfra/elog.h>
-#include <nat/nat.h>
-#include <nat/nat_det.h>
-#include <nat/nat_inlines.h>
-
-typedef enum
-{
-  NAT_DET_OUT2IN_NEXT_DROP,
-  NAT_DET_OUT2IN_NEXT_LOOKUP,
-  NAT_DET_OUT2IN_NEXT_ICMP_ERROR,
-  NAT_DET_OUT2IN_N_NEXT,
-} nat_det_out2in_next_t;
-
-typedef struct
-{
-  u32 sw_if_index;
-  u32 next_index;
-  u32 session_index;
-} nat_det_out2in_trace_t;
-
-#define foreach_nat_det_out2in_error                       \
-_(UNSUPPORTED_PROTOCOL, "Unsupported protocol")         \
-_(NO_TRANSLATION, "No translation")                     \
-_(BAD_ICMP_TYPE, "unsupported ICMP type")               \
-_(OUT2IN_PACKETS, "Good out2in packets processed")
-
-typedef enum
-{
-#define _(sym,str) NAT_DET_OUT2IN_ERROR_##sym,
-  foreach_nat_det_out2in_error
-#undef _
-    SNAT_OUT2IN_N_ERROR,
-} nat_det_out2in_error_t;
-
-static char *nat_det_out2in_error_strings[] = {
-#define _(sym,string) string,
-  foreach_nat_det_out2in_error
-#undef _
-};
-
-static u8 *
-format_nat_det_out2in_trace (u8 * s, va_list * args)
-{
-  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
-  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
-  nat_det_out2in_trace_t *t = va_arg (*args, nat_det_out2in_trace_t *);
-
-  s =
-    format (s,
-	    "NAT_DET_OUT2IN: sw_if_index %d, next index %d, session index %d",
-	    t->sw_if_index, t->next_index, t->session_index);
-  return s;
-}
-
-#ifndef CLIB_MARCH_VARIANT
-/**
- * Get address and port values to be used for ICMP packet translation
- * and create session if needed
- *
- * @param[in,out] sm             NAT main
- * @param[in,out] node           NAT node runtime
- * @param[in] thread_index       thread index
- * @param[in,out] b0             buffer containing packet to be translated
- * @param[in,out] ip0            ip header
- * @param[out] p_proto           protocol used for matching
- * @param[out] p_value           address and port after NAT translation
- * @param[out] p_dont_translate  if packet should not be translated
- * @param d                      optional parameter
- * @param e                      optional parameter
- */
-u32
-icmp_match_out2in_det (snat_main_t * sm, vlib_node_runtime_t * node,
-		       u32 thread_index, vlib_buffer_t * b0,
-		       ip4_header_t * ip0, ip4_address_t * addr,
-		       u16 * port, u32 * fib_index,
-		       nat_protocol_t * proto, void *d, void *e,
-		       u8 * dont_translate)
-{
-  icmp46_header_t *icmp0;
-  u32 sw_if_index0;
-  u8 protocol;
-  snat_det_out_key_t key0;
-  u32 next0 = ~0;
-  icmp_echo_header_t *echo0, *inner_echo0 = 0;
-  ip4_header_t *inner_ip0;
-  void *l4_header = 0;
-  icmp46_header_t *inner_icmp0;
-  snat_det_map_t *dm0 = 0;
-  ip4_address_t new_addr0 = { {0} };
-  snat_det_session_t *ses0 = 0;
-  ip4_address_t out_addr;
-  *dont_translate = 0;
-
-  icmp0 = (icmp46_header_t *) ip4_next_header (ip0);
-  echo0 = (icmp_echo_header_t *) (icmp0 + 1);
-  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
-
-  if (!icmp_type_is_error_message
-      (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags))
-    {
-      protocol = NAT_PROTOCOL_ICMP;
-      key0.ext_host_addr = ip0->src_address;
-      key0.ext_host_port = 0;
-      key0.out_port = vnet_buffer (b0)->ip.reass.l4_src_port;
-      out_addr = ip0->dst_address;
-    }
-  else
-    {
-      /* if error message, then it's not fragmented and we can access it */
-      inner_ip0 = (ip4_header_t *) (echo0 + 1);
-      l4_header = ip4_next_header (inner_ip0);
-      protocol = ip_proto_to_nat_proto (inner_ip0->protocol);
-      key0.ext_host_addr = inner_ip0->dst_address;
-      out_addr = inner_ip0->src_address;
-      switch (protocol)
-	{
-	case NAT_PROTOCOL_ICMP:
-	  inner_icmp0 = (icmp46_header_t *) l4_header;
-	  inner_echo0 = (icmp_echo_header_t *) (inner_icmp0 + 1);
-	  key0.ext_host_port = 0;
-	  key0.out_port = inner_echo0->identifier;
-	  break;
-	case NAT_PROTOCOL_UDP:
-	case NAT_PROTOCOL_TCP:
-	  key0.ext_host_port = ((tcp_udp_header_t *) l4_header)->dst_port;
-	  key0.out_port = ((tcp_udp_header_t *) l4_header)->src_port;
-	  break;
-	default:
-	  b0->error = node->errors[NAT_DET_OUT2IN_ERROR_UNSUPPORTED_PROTOCOL];
-	  next0 = NAT_DET_OUT2IN_NEXT_DROP;
-	  goto out;
-	}
-    }
-
-  dm0 = snat_det_map_by_out (sm, &out_addr);
-  if (PREDICT_FALSE (!dm0))
-    {
-      /* Don't NAT packet aimed at the intfc address */
-      if (PREDICT_FALSE (is_interface_addr (sm, node, sw_if_index0,
-					    ip0->dst_address.as_u32)))
-	{
-	  *dont_translate = 1;
-	  goto out;
-	}
-      nat_log_info ("unknown dst address:  %U",
-		    format_ip4_address, &ip0->dst_address);
-      goto out;
-    }
-
-  snat_det_reverse (dm0, &ip0->dst_address,
-		    clib_net_to_host_u16 (key0.out_port), &new_addr0);
-
-  ses0 = snat_det_get_ses_by_out (dm0, &new_addr0, key0.as_u64);
-  if (PREDICT_FALSE (!ses0))
-    {
-      /* Don't NAT packet aimed at the intfc address */
-      if (PREDICT_FALSE (is_interface_addr (sm, node, sw_if_index0,
-					    ip0->dst_address.as_u32)))
-	{
-	  *dont_translate = 1;
-	  goto out;
-	}
-      nat_log_info ("no match src %U:%d dst %U:%d for user %U",
-		    format_ip4_address, &key0.ext_host_addr,
-		    clib_net_to_host_u16 (key0.ext_host_port),
-		    format_ip4_address, &out_addr,
-		    clib_net_to_host_u16 (key0.out_port),
-		    format_ip4_address, &new_addr0);
-      b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
-      next0 = NAT_DET_OUT2IN_NEXT_DROP;
-      goto out;
-    }
-
-  if (PREDICT_FALSE
-      (vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags != ICMP4_echo_reply
-       && !icmp_type_is_error_message (vnet_buffer (b0)->ip.
-				       reass.icmp_type_or_tcp_flags)))
-    {
-      b0->error = node->errors[NAT_DET_OUT2IN_ERROR_BAD_ICMP_TYPE];
-      next0 = NAT_DET_OUT2IN_NEXT_DROP;
-      goto out;
-    }
-
-  goto out;
-
-out:
-  *proto = protocol;
-  if (ses0)
-    {
-      *addr = new_addr0;
-      *fib_index = sm->inside_fib_index;
-      *port = ses0->in_port;
-    }
-  if (d)
-    *(snat_det_session_t **) d = ses0;
-  if (e)
-    *(snat_det_map_t **) e = dm0;
-  return next0;
-}
-#endif
-
-VLIB_NODE_FN (snat_det_out2in_node) (vlib_main_t * vm,
-				     vlib_node_runtime_t * node,
-				     vlib_frame_t * frame)
-{
-  u32 n_left_from, *from, *to_next;
-  nat_det_out2in_next_t next_index;
-  u32 pkts_processed = 0;
-  snat_main_t *sm = &snat_main;
-  u32 thread_index = vm->thread_index;
-
-  from = vlib_frame_vector_args (frame);
-  n_left_from = frame->n_vectors;
-  next_index = node->cached_next_index;
-
-  while (n_left_from > 0)
-    {
-      u32 n_left_to_next;
-
-      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
-
-      while (n_left_from >= 4 && n_left_to_next >= 2)
-	{
-	  u32 bi0, bi1;
-	  vlib_buffer_t *b0, *b1;
-	  u32 next0 = NAT_DET_OUT2IN_NEXT_LOOKUP;
-	  u32 next1 = NAT_DET_OUT2IN_NEXT_LOOKUP;
-	  u32 sw_if_index0, sw_if_index1;
-	  ip4_header_t *ip0, *ip1;
-	  ip_csum_t sum0, sum1;
-	  ip4_address_t new_addr0, old_addr0, new_addr1, old_addr1;
-	  u16 new_port0, old_port0, old_port1, new_port1;
-	  udp_header_t *udp0, *udp1;
-	  tcp_header_t *tcp0, *tcp1;
-	  u32 proto0, proto1;
-	  snat_det_out_key_t key0, key1;
-	  snat_det_map_t *dm0, *dm1;
-	  snat_det_session_t *ses0 = 0, *ses1 = 0;
-	  u32 rx_fib_index0, rx_fib_index1;
-	  icmp46_header_t *icmp0, *icmp1;
-
-	  /* Prefetch next iteration. */
-	  {
-	    vlib_buffer_t *p2, *p3;
-
-	    p2 = vlib_get_buffer (vm, from[2]);
-	    p3 = vlib_get_buffer (vm, from[3]);
-
-	    vlib_prefetch_buffer_header (p2, LOAD);
-	    vlib_prefetch_buffer_header (p3, LOAD);
-
-	    CLIB_PREFETCH (p2->data, CLIB_CACHE_LINE_BYTES, LOAD);
-	    CLIB_PREFETCH (p3->data, CLIB_CACHE_LINE_BYTES, LOAD);
-	  }
-
-	  /* speculatively enqueue b0 and b1 to the current next frame */
-	  to_next[0] = bi0 = from[0];
-	  to_next[1] = bi1 = from[1];
-	  from += 2;
-	  to_next += 2;
-	  n_left_from -= 2;
-	  n_left_to_next -= 2;
-
-	  b0 = vlib_get_buffer (vm, bi0);
-	  b1 = vlib_get_buffer (vm, bi1);
-
-	  ip0 = vlib_buffer_get_current (b0);
-	  udp0 = ip4_next_header (ip0);
-	  tcp0 = (tcp_header_t *) udp0;
-
-	  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
-
-	  if (PREDICT_FALSE (ip0->ttl == 1))
-	    {
-	      vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
-	      icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
-					   ICMP4_time_exceeded_ttl_exceeded_in_transit,
-					   0);
-	      next0 = NAT_DET_OUT2IN_NEXT_ICMP_ERROR;
-	      goto trace0;
-	    }
-
-	  proto0 = ip_proto_to_nat_proto (ip0->protocol);
-
-	  if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
-	    {
-	      rx_fib_index0 =
-		ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
-	      icmp0 = (icmp46_header_t *) udp0;
-
-	      next0 = icmp_out2in (sm, b0, ip0, icmp0, sw_if_index0,
-				   rx_fib_index0, node, next0, thread_index,
-				   &ses0, &dm0);
-	      goto trace0;
-	    }
-
-	  key0.ext_host_addr = ip0->src_address;
-	  key0.ext_host_port = tcp0->src;
-	  key0.out_port = tcp0->dst;
-
-	  dm0 = snat_det_map_by_out (sm, &ip0->dst_address);
-	  if (PREDICT_FALSE (!dm0))
-	    {
-	      nat_log_info ("unknown dst address:  %U",
-			    format_ip4_address, &ip0->dst_address);
-	      next0 = NAT_DET_OUT2IN_NEXT_DROP;
-	      b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
-	      goto trace0;
-	    }
-
-	  snat_det_reverse (dm0, &ip0->dst_address,
-			    clib_net_to_host_u16 (tcp0->dst), &new_addr0);
-
-	  ses0 = snat_det_get_ses_by_out (dm0, &new_addr0, key0.as_u64);
-	  if (PREDICT_FALSE (!ses0))
-	    {
-	      nat_log_info ("no match src %U:%d dst %U:%d for user %U",
-			    format_ip4_address, &ip0->src_address,
-			    clib_net_to_host_u16 (tcp0->src),
-			    format_ip4_address, &ip0->dst_address,
-			    clib_net_to_host_u16 (tcp0->dst),
-			    format_ip4_address, &new_addr0);
-	      next0 = NAT_DET_OUT2IN_NEXT_DROP;
-	      b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
-	      goto trace0;
-	    }
-	  old_port0 = udp0->dst_port;
-	  udp0->dst_port = new_port0 = ses0->in_port;
-
-	  old_addr0 = ip0->dst_address;
-	  ip0->dst_address = new_addr0;
-	  vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->inside_fib_index;
-
-	  sum0 = ip0->checksum;
-	  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
-				 ip4_header_t,
-				 dst_address /* changed member */ );
-	  ip0->checksum = ip_csum_fold (sum0);
-
-	  if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
-	    {
-	      if (tcp0->flags & TCP_FLAG_FIN
-		  && ses0->state == SNAT_SESSION_TCP_ESTABLISHED)
-		ses0->state = SNAT_SESSION_TCP_CLOSE_WAIT;
-	      else if (tcp0->flags & TCP_FLAG_ACK
-		       && ses0->state == SNAT_SESSION_TCP_LAST_ACK)
-		snat_det_ses_close (dm0, ses0);
-
-	      sum0 = tcp0->checksum;
-	      sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
-				     ip4_header_t,
-				     dst_address /* changed member */ );
-	      sum0 = ip_csum_update (sum0, old_port0, new_port0,
-				     ip4_header_t /* cheat */ ,
-				     length /* changed member */ );
-	      tcp0->checksum = ip_csum_fold (sum0);
-	    }
-	  else if (udp0->checksum)
-	    {
-	      sum0 = udp0->checksum;
-	      sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
-				     ip4_header_t,
-				     dst_address /* changed member */ );
-	      sum0 = ip_csum_update (sum0, old_port0, new_port0,
-				     ip4_header_t /* cheat */ ,
-				     length /* changed member */ );
-	      udp0->checksum = ip_csum_fold (sum0);
-	    }
-
-	trace0:
-
-	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
-			     && (b0->flags & VLIB_BUFFER_IS_TRACED)))
-	    {
-	      nat_det_out2in_trace_t *t =
-		vlib_add_trace (vm, node, b0, sizeof (*t));
-	      t->sw_if_index = sw_if_index0;
-	      t->next_index = next0;
-	      t->session_index = ~0;
-	      if (ses0)
-		t->session_index = ses0 - dm0->sessions;
-	    }
-
-	  pkts_processed += next0 != NAT_DET_OUT2IN_NEXT_DROP;
-
-	  b1 = vlib_get_buffer (vm, bi1);
-
-	  ip1 = vlib_buffer_get_current (b1);
-	  udp1 = ip4_next_header (ip1);
-	  tcp1 = (tcp_header_t *) udp1;
-
-	  sw_if_index1 = vnet_buffer (b1)->sw_if_index[VLIB_RX];
-
-	  if (PREDICT_FALSE (ip1->ttl == 1))
-	    {
-	      vnet_buffer (b1)->sw_if_index[VLIB_TX] = (u32) ~ 0;
-	      icmp4_error_set_vnet_buffer (b1, ICMP4_time_exceeded,
-					   ICMP4_time_exceeded_ttl_exceeded_in_transit,
-					   0);
-	      next1 = NAT_DET_OUT2IN_NEXT_ICMP_ERROR;
-	      goto trace1;
-	    }
-
-	  proto1 = ip_proto_to_nat_proto (ip1->protocol);
-
-	  if (PREDICT_FALSE (proto1 == NAT_PROTOCOL_ICMP))
-	    {
-	      rx_fib_index1 =
-		ip4_fib_table_get_index_for_sw_if_index (sw_if_index1);
-	      icmp1 = (icmp46_header_t *) udp1;
-
-	      next1 = icmp_out2in (sm, b1, ip1, icmp1, sw_if_index1,
-				   rx_fib_index1, node, next1, thread_index,
-				   &ses1, &dm1);
-	      goto trace1;
-	    }
-
-	  key1.ext_host_addr = ip1->src_address;
-	  key1.ext_host_port = tcp1->src;
-	  key1.out_port = tcp1->dst;
-
-	  dm1 = snat_det_map_by_out (sm, &ip1->dst_address);
-	  if (PREDICT_FALSE (!dm1))
-	    {
-	      nat_log_info ("unknown dst address:  %U",
-			    format_ip4_address, &ip1->dst_address);
-	      next1 = NAT_DET_OUT2IN_NEXT_DROP;
-	      b1->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
-	      goto trace1;
-	    }
-
-	  snat_det_reverse (dm1, &ip1->dst_address,
-			    clib_net_to_host_u16 (tcp1->dst), &new_addr1);
-
-	  ses1 = snat_det_get_ses_by_out (dm1, &new_addr1, key1.as_u64);
-	  if (PREDICT_FALSE (!ses1))
-	    {
-	      nat_log_info ("no match src %U:%d dst %U:%d for user %U",
-			    format_ip4_address, &ip1->src_address,
-			    clib_net_to_host_u16 (tcp1->src),
-			    format_ip4_address, &ip1->dst_address,
-			    clib_net_to_host_u16 (tcp1->dst),
-			    format_ip4_address, &new_addr1);
-	      next1 = NAT_DET_OUT2IN_NEXT_DROP;
-	      b1->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
-	      goto trace1;
-	    }
-	  old_port1 = udp1->dst_port;
-	  udp1->dst_port = new_port1 = ses1->in_port;
-
-	  old_addr1 = ip1->dst_address;
-	  ip1->dst_address = new_addr1;
-	  vnet_buffer (b1)->sw_if_index[VLIB_TX] = sm->inside_fib_index;
-
-	  sum1 = ip1->checksum;
-	  sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
-				 ip4_header_t,
-				 dst_address /* changed member */ );
-	  ip1->checksum = ip_csum_fold (sum1);
-
-	  if (PREDICT_TRUE (proto1 == NAT_PROTOCOL_TCP))
-	    {
-	      if (tcp1->flags & TCP_FLAG_FIN
-		  && ses1->state == SNAT_SESSION_TCP_ESTABLISHED)
-		ses1->state = SNAT_SESSION_TCP_CLOSE_WAIT;
-	      else if (tcp1->flags & TCP_FLAG_ACK
-		       && ses1->state == SNAT_SESSION_TCP_LAST_ACK)
-		snat_det_ses_close (dm1, ses1);
-
-	      sum1 = tcp1->checksum;
-	      sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
-				     ip4_header_t,
-				     dst_address /* changed member */ );
-	      sum1 = ip_csum_update (sum1, old_port1, new_port1,
-				     ip4_header_t /* cheat */ ,
-				     length /* changed member */ );
-	      tcp1->checksum = ip_csum_fold (sum1);
-	    }
-	  else if (udp1->checksum)
-	    {
-	      sum1 = udp1->checksum;
-	      sum1 = ip_csum_update (sum1, old_addr1.as_u32, new_addr1.as_u32,
-				     ip4_header_t,
-				     dst_address /* changed member */ );
-	      sum1 = ip_csum_update (sum1, old_port1, new_port1,
-				     ip4_header_t /* cheat */ ,
-				     length /* changed member */ );
-	      udp1->checksum = ip_csum_fold (sum1);
-	    }
-
-	trace1:
-
-	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
-			     && (b1->flags & VLIB_BUFFER_IS_TRACED)))
-	    {
-	      nat_det_out2in_trace_t *t =
-		vlib_add_trace (vm, node, b1, sizeof (*t));
-	      t->sw_if_index = sw_if_index1;
-	      t->next_index = next1;
-	      t->session_index = ~0;
-	      if (ses1)
-		t->session_index = ses1 - dm1->sessions;
-	    }
-
-	  pkts_processed += next1 != NAT_DET_OUT2IN_NEXT_DROP;
-
-	  /* verify speculative enqueues, maybe switch current next frame */
-	  vlib_validate_buffer_enqueue_x2 (vm, node, next_index,
-					   to_next, n_left_to_next,
-					   bi0, bi1, next0, next1);
-	}
-
-      while (n_left_from > 0 && n_left_to_next > 0)
-	{
-	  u32 bi0;
-	  vlib_buffer_t *b0;
-	  u32 next0 = NAT_DET_OUT2IN_NEXT_LOOKUP;
-	  u32 sw_if_index0;
-	  ip4_header_t *ip0;
-	  ip_csum_t sum0;
-	  ip4_address_t new_addr0, old_addr0;
-	  u16 new_port0, old_port0;
-	  udp_header_t *udp0;
-	  tcp_header_t *tcp0;
-	  u32 proto0;
-	  snat_det_out_key_t key0;
-	  snat_det_map_t *dm0;
-	  snat_det_session_t *ses0 = 0;
-	  u32 rx_fib_index0;
-	  icmp46_header_t *icmp0;
-
-	  /* speculatively enqueue b0 to the current next frame */
-	  bi0 = from[0];
-	  to_next[0] = bi0;
-	  from += 1;
-	  to_next += 1;
-	  n_left_from -= 1;
-	  n_left_to_next -= 1;
-
-	  b0 = vlib_get_buffer (vm, bi0);
-
-	  ip0 = vlib_buffer_get_current (b0);
-	  udp0 = ip4_next_header (ip0);
-	  tcp0 = (tcp_header_t *) udp0;
-
-	  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
-
-	  if (PREDICT_FALSE (ip0->ttl == 1))
-	    {
-	      vnet_buffer (b0)->sw_if_index[VLIB_TX] = (u32) ~ 0;
-	      icmp4_error_set_vnet_buffer (b0, ICMP4_time_exceeded,
-					   ICMP4_time_exceeded_ttl_exceeded_in_transit,
-					   0);
-	      next0 = NAT_DET_OUT2IN_NEXT_ICMP_ERROR;
-	      goto trace00;
-	    }
-
-	  proto0 = ip_proto_to_nat_proto (ip0->protocol);
-
-	  if (PREDICT_FALSE (proto0 == NAT_PROTOCOL_ICMP))
-	    {
-	      rx_fib_index0 =
-		ip4_fib_table_get_index_for_sw_if_index (sw_if_index0);
-	      icmp0 = (icmp46_header_t *) udp0;
-
-	      next0 = icmp_out2in (sm, b0, ip0, icmp0, sw_if_index0,
-				   rx_fib_index0, node, next0, thread_index,
-				   &ses0, &dm0);
-	      goto trace00;
-	    }
-
-	  key0.ext_host_addr = ip0->src_address;
-	  key0.ext_host_port = tcp0->src;
-	  key0.out_port = tcp0->dst;
-
-	  dm0 = snat_det_map_by_out (sm, &ip0->dst_address);
-	  if (PREDICT_FALSE (!dm0))
-	    {
-	      nat_log_info ("unknown dst address:  %U",
-			    format_ip4_address, &ip0->dst_address);
-	      next0 = NAT_DET_OUT2IN_NEXT_DROP;
-	      b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
-	      goto trace00;
-	    }
-
-	  snat_det_reverse (dm0, &ip0->dst_address,
-			    clib_net_to_host_u16 (tcp0->dst), &new_addr0);
-
-	  ses0 = snat_det_get_ses_by_out (dm0, &new_addr0, key0.as_u64);
-	  if (PREDICT_FALSE (!ses0))
-	    {
-	      nat_log_info ("no match src %U:%d dst %U:%d for user %U",
-			    format_ip4_address, &ip0->src_address,
-			    clib_net_to_host_u16 (tcp0->src),
-			    format_ip4_address, &ip0->dst_address,
-			    clib_net_to_host_u16 (tcp0->dst),
-			    format_ip4_address, &new_addr0);
-	      next0 = NAT_DET_OUT2IN_NEXT_DROP;
-	      b0->error = node->errors[NAT_DET_OUT2IN_ERROR_NO_TRANSLATION];
-	      goto trace00;
-	    }
-	  old_port0 = udp0->dst_port;
-	  udp0->dst_port = new_port0 = ses0->in_port;
-
-	  old_addr0 = ip0->dst_address;
-	  ip0->dst_address = new_addr0;
-	  vnet_buffer (b0)->sw_if_index[VLIB_TX] = sm->inside_fib_index;
-
-	  sum0 = ip0->checksum;
-	  sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
-				 ip4_header_t,
-				 dst_address /* changed member */ );
-	  ip0->checksum = ip_csum_fold (sum0);
-
-	  if (PREDICT_TRUE (proto0 == NAT_PROTOCOL_TCP))
-	    {
-	      if (tcp0->flags & TCP_FLAG_FIN
-		  && ses0->state == SNAT_SESSION_TCP_ESTABLISHED)
-		ses0->state = SNAT_SESSION_TCP_CLOSE_WAIT;
-	      else if (tcp0->flags & TCP_FLAG_ACK
-		       && ses0->state == SNAT_SESSION_TCP_LAST_ACK)
-		snat_det_ses_close (dm0, ses0);
-
-	      sum0 = tcp0->checksum;
-	      sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
-				     ip4_header_t,
-				     dst_address /* changed member */ );
-	      sum0 = ip_csum_update (sum0, old_port0, new_port0,
-				     ip4_header_t /* cheat */ ,
-				     length /* changed member */ );
-	      tcp0->checksum = ip_csum_fold (sum0);
-	    }
-	  else if (udp0->checksum)
-	    {
-	      sum0 = udp0->checksum;
-	      sum0 = ip_csum_update (sum0, old_addr0.as_u32, new_addr0.as_u32,
-				     ip4_header_t,
-				     dst_address /* changed member */ );
-	      sum0 = ip_csum_update (sum0, old_port0, new_port0,
-				     ip4_header_t /* cheat */ ,
-				     length /* changed member */ );
-	      udp0->checksum = ip_csum_fold (sum0);
-	    }
-
-	trace00:
-
-	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
-			     && (b0->flags & VLIB_BUFFER_IS_TRACED)))
-	    {
-	      nat_det_out2in_trace_t *t =
-		vlib_add_trace (vm, node, b0, sizeof (*t));
-	      t->sw_if_index = sw_if_index0;
-	      t->next_index = next0;
-	      t->session_index = ~0;
-	      if (ses0)
-		t->session_index = ses0 - dm0->sessions;
-	    }
-
-	  pkts_processed += next0 != NAT_DET_OUT2IN_NEXT_DROP;
-
-	  /* verify speculative enqueue, maybe switch current next frame */
-	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
-					   to_next, n_left_to_next,
-					   bi0, next0);
-	}
-
-      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
-    }
-
-  vlib_node_increment_counter (vm, sm->det_out2in_node_index,
-			       NAT_DET_OUT2IN_ERROR_OUT2IN_PACKETS,
-			       pkts_processed);
-  return frame->n_vectors;
-}
-
-/* *INDENT-OFF* */
-VLIB_REGISTER_NODE (snat_det_out2in_node) = {
-  .name = "nat44-det-out2in",
-  .vector_size = sizeof (u32),
-  .format_trace = format_nat_det_out2in_trace,
-  .type = VLIB_NODE_TYPE_INTERNAL,
-  .n_errors = ARRAY_LEN(nat_det_out2in_error_strings),
-  .error_strings = nat_det_out2in_error_strings,
-  .runtime_data_bytes = sizeof (snat_runtime_t),
-  .n_next_nodes = NAT_DET_OUT2IN_N_NEXT,
-  /* edit / add dispositions here */
-  .next_nodes = {
-    [NAT_DET_OUT2IN_NEXT_DROP] = "error-drop",
-    [NAT_DET_OUT2IN_NEXT_LOOKUP] = "ip4-lookup",
-    [NAT_DET_OUT2IN_NEXT_ICMP_ERROR] = "ip4-icmp-error",
-  },
-};
-/* *INDENT-ON* */
-
-/*
- * fd.io coding-style-patch-verification: ON
- *
- * Local Variables:
- * eval: (c-set-style "gnu")
- * End:
- */
diff --git a/src/plugins/nat/nat_format.c b/src/plugins/nat/nat_format.c
index 8287968..e47ba69 100644
--- a/src/plugins/nat/nat_format.c
+++ b/src/plugins/nat/nat_format.c
@@ -19,7 +19,6 @@
 
 #include <nat/nat.h>
 #include <nat/nat_inlines.h>
-#include <nat/nat_det.h>
 
 uword
 unformat_nat_protocol (unformat_input_t * input, va_list * args)
@@ -297,39 +296,6 @@
   return s;
 }
 
-u8 *
-format_det_map_ses (u8 * s, va_list * args)
-{
-  snat_det_map_t *det_map = va_arg (*args, snat_det_map_t *);
-  ip4_address_t in_addr, out_addr;
-  u32 in_offset, out_offset;
-  snat_det_session_t *ses = va_arg (*args, snat_det_session_t *);
-  u32 *i = va_arg (*args, u32 *);
-
-  u32 user_index = *i / SNAT_DET_SES_PER_USER;
-  in_addr.as_u32 =
-    clib_host_to_net_u32 (clib_net_to_host_u32 (det_map->in_addr.as_u32) +
-			  user_index);
-  in_offset =
-    clib_net_to_host_u32 (in_addr.as_u32) -
-    clib_net_to_host_u32 (det_map->in_addr.as_u32);
-  out_offset = in_offset / det_map->sharing_ratio;
-  out_addr.as_u32 =
-    clib_host_to_net_u32 (clib_net_to_host_u32 (det_map->out_addr.as_u32) +
-			  out_offset);
-  s =
-    format (s,
-	    "in %U:%d out %U:%d external host %U:%d state: %U expire: %d\n",
-	    format_ip4_address, &in_addr, clib_net_to_host_u16 (ses->in_port),
-	    format_ip4_address, &out_addr,
-	    clib_net_to_host_u16 (ses->out.out_port), format_ip4_address,
-	    &ses->out.ext_host_addr,
-	    clib_net_to_host_u16 (ses->out.ext_host_port),
-	    format_snat_session_state, ses->state, ses->expire);
-
-  return s;
-}
-
 /*
  * fd.io coding-style-patch-verification: ON
  *
diff --git a/src/plugins/nat/nat_ipfix_logging.c b/src/plugins/nat/nat_ipfix_logging.c
index 59387e1..3b75260 100644
--- a/src/plugins/nat/nat_ipfix_logging.c
+++ b/src/plugins/nat/nat_ipfix_logging.c
@@ -1528,83 +1528,78 @@
   a.src_port = src_port ? src_port : UDP_DST_PORT_ipfix;
   a.flow_data_callback = data_callback;
 
-  if (sm->deterministic)
+  /* TODO: ipfix needs to be separated from NAT base plugin
+  a.rewrite_callback = snat_template_rewrite_max_entries_per_usr;
+  rv = vnet_flow_report_add_del (frm, &a, NULL);
+  if (rv)
+    {
+      nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv);
+      return -1;
+    }
+  */
+  a.rewrite_callback = snat_template_rewrite_nat44_session;
+
+  rv = vnet_flow_report_add_del (frm, &a, NULL);
+  if (rv)
+    {
+      nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv);
+      return -1;
+    }
+
+  a.rewrite_callback = snat_template_rewrite_addr_exhausted;
+
+  rv = vnet_flow_report_add_del (frm, &a, NULL);
+  if (rv)
+    {
+      nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv);
+      return -1;
+    }
+
+  a.rewrite_callback = nat_template_rewrite_max_sessions;
+
+  rv = vnet_flow_report_add_del (frm, &a, NULL);
+  if (rv)
+    {
+      nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv);
+      return -1;
+    }
+
+  a.rewrite_callback = nat_template_rewrite_max_bibs;
+
+  rv = vnet_flow_report_add_del (frm, &a, NULL);
+  if (rv)
+    {
+      nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv);
+      return -1;
+    }
+
+  a.rewrite_callback = nat_template_rewrite_nat64_bib;
+
+  rv = vnet_flow_report_add_del (frm, &a, NULL);
+  if (rv)
+    {
+      nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv);
+      return -1;
+    }
+
+  a.rewrite_callback = nat_template_rewrite_nat64_session;
+
+  rv = vnet_flow_report_add_del (frm, &a, NULL);
+  if (rv)
+    {
+      nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv);
+      return -1;
+    }
+
+  if (sm->endpoint_dependent)
     {
       a.rewrite_callback = snat_template_rewrite_max_entries_per_usr;
 
       rv = vnet_flow_report_add_del (frm, &a, NULL);
       if (rv)
-	{
-	  nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv);
-	  return -1;
-	}
-    }
-  else
-    {
-      a.rewrite_callback = snat_template_rewrite_nat44_session;
-
-      rv = vnet_flow_report_add_del (frm, &a, NULL);
-      if (rv)
-	{
-	  nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv);
-	  return -1;
-	}
-
-      a.rewrite_callback = snat_template_rewrite_addr_exhausted;
-
-      rv = vnet_flow_report_add_del (frm, &a, NULL);
-      if (rv)
-	{
-	  nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv);
-	  return -1;
-	}
-
-      a.rewrite_callback = nat_template_rewrite_max_sessions;
-
-      rv = vnet_flow_report_add_del (frm, &a, NULL);
-      if (rv)
-	{
-	  nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv);
-	  return -1;
-	}
-
-      a.rewrite_callback = nat_template_rewrite_max_bibs;
-
-      rv = vnet_flow_report_add_del (frm, &a, NULL);
-      if (rv)
-	{
-	  nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv);
-	  return -1;
-	}
-
-      a.rewrite_callback = nat_template_rewrite_nat64_bib;
-
-      rv = vnet_flow_report_add_del (frm, &a, NULL);
-      if (rv)
-	{
-	  nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv);
-	  return -1;
-	}
-
-      a.rewrite_callback = nat_template_rewrite_nat64_session;
-
-      rv = vnet_flow_report_add_del (frm, &a, NULL);
-      if (rv)
-	{
-	  nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv);
-	  return -1;
-	}
-
-      if (sm->endpoint_dependent)
         {
-          a.rewrite_callback = snat_template_rewrite_max_entries_per_usr;
-
-          rv = vnet_flow_report_add_del (frm, &a, NULL);
-          if (rv)
-            {
-              nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv);
-              return -1;
-            }
+          nat_elog_warn_X1 ("vnet_flow_report_add_del returned %d", "i4", rv);
+          return -1;
         }
     }
 
diff --git a/src/plugins/nat/nat_test.c b/src/plugins/nat/nat_test.c
index 46fbfc7..0cc34f0 100644
--- a/src/plugins/nat/nat_test.c
+++ b/src/plugins/nat/nat_test.c
@@ -1,4 +1,3 @@
-
 /*
  * nat.c - skeleton vpp-api-test plug-in
  *
@@ -69,16 +68,13 @@
 _(nat_set_workers_reply)                         \
 _(nat44_add_del_interface_addr_reply)            \
 _(nat_ipfix_enable_disable_reply)                \
-_(nat_det_add_del_map_reply)                     \
-_(nat_set_timeouts_reply)                        \
-_(nat_det_close_session_out_reply)               \
-_(nat_det_close_session_in_reply)
+_(nat_set_timeouts_reply)
 
 #define _(n)                                            \
     static void vl_api_##n##_t_handler                  \
     (vl_api_##n##_t * mp)                               \
     {                                                   \
-        vat_main_t * vam = snat_test_main.vat_main;   \
+        vat_main_t * vam = snat_test_main.vat_main;     \
         i32 retval = ntohl(mp->retval);                 \
         if (vam->async_mode) {                          \
             vam->async_errors += (retval < 0);          \
@@ -117,17 +113,8 @@
   nat_ipfix_enable_disable_reply)                               \
 _(NAT44_USER_DETAILS, nat44_user_details)                       \
 _(NAT44_USER_SESSION_DETAILS, nat44_user_session_details)       \
-_(NAT_DET_ADD_DEL_MAP_REPLY, nat_det_add_del_map_reply)         \
-_(NAT_DET_FORWARD_REPLY, nat_det_forward_reply)                 \
-_(NAT_DET_REVERSE_REPLY, nat_det_reverse_reply)                 \
-_(NAT_DET_MAP_DETAILS, nat_det_map_details)                     \
 _(NAT_SET_TIMEOUTS_REPLY, nat_set_timeouts_reply)               \
-_(NAT_GET_TIMEOUTS_REPLY, nat_get_timeouts_reply)               \
-_(NAT_DET_CLOSE_SESSION_OUT_REPLY,                              \
-  nat_det_close_session_out_reply)                              \
-_(NAT_DET_CLOSE_SESSION_IN_REPLY,                               \
-  nat_det_close_session_in_reply)                               \
-_(NAT_DET_SESSION_DETAILS, nat_det_session_details)
+_(NAT_GET_TIMEOUTS_REPLY, nat_get_timeouts_reply)
 
 static int api_nat44_add_del_address_range (vat_main_t * vam)
 {
@@ -827,159 +814,6 @@
   return ret;
 }
 
-static int api_nat_det_add_del_map (vat_main_t * vam)
-{
-  unformat_input_t * i = vam->input;
-  vl_api_nat_det_add_del_map_t * mp;
-  ip4_address_t in_addr, out_addr;
-  u32 in_plen, out_plen;
-  u8 is_add = 1;
-  int ret;
-
-  if (unformat (i, "in %U/%d out %U/%d",
-                unformat_ip4_address, &in_addr, &in_plen,
-                unformat_ip4_address, &out_addr, &out_plen))
-    ;
-  else if (unformat (i, "del"))
-    is_add = 0;
-  else
-    {
-      clib_warning("unknown input '%U'", format_unformat_error, i);
-      return -99;
-    }
-
-  M(NAT_DET_ADD_DEL_MAP, mp);
-  clib_memcpy(mp->in_addr, &in_addr, 4);
-  mp->in_plen = in_plen;
-  clib_memcpy(mp->out_addr, &out_addr, 4);
-  mp->out_plen = out_plen;
-  mp->is_add = is_add;
-
-  S(mp);
-  W (ret);
-  return ret;
-}
-
-static void vl_api_nat_det_forward_reply_t_handler
-  (vl_api_nat_det_forward_reply_t *mp)
-{
-  snat_test_main_t * sm = &snat_test_main;
-  vat_main_t *vam = sm->vat_main;
-  i32 retval = ntohl(mp->retval);
-
-  if (retval >= 0)
-  {
-    fformat (vam->ofp, "outside address %U", format_ip4_address, &mp->out_addr);
-    fformat (vam->ofp, " outside port range start %d", ntohs(mp->out_port_lo));
-    fformat (vam->ofp, " outside port range end %d\n", ntohs(mp->out_port_hi));
-  }
-
-  vam->retval = retval;
-  vam->result_ready = 1;
-}
-
-static int api_nat_det_forward (vat_main_t * vam)
-{
-  unformat_input_t * i = vam->input;
-  vl_api_nat_det_forward_t * mp;
-  ip4_address_t in_addr;
-  int ret;
-
-  if (unformat (i, "%U", unformat_ip4_address, &in_addr))
-    ;
-  else
-    {
-      clib_warning("unknown input '%U'", format_unformat_error, i);
-      return -99;
-    }
-
-  M(NAT_DET_FORWARD, mp);
-  clib_memcpy(mp->in_addr, &in_addr, 4);
-
-  S(mp);
-  W(ret);
-  return ret;
-}
-
-static void vl_api_nat_det_reverse_reply_t_handler
-  (vl_api_nat_det_reverse_reply_t *mp)
-{
-  snat_test_main_t * sm = &snat_test_main;
-  vat_main_t *vam = sm->vat_main;
-  i32 retval = ntohl(mp->retval);
-
-  if (retval >= 0)
-  {
-    fformat (vam->ofp, "inside address %U\n", format_ip4_address, &mp->in_addr);
-  }
-
-  vam->retval = retval;
-  vam->result_ready = 1;
-}
-
-static int api_nat_det_reverse (vat_main_t * vam)
-{
-  unformat_input_t * i = vam->input;
-  vl_api_nat_det_reverse_t * mp;
-  ip4_address_t out_addr;
-  u32 out_port;
-  int ret;
-
-  if (unformat (i, "%U %d", unformat_ip4_address, &out_addr, &out_port))
-    ;
-  else
-    {
-      clib_warning("unknown input '%U'", format_unformat_error, i);
-      return -99;
-    }
-
-  M(NAT_DET_REVERSE, mp);
-  clib_memcpy(mp->out_addr, &out_addr, 4);
-  mp->out_port = htons((u16)out_port);
-
-  S(mp);
-  W(ret);
-  return ret;
-}
-
-static void vl_api_nat_det_map_details_t_handler
-  (vl_api_nat_det_map_details_t *mp)
-{
-  snat_test_main_t * sm = &snat_test_main;
-  vat_main_t *vam = sm->vat_main;
-
-  fformat (vam->ofp, "Deterministic S-NAT mapping in %U/%d out %U/%d "
-                     "ports per host %d sharing ratio %d "
-                     "number of sessions %d",
-           format_ip4_address, mp->in_addr, mp->in_plen,
-           format_ip4_address, mp->out_addr, mp->out_plen,
-           ntohs(mp->ports_per_host), ntohl(mp->sharing_ratio),
-           ntohl(mp->ses_num));
-}
-
-static int api_nat_det_map_dump(vat_main_t * vam)
-{
-  vl_api_nat_det_map_dump_t * mp;
-  vl_api_nat_control_ping_t *mp_ping;
-  int ret;
-
-  if (vam->json_output)
-    {
-      clib_warning ("JSON output not supported for nat_det_map_dump");
-      return -99;
-    }
-
-  M(NAT_DET_MAP_DUMP, mp);
-  S(mp);
-
-  /* Use a control ping for synchronization */
-  M(NAT_CONTROL_PING, mp_ping);
-  S(mp_ping);
-
-  W (ret);
-  return ret;
-}
-
 static int api_nat_set_timeouts (vat_main_t * vam)
 {
   unformat_input_t * i = vam->input;
@@ -1052,110 +886,6 @@
   return ret;
 }
 
-static int api_nat_det_close_session_out (vat_main_t * vam)
-{
-  unformat_input_t * i = vam->input;
-  vl_api_nat_det_close_session_out_t * mp;
-  ip4_address_t out_addr, ext_addr;
-  u32 out_port, ext_port;
-  int ret;
-
-  if (unformat (i, "%U:%d %U:%d",
-                unformat_ip4_address, &out_addr, &out_port,
-                unformat_ip4_address, &ext_addr, &ext_port))
-    ;
-  else
-    {
-      clib_warning("unknown input '%U'", format_unformat_error, i);
-      return -99;
-    }
-
-  M(NAT_DET_CLOSE_SESSION_OUT, mp);
-  clib_memcpy(mp->out_addr, &out_addr, 4);
-  mp->out_port = ntohs((u16)out_port);
-  clib_memcpy(mp->ext_addr, &ext_addr, 4);
-  mp->ext_port = ntohs((u16)ext_port);
-
-  S(mp);
-  W (ret);
-  return ret;
-}
-
-static int api_nat_det_close_session_in (vat_main_t * vam)
-{
-  unformat_input_t * i = vam->input;
-  vl_api_nat_det_close_session_in_t * mp;
-  ip4_address_t in_addr, ext_addr;
-  u32 in_port, ext_port;
-  int ret;
-
-  if (unformat (i, "%U:%d %U:%d",
-                unformat_ip4_address, &in_addr, &in_port,
-                unformat_ip4_address, &ext_addr, &ext_port))
-    ;
-  else
-    {
-      clib_warning("unknown input '%U'", format_unformat_error, i);
-      return -99;
-    }
-
-  M(NAT_DET_CLOSE_SESSION_IN, mp);
-  clib_memcpy(mp->in_addr, &in_addr, 4);
-  mp->in_port = ntohs((u16)in_port);
-  clib_memcpy(mp->ext_addr, &ext_addr, 4);
-  mp->ext_port = ntohs((u16)ext_port);
-
-  S(mp);
-  W (ret);
-  return ret;
-}
-
-static void vl_api_nat_det_session_details_t_handler
-  (vl_api_nat_det_session_details_t *mp)
-{
-  snat_test_main_t * sm = &snat_test_main;
-  vat_main_t *vam = sm->vat_main;
-
-  fformat(vam->ofp, "deterministic session, external host address %U, "
-                    "external host port %d, outer port %d, inside port %d",
-          format_ip4_address, mp->ext_addr, mp->ext_port,
-          mp->out_port, mp->in_port);
-}
-
-static int api_nat_det_session_dump(vat_main_t * vam)
-{
-  unformat_input_t* i = vam->input;
-  vl_api_nat_det_session_dump_t * mp;
-  vl_api_nat_control_ping_t *mp_ping;
-  ip4_address_t user_addr;
-  int ret;
-
-  if (vam->json_output)
-    {
-      clib_warning ("JSON output not supported for nat_det_session_dump");
-      return -99;
-    }
-
-  if (unformat (i, "user_addr %U", unformat_ip4_address, &user_addr))
-    ;
-  else
-    {
-      clib_warning ("unknown input '%U'", format_unformat_error, i);
-      return -99;
-    }
-
-  M(NAT_DET_SESSION_DUMP, mp);
-  clib_memcpy (&mp->user_addr, &user_addr, 4);
-  S(mp);
-
-  /* Use a control ping for synchronization */
-  M(NAT_CONTROL_PING, mp_ping);
-  S(mp_ping);
-
-  W (ret);
-  return ret;
-}
-
 /*
  * List of messages that the api test plugin sends,
  * and that the data plane plugin processes
@@ -1184,19 +914,9 @@
   "[disable]")                                                    \
 _(nat44_user_dump, "")                                            \
 _(nat44_user_session_dump, "ip_address <ip> vrf_id <table-id>")   \
-_(nat_det_add_del_map, "in <in_addr>/<in_plen> out "              \
-  "<out_addr>/<out_plen> [del]")                                  \
-_(nat_det_forward, "<in_addr>")                                   \
-_(nat_det_reverse, "<out_addr> <out_port>")                       \
-_(nat_det_map_dump, "")                                           \
 _(nat_set_timeouts, "[udp <sec> | tcp_established <sec> | "       \
   "tcp_transitory <sec> | icmp <sec>]")                           \
-_(nat_get_timeouts, "")                                           \
-_(nat_det_close_session_out, "<out_addr>:<out_port> "             \
-  "<ext_addr>:<ext_port>")                                        \
-_(nat_det_close_session_in, "<in_addr>:<in_port> "                \
-  "<out_addr>:<out_port>")                                        \
-_(nat_det_session_dump, "ip_address <user_addr>")
+_(nat_get_timeouts, "")
 
 static void
 snat_vat_api_hookup (vat_main_t *vam)
diff --git a/src/plugins/nat/test/test_det44.py b/src/plugins/nat/test/test_det44.py
new file mode 100644
index 0000000..ced7746
--- /dev/null
+++ b/src/plugins/nat/test/test_det44.py
@@ -0,0 +1,682 @@
+#!/usr/bin/env python3
+
+import socket
+import struct
+import unittest
+import scapy.compat
+from time import sleep
+from framework import VppTestCase, running_extended_tests
+from ipfix import IPFIX, Set, Template, Data, IPFIXDecoder
+from scapy.layers.inet import IP, TCP, UDP, ICMP
+from scapy.layers.inet import IPerror, UDPerror
+from scapy.layers.l2 import Ether
+from util import ppp
+
+
+class TestDET44(VppTestCase):
+    """ Deterministic NAT Test Cases """
+
+    @classmethod
+    def setUpClass(cls):
+        super(TestDET44, cls).setUpClass()
+        cls.vapi.cli("set log class det44 level debug")
+
+        cls.tcp_port_in = 6303
+        cls.tcp_external_port = 6303
+        cls.udp_port_in = 6304
+        cls.udp_external_port = 6304
+        cls.icmp_id_in = 6305
+        cls.nat_addr = '10.0.0.3'
+
+        cls.create_pg_interfaces(range(3))
+        cls.interfaces = list(cls.pg_interfaces)
+
+        for i in cls.interfaces:
+            i.admin_up()
+            i.config_ip4()
+            i.resolve_arp()
+
+        cls.pg0.generate_remote_hosts(2)
+        cls.pg0.configure_ipv4_neighbors()
+
+    @classmethod
+    def tearDownClass(cls):
+        super(TestDET44, cls).tearDownClass()
+
+    def setUp(self):
+        super(TestDET44, self).setUp()
+        self.vapi.det44_plugin_enable_disable(enable=1)
+
+    def tearDown(self):
+        super(TestDET44, self).tearDown()
+        if not self.vpp_dead:
+            self.vapi.det44_plugin_enable_disable(enable=0)
+
+    def show_commands_at_teardown(self):
+        self.logger.info(self.vapi.cli("show det44 interfaces"))
+        self.logger.info(self.vapi.cli("show det44 timeouts"))
+        self.logger.info(self.vapi.cli("show det44 mappings"))
+        self.logger.info(self.vapi.cli("show det44 sessions"))
+
+    def verify_capture_in(self, capture, in_if):
+        """
+        Verify captured packets on inside network
+
+        :param capture: Captured packets
+        :param in_if: Inside interface
+        """
+        fired = False
+        for packet in capture:
+            try:
+                self.assert_packet_checksums_valid(packet)
+                self.assertEqual(packet[IP].dst, in_if.remote_ip4)
+                if packet.haslayer(TCP):
+                    self.assertEqual(packet[TCP].dport, self.tcp_port_in)
+                elif packet.haslayer(UDP):
+                    self.assertEqual(packet[UDP].dport, self.udp_port_in)
+                else:
+                    self.assertEqual(packet[ICMP].id, self.icmp_id_in)
+            except:
+                fired = True
+                self.logger.error(ppp("Unexpected or invalid packet "
+                                      "(inside network):", packet))
+        if fired:
+            raise
+
+    def verify_ipfix_max_entries_per_user(self, data, limit, src_addr):
+        """
+        Verify IPFIX maximum entries per user exceeded event
+
+        :param data: Decoded IPFIX data records
+        :param limit: Number of maximum entries per user
+        :param src_addr: IPv4 source address
+        """
+        self.assertEqual(1, len(data))
+        record = data[0]
+        # natEvent
+        self.assertEqual(scapy.compat.orb(record[230]), 13)
+        # natQuotaExceededEvent
+        self.assertEqual(struct.pack("I", 3), record[466])
+        # maxEntriesPerUser
+        self.assertEqual(struct.pack("I", limit), record[473])
+        # sourceIPv4Address
+        self.assertEqual(socket.inet_pton(socket.AF_INET, src_addr), record[8])
+
+    def initiate_tcp_session(self, in_if, out_if):
+        """
+        Initiates TCP session 3 WAY HAND SHAKE
+
+        :param in_if: Inside interface
+        :param out_if: Outside interface
+        """
+
+        # SYN packet in->out
+        p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) /
+             IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
+             TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
+             flags="S"))
+        in_if.add_stream(p)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        capture = out_if.get_capture(1)
+        p = capture[0]
+        self.tcp_port_out = p[TCP].sport
+
+        # SYN + ACK packet out->in
+        p = (Ether(src=out_if.remote_mac, dst=out_if.local_mac) /
+             IP(src=out_if.remote_ip4, dst=self.nat_addr) /
+             TCP(sport=self.tcp_external_port, dport=self.tcp_port_out,
+             flags="SA"))
+        out_if.add_stream(p)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        in_if.get_capture(1)
+
+        # ACK packet in->out
+        p = (Ether(src=in_if.remote_mac, dst=in_if.local_mac) /
+             IP(src=in_if.remote_ip4, dst=out_if.remote_ip4) /
+             TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
+             flags="A"))
+        in_if.add_stream(p)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        out_if.get_capture(1)
+
+    def create_stream_in(self, in_if, out_if, ttl=64):
+        """
+        Create packet stream for inside network
+
+        :param in_if: Inside interface
+        :param out_if: Outside interface
+        :param ttl: TTL of generated packets
+        """
+        pkts = []
+        # TCP
+        p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
+             IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=ttl) /
+             TCP(sport=self.tcp_port_in, dport=self.tcp_external_port))
+        pkts.append(p)
+
+        # UDP
+        p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
+             IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=ttl) /
+             UDP(sport=self.udp_port_in, dport=self.udp_external_port))
+        pkts.append(p)
+
+        # ICMP
+        p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
+             IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=ttl) /
+             ICMP(id=self.icmp_id_in, type='echo-request'))
+        pkts.append(p)
+
+        return pkts
+
+    def create_stream_out(self, out_if, dst_ip=None, ttl=64):
+        """
+        Create packet stream for outside network
+
+        :param out_if: Outside interface
+        :param dst_ip: Destination IP address (Default use global NAT address)
+        :param ttl: TTL of generated packets
+        """
+        if dst_ip is None:
+            dst_ip = self.nat_addr
+        pkts = []
+        # TCP
+        p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
+             IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
+             TCP(dport=self.tcp_port_out, sport=self.tcp_external_port))
+        pkts.append(p)
+
+        # UDP
+        p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
+             IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
+             UDP(dport=self.udp_port_out, sport=self.udp_external_port))
+        pkts.append(p)
+
+        # ICMP
+        p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
+             IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
+             ICMP(id=self.icmp_external_id, type='echo-reply'))
+        pkts.append(p)
+
+        return pkts
+
+    def verify_capture_out(self, capture, nat_ip=None):
+        """
+        Verify captured packets on outside network
+
+        :param capture: Captured packets
+        :param nat_ip: Translated IP address (Default use global NAT address)
+        :param same_port: Source port number is not translated (Default False)
+        """
+        if nat_ip is None:
+            nat_ip = self.nat_addr
+        for packet in capture:
+            try:
+                self.assertEqual(packet[IP].src, nat_ip)
+                if packet.haslayer(TCP):
+                    self.tcp_port_out = packet[TCP].sport
+                elif packet.haslayer(UDP):
+                    self.udp_port_out = packet[UDP].sport
+                else:
+                    self.icmp_external_id = packet[ICMP].id
+            except:
+                self.logger.error(ppp("Unexpected or invalid packet "
+                                      "(outside network):", packet))
+                raise
+
+    def test_deterministic_mode(self):
+        """ NAT plugin run deterministic mode """
+        in_addr = '172.16.255.0'
+        out_addr = '172.17.255.50'
+        in_addr_t = '172.16.255.20'
+        in_plen = 24
+        out_plen = 32
+
+        self.vapi.det44_add_del_map(is_add=1, in_addr=in_addr,
+                                    in_plen=in_plen, out_addr=out_addr,
+                                    out_plen=out_plen)
+
+        rep1 = self.vapi.det44_forward(in_addr_t)
+        self.assertEqual(str(rep1.out_addr), out_addr)
+        rep2 = self.vapi.det44_reverse(rep1.out_port_hi, out_addr)
+
+        self.assertEqual(str(rep2.in_addr), in_addr_t)
+
+        deterministic_mappings = self.vapi.det44_map_dump()
+        self.assertEqual(len(deterministic_mappings), 1)
+        dsm = deterministic_mappings[0]
+        self.assertEqual(in_addr, str(dsm.in_addr))
+        self.assertEqual(in_plen, dsm.in_plen)
+        self.assertEqual(out_addr, str(dsm.out_addr))
+        self.assertEqual(out_plen, dsm.out_plen)
+
+    def test_set_timeouts(self):
+        """ Set deterministic NAT timeouts """
+        timeouts_before = self.vapi.det44_get_timeouts()
+
+        self.vapi.det44_set_timeouts(
+            udp=timeouts_before.udp + 10,
+            tcp_established=timeouts_before.tcp_established + 10,
+            tcp_transitory=timeouts_before.tcp_transitory + 10,
+            icmp=timeouts_before.icmp + 10)
+
+        timeouts_after = self.vapi.det44_get_timeouts()
+
+        self.assertNotEqual(timeouts_before.udp, timeouts_after.udp)
+        self.assertNotEqual(timeouts_before.icmp, timeouts_after.icmp)
+        self.assertNotEqual(timeouts_before.tcp_established,
+                            timeouts_after.tcp_established)
+        self.assertNotEqual(timeouts_before.tcp_transitory,
+                            timeouts_after.tcp_transitory)
+
+    def test_in(self):
+        """ DET44 translation test (TCP, UDP, ICMP) """
+
+        nat_ip = "10.0.0.10"
+
+        self.vapi.det44_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4,
+                                    in_plen=32,
+                                    out_addr=socket.inet_aton(nat_ip),
+                                    out_plen=32)
+
+        self.vapi.det44_interface_add_del_feature(
+            sw_if_index=self.pg0.sw_if_index,
+            is_add=1, is_inside=1)
+        self.vapi.det44_interface_add_del_feature(
+            sw_if_index=self.pg1.sw_if_index,
+            is_add=1, is_inside=0)
+
+        # in2out
+        pkts = self.create_stream_in(self.pg0, self.pg1)
+        self.pg0.add_stream(pkts)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        capture = self.pg1.get_capture(len(pkts))
+        self.verify_capture_out(capture, nat_ip)
+
+        # out2in
+        pkts = self.create_stream_out(self.pg1, nat_ip)
+        self.pg1.add_stream(pkts)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        capture = self.pg0.get_capture(len(pkts))
+        self.verify_capture_in(capture, self.pg0)
+
+        # session dump test
+        sessions = self.vapi.det44_session_dump(self.pg0.remote_ip4)
+        self.assertEqual(len(sessions), 3)
+
+        # TCP session
+        s = sessions[0]
+        self.assertEqual(str(s.ext_addr), self.pg1.remote_ip4)
+        self.assertEqual(s.in_port, self.tcp_port_in)
+        self.assertEqual(s.out_port, self.tcp_port_out)
+        self.assertEqual(s.ext_port, self.tcp_external_port)
+
+        # UDP session
+        s = sessions[1]
+        self.assertEqual(str(s.ext_addr), self.pg1.remote_ip4)
+        self.assertEqual(s.in_port, self.udp_port_in)
+        self.assertEqual(s.out_port, self.udp_port_out)
+        self.assertEqual(s.ext_port, self.udp_external_port)
+
+        # ICMP session
+        s = sessions[2]
+        self.assertEqual(str(s.ext_addr), self.pg1.remote_ip4)
+        self.assertEqual(s.in_port, self.icmp_id_in)
+        self.assertEqual(s.out_port, self.icmp_external_id)
+
+    def test_multiple_users(self):
+        """ Deterministic NAT multiple users """
+
+        nat_ip = "10.0.0.10"
+        port_in = 80
+        external_port = 6303
+
+        host0 = self.pg0.remote_hosts[0]
+        host1 = self.pg0.remote_hosts[1]
+
+        self.vapi.det44_add_del_map(is_add=1, in_addr=host0.ip4, in_plen=24,
+                                    out_addr=socket.inet_aton(nat_ip),
+                                    out_plen=32)
+        self.vapi.det44_interface_add_del_feature(
+            sw_if_index=self.pg0.sw_if_index,
+            is_add=1, is_inside=1)
+        self.vapi.det44_interface_add_del_feature(
+            sw_if_index=self.pg1.sw_if_index,
+            is_add=1, is_inside=0)
+
+        # host0 to out
+        p = (Ether(src=host0.mac, dst=self.pg0.local_mac) /
+             IP(src=host0.ip4, dst=self.pg1.remote_ip4) /
+             TCP(sport=port_in, dport=external_port))
+        self.pg0.add_stream(p)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        capture = self.pg1.get_capture(1)
+        p = capture[0]
+        try:
+            ip = p[IP]
+            tcp = p[TCP]
+            self.assertEqual(ip.src, nat_ip)
+            self.assertEqual(ip.dst, self.pg1.remote_ip4)
+            self.assertEqual(tcp.dport, external_port)
+            port_out0 = tcp.sport
+        except:
+            self.logger.error(ppp("Unexpected or invalid packet:", p))
+            raise
+
+        # host1 to out
+        p = (Ether(src=host1.mac, dst=self.pg0.local_mac) /
+             IP(src=host1.ip4, dst=self.pg1.remote_ip4) /
+             TCP(sport=port_in, dport=external_port))
+        self.pg0.add_stream(p)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        capture = self.pg1.get_capture(1)
+        p = capture[0]
+        try:
+            ip = p[IP]
+            tcp = p[TCP]
+            self.assertEqual(ip.src, nat_ip)
+            self.assertEqual(ip.dst, self.pg1.remote_ip4)
+            self.assertEqual(tcp.dport, external_port)
+            port_out1 = tcp.sport
+        except:
+            self.logger.error(ppp("Unexpected or invalid packet:", p))
+            raise
+
+        dms = self.vapi.det44_map_dump()
+        self.assertEqual(1, len(dms))
+        self.assertEqual(2, dms[0].ses_num)
+
+        # out to host0
+        p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
+             IP(src=self.pg1.remote_ip4, dst=nat_ip) /
+             TCP(sport=external_port, dport=port_out0))
+        self.pg1.add_stream(p)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        capture = self.pg0.get_capture(1)
+        p = capture[0]
+        try:
+            ip = p[IP]
+            tcp = p[TCP]
+            self.assertEqual(ip.src, self.pg1.remote_ip4)
+            self.assertEqual(ip.dst, host0.ip4)
+            self.assertEqual(tcp.dport, port_in)
+            self.assertEqual(tcp.sport, external_port)
+        except:
+            self.logger.error(ppp("Unexpected or invalid packet:", p))
+            raise
+
+        # out to host1
+        p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
+             IP(src=self.pg1.remote_ip4, dst=nat_ip) /
+             TCP(sport=external_port, dport=port_out1))
+        self.pg1.add_stream(p)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        capture = self.pg0.get_capture(1)
+        p = capture[0]
+        try:
+            ip = p[IP]
+            tcp = p[TCP]
+            self.assertEqual(ip.src, self.pg1.remote_ip4)
+            self.assertEqual(ip.dst, host1.ip4)
+            self.assertEqual(tcp.dport, port_in)
+            self.assertEqual(tcp.sport, external_port)
+        except:
+            self.logger.error(ppp("Unexpected or invalid packet", p))
+            raise
+
+        # session close api test
+        self.vapi.det44_close_session_out(socket.inet_aton(nat_ip),
+                                          port_out1,
+                                          self.pg1.remote_ip4,
+                                          external_port)
+        dms = self.vapi.det44_map_dump()
+        self.assertEqual(dms[0].ses_num, 1)
+
+        self.vapi.det44_close_session_in(host0.ip4,
+                                         port_in,
+                                         self.pg1.remote_ip4,
+                                         external_port)
+        dms = self.vapi.det44_map_dump()
+        self.assertEqual(dms[0].ses_num, 0)
+
+    def test_tcp_session_close_detection_in(self):
+        """ DET44 TCP session close from inside network """
+        self.vapi.det44_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4,
+                                    in_plen=32,
+                                    out_addr=socket.inet_aton(self.nat_addr),
+                                    out_plen=32)
+        self.vapi.det44_interface_add_del_feature(
+            sw_if_index=self.pg0.sw_if_index,
+            is_add=1, is_inside=1)
+        self.vapi.det44_interface_add_del_feature(
+            sw_if_index=self.pg1.sw_if_index,
+            is_add=1, is_inside=0)
+
+        self.initiate_tcp_session(self.pg0, self.pg1)
+
+        # close the session from inside
+        try:
+            # FIN packet in -> out
+            p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
+                 IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
+                 TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
+                     flags="F"))
+            self.pg0.add_stream(p)
+            self.pg_enable_capture(self.pg_interfaces)
+            self.pg_start()
+            self.pg1.get_capture(1)
+
+            pkts = []
+
+            # ACK packet out -> in
+            p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
+                 IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
+                 TCP(sport=self.tcp_external_port, dport=self.tcp_port_out,
+                     flags="A"))
+            pkts.append(p)
+
+            # FIN packet out -> in
+            p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
+                 IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
+                 TCP(sport=self.tcp_external_port, dport=self.tcp_port_out,
+                     flags="F"))
+            pkts.append(p)
+
+            self.pg1.add_stream(pkts)
+            self.pg_enable_capture(self.pg_interfaces)
+            self.pg_start()
+            self.pg0.get_capture(2)
+
+            # ACK packet in -> out
+            p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
+                 IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
+                 TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
+                     flags="A"))
+            self.pg0.add_stream(p)
+            self.pg_enable_capture(self.pg_interfaces)
+            self.pg_start()
+            self.pg1.get_capture(1)
+
+            # Check if deterministic NAT44 closed the session
+            dms = self.vapi.det44_map_dump()
+            self.assertEqual(0, dms[0].ses_num)
+        except:
+            self.logger.error("TCP session termination failed")
+            raise
+
+    def test_tcp_session_close_detection_out(self):
+        """ Deterministic NAT TCP session close from outside network """
+        self.vapi.det44_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4,
+                                    in_plen=32,
+                                    out_addr=socket.inet_aton(self.nat_addr),
+                                    out_plen=32)
+        self.vapi.det44_interface_add_del_feature(
+            sw_if_index=self.pg0.sw_if_index,
+            is_add=1, is_inside=1)
+        self.vapi.det44_interface_add_del_feature(
+            sw_if_index=self.pg1.sw_if_index,
+            is_add=1, is_inside=0)
+
+        self.initiate_tcp_session(self.pg0, self.pg1)
+
+        # close the session from outside
+        try:
+            # FIN packet out -> in
+            p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
+                 IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
+                 TCP(sport=self.tcp_external_port, dport=self.tcp_port_out,
+                     flags="F"))
+            self.pg1.add_stream(p)
+            self.pg_enable_capture(self.pg_interfaces)
+            self.pg_start()
+            self.pg0.get_capture(1)
+
+            pkts = []
+
+            # ACK packet in -> out
+            p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
+                 IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
+                 TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
+                     flags="A"))
+            pkts.append(p)
+
+            # ACK packet in -> out
+            p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
+                 IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
+                 TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
+                     flags="F"))
+            pkts.append(p)
+
+            self.pg0.add_stream(pkts)
+            self.pg_enable_capture(self.pg_interfaces)
+            self.pg_start()
+            self.pg1.get_capture(2)
+
+            # ACK packet out -> in
+            p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
+                 IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
+                 TCP(sport=self.tcp_external_port, dport=self.tcp_port_out,
+                     flags="A"))
+            self.pg1.add_stream(p)
+            self.pg_enable_capture(self.pg_interfaces)
+            self.pg_start()
+            self.pg0.get_capture(1)
+
+            # Check if deterministic NAT44 closed the session
+            dms = self.vapi.det44_map_dump()
+            self.assertEqual(0, dms[0].ses_num)
+        except:
+            self.logger.error("TCP session termination failed")
+            raise
+
+    @unittest.skipUnless(running_extended_tests, "part of extended tests")
+    def test_session_timeout(self):
+        """ Deterministic NAT session timeouts """
+        self.vapi.det44_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4,
+                                    in_plen=32,
+                                    out_addr=socket.inet_aton(self.nat_addr),
+                                    out_plen=32)
+        self.vapi.det44_interface_add_del_feature(
+            sw_if_index=self.pg0.sw_if_index,
+            is_add=1, is_inside=1)
+        self.vapi.det44_interface_add_del_feature(
+            sw_if_index=self.pg1.sw_if_index,
+            is_add=1, is_inside=0)
+
+        self.initiate_tcp_session(self.pg0, self.pg1)
+        self.vapi.det44_set_timeouts(udp=5, tcp_established=5,
+                                     tcp_transitory=5, icmp=5)
+        pkts = self.create_stream_in(self.pg0, self.pg1)
+        self.pg0.add_stream(pkts)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        self.pg1.get_capture(len(pkts))
+        sleep(15)
+
+        dms = self.vapi.det44_map_dump()
+        self.assertEqual(0, dms[0].ses_num)
+
+    # TODO: ipfix needs to be separated from NAT base plugin
+    @unittest.skipUnless(running_extended_tests, "part of extended tests")
+    def test_session_limit_per_user(self):
+        """ Deterministic NAT maximum sessions per user limit """
+        self.vapi.det44_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4,
+                                    in_plen=32,
+                                    out_addr=socket.inet_aton(self.nat_addr),
+                                    out_plen=32)
+        self.vapi.det44_interface_add_del_feature(
+            sw_if_index=self.pg0.sw_if_index,
+            is_add=1, is_inside=1)
+        self.vapi.det44_interface_add_del_feature(
+            sw_if_index=self.pg1.sw_if_index,
+            is_add=1, is_inside=0)
+        self.vapi.set_ipfix_exporter(collector_address=self.pg2.remote_ip4,
+                                     src_address=self.pg2.local_ip4,
+                                     path_mtu=512,
+                                     template_interval=10)
+        self.vapi.nat_ipfix_enable_disable(domain_id=1, src_port=4739,
+                                           enable=1)
+
+        pkts = []
+        for port in range(1025, 2025):
+            p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
+                 IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
+                 UDP(sport=port, dport=port))
+            pkts.append(p)
+
+        self.pg0.add_stream(pkts)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        self.pg1.get_capture(len(pkts))
+
+        p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
+             IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
+             UDP(sport=3001, dport=3002))
+        self.pg0.add_stream(p)
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+        self.pg1.assert_nothing_captured()
+
+        # verify ICMP error packet
+        capture = self.pg0.get_capture(1)
+        p = capture[0]
+        self.assertTrue(p.haslayer(ICMP))
+        icmp = p[ICMP]
+        self.assertEqual(icmp.type, 3)
+        self.assertEqual(icmp.code, 1)
+        self.assertTrue(icmp.haslayer(IPerror))
+        inner_ip = icmp[IPerror]
+        self.assertEqual(inner_ip[UDPerror].sport, 3001)
+        self.assertEqual(inner_ip[UDPerror].dport, 3002)
+
+        dms = self.vapi.det44_map_dump()
+
+        self.assertEqual(1000, dms[0].ses_num)
+
+        # verify IPFIX logging
+        self.vapi.ipfix_flush()
+        sleep(1)
+        capture = self.pg2.get_capture(2)
+        ipfix = IPFIXDecoder()
+        # first load template
+        for p in capture:
+            self.assertTrue(p.haslayer(IPFIX))
+            if p.haslayer(Template):
+                ipfix.add_template(p.getlayer(Template))
+        # verify events in data set
+        for p in capture:
+            if p.haslayer(Data):
+                data = ipfix.decode_data_set(p.getlayer(Set))
+                self.verify_ipfix_max_entries_per_user(data,
+                                                       1000,
+                                                       self.pg0.remote_ip4)
+        self.vapi.nat_ipfix_enable_disable(domain_id=1, src_port=4739,
+                                           enable=0)
diff --git a/src/plugins/nat/test/test_nat.py b/src/plugins/nat/test/test_nat.py
index 16ffcfd..09bf8a2 100644
--- a/src/plugins/nat/test/test_nat.py
+++ b/src/plugins/nat/test/test_nat.py
@@ -7462,625 +7462,6 @@
         self.verify_capture_in(capture, self.pg0)
 
 
-class TestDeterministicNAT(MethodHolder):
-    """ Deterministic NAT Test Cases """
-
-    @classmethod
-    def setUpConstants(cls):
-        super(TestDeterministicNAT, cls).setUpConstants()
-        cls.vpp_cmdline.extend(["nat", "{", "deterministic", "}"])
-
-    @classmethod
-    def setUpClass(cls):
-        super(TestDeterministicNAT, cls).setUpClass()
-        cls.vapi.cli("set log class nat level debug")
-
-        cls.tcp_port_in = 6303
-        cls.tcp_external_port = 6303
-        cls.udp_port_in = 6304
-        cls.udp_external_port = 6304
-        cls.icmp_id_in = 6305
-        cls.nat_addr = '10.0.0.3'
-
-        cls.create_pg_interfaces(range(3))
-        cls.interfaces = list(cls.pg_interfaces)
-
-        for i in cls.interfaces:
-            i.admin_up()
-            i.config_ip4()
-            i.resolve_arp()
-
-        cls.pg0.generate_remote_hosts(2)
-        cls.pg0.configure_ipv4_neighbors()
-
-    @classmethod
-    def tearDownClass(cls):
-        super(TestDeterministicNAT, cls).tearDownClass()
-
-    def create_stream_in(self, in_if, out_if, ttl=64):
-        """
-        Create packet stream for inside network
-
-        :param in_if: Inside interface
-        :param out_if: Outside interface
-        :param ttl: TTL of generated packets
-        """
-        pkts = []
-        # TCP
-        p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
-             IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=ttl) /
-             TCP(sport=self.tcp_port_in, dport=self.tcp_external_port))
-        pkts.append(p)
-
-        # UDP
-        p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
-             IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=ttl) /
-             UDP(sport=self.udp_port_in, dport=self.udp_external_port))
-        pkts.append(p)
-
-        # ICMP
-        p = (Ether(dst=in_if.local_mac, src=in_if.remote_mac) /
-             IP(src=in_if.remote_ip4, dst=out_if.remote_ip4, ttl=ttl) /
-             ICMP(id=self.icmp_id_in, type='echo-request'))
-        pkts.append(p)
-
-        return pkts
-
-    def create_stream_out(self, out_if, dst_ip=None, ttl=64):
-        """
-        Create packet stream for outside network
-
-        :param out_if: Outside interface
-        :param dst_ip: Destination IP address (Default use global NAT address)
-        :param ttl: TTL of generated packets
-        """
-        if dst_ip is None:
-            dst_ip = self.nat_addr
-        pkts = []
-        # TCP
-        p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
-             IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
-             TCP(dport=self.tcp_port_out, sport=self.tcp_external_port))
-        pkts.append(p)
-
-        # UDP
-        p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
-             IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
-             UDP(dport=self.udp_port_out, sport=self.udp_external_port))
-        pkts.append(p)
-
-        # ICMP
-        p = (Ether(dst=out_if.local_mac, src=out_if.remote_mac) /
-             IP(src=out_if.remote_ip4, dst=dst_ip, ttl=ttl) /
-             ICMP(id=self.icmp_external_id, type='echo-reply'))
-        pkts.append(p)
-
-        return pkts
-
-    def verify_capture_out(self, capture, nat_ip=None):
-        """
-        Verify captured packets on outside network
-
-        :param capture: Captured packets
-        :param nat_ip: Translated IP address (Default use global NAT address)
-        :param same_port: Source port number is not translated (Default False)
-        """
-        if nat_ip is None:
-            nat_ip = self.nat_addr
-        for packet in capture:
-            try:
-                self.assertEqual(packet[IP].src, nat_ip)
-                if packet.haslayer(TCP):
-                    self.tcp_port_out = packet[TCP].sport
-                elif packet.haslayer(UDP):
-                    self.udp_port_out = packet[UDP].sport
-                else:
-                    self.icmp_external_id = packet[ICMP].id
-            except:
-                self.logger.error(ppp("Unexpected or invalid packet "
-                                      "(outside network):", packet))
-                raise
-
-    def test_deterministic_mode(self):
-        """ NAT plugin run deterministic mode """
-        in_addr = '172.16.255.0'
-        out_addr = '172.17.255.50'
-        in_addr_t = '172.16.255.20'
-        in_plen = 24
-        out_plen = 32
-
-        nat_config = self.vapi.nat_show_config()
-        self.assertEqual(1, nat_config.deterministic)
-
-        self.vapi.nat_det_add_del_map(is_add=1, in_addr=in_addr,
-                                      in_plen=in_plen, out_addr=out_addr,
-                                      out_plen=out_plen)
-
-        rep1 = self.vapi.nat_det_forward(in_addr_t)
-        self.assertEqual(str(rep1.out_addr), out_addr)
-        rep2 = self.vapi.nat_det_reverse(rep1.out_port_hi, out_addr)
-
-        self.assertEqual(str(rep2.in_addr), in_addr_t)
-
-        deterministic_mappings = self.vapi.nat_det_map_dump()
-        self.assertEqual(len(deterministic_mappings), 1)
-        dsm = deterministic_mappings[0]
-        self.assertEqual(in_addr, str(dsm.in_addr))
-        self.assertEqual(in_plen, dsm.in_plen)
-        self.assertEqual(out_addr, str(dsm.out_addr))
-        self.assertEqual(out_plen, dsm.out_plen)
-
-        self.clear_nat_det()
-        deterministic_mappings = self.vapi.nat_det_map_dump()
-        self.assertEqual(len(deterministic_mappings), 0)
-
-    def test_set_timeouts(self):
-        """ Set deterministic NAT timeouts """
-        timeouts_before = self.vapi.nat_get_timeouts()
-
-        self.vapi.nat_set_timeouts(
-            udp=timeouts_before.udp + 10,
-            tcp_established=timeouts_before.tcp_established + 10,
-            tcp_transitory=timeouts_before.tcp_transitory + 10,
-            icmp=timeouts_before.icmp + 10)
-
-        timeouts_after = self.vapi.nat_get_timeouts()
-
-        self.assertNotEqual(timeouts_before.udp, timeouts_after.udp)
-        self.assertNotEqual(timeouts_before.icmp, timeouts_after.icmp)
-        self.assertNotEqual(timeouts_before.tcp_established,
-                            timeouts_after.tcp_established)
-        self.assertNotEqual(timeouts_before.tcp_transitory,
-                            timeouts_after.tcp_transitory)
-
-    def test_det_in(self):
-        """ Deterministic NAT translation test (TCP, UDP, ICMP) """
-
-        nat_ip = "10.0.0.10"
-
-        self.vapi.nat_det_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4,
-                                      in_plen=32,
-                                      out_addr=socket.inet_aton(nat_ip),
-                                      out_plen=32)
-
-        flags = self.config_flags.NAT_IS_INSIDE
-        self.vapi.nat44_interface_add_del_feature(
-            sw_if_index=self.pg0.sw_if_index,
-            flags=flags, is_add=1)
-        self.vapi.nat44_interface_add_del_feature(
-            sw_if_index=self.pg1.sw_if_index,
-            is_add=1)
-
-        # in2out
-        pkts = self.create_stream_in(self.pg0, self.pg1)
-        self.pg0.add_stream(pkts)
-        self.pg_enable_capture(self.pg_interfaces)
-        self.pg_start()
-        capture = self.pg1.get_capture(len(pkts))
-        self.verify_capture_out(capture, nat_ip)
-
-        # out2in
-        pkts = self.create_stream_out(self.pg1, nat_ip)
-        self.pg1.add_stream(pkts)
-        self.pg_enable_capture(self.pg_interfaces)
-        self.pg_start()
-        capture = self.pg0.get_capture(len(pkts))
-        self.verify_capture_in(capture, self.pg0)
-
-        # session dump test
-        sessions = self.vapi.nat_det_session_dump(self.pg0.remote_ip4)
-        self.assertEqual(len(sessions), 3)
-
-        # TCP session
-        s = sessions[0]
-        self.assertEqual(str(s.ext_addr), self.pg1.remote_ip4)
-        self.assertEqual(s.in_port, self.tcp_port_in)
-        self.assertEqual(s.out_port, self.tcp_port_out)
-        self.assertEqual(s.ext_port, self.tcp_external_port)
-
-        # UDP session
-        s = sessions[1]
-        self.assertEqual(str(s.ext_addr), self.pg1.remote_ip4)
-        self.assertEqual(s.in_port, self.udp_port_in)
-        self.assertEqual(s.out_port, self.udp_port_out)
-        self.assertEqual(s.ext_port, self.udp_external_port)
-
-        # ICMP session
-        s = sessions[2]
-        self.assertEqual(str(s.ext_addr), self.pg1.remote_ip4)
-        self.assertEqual(s.in_port, self.icmp_id_in)
-        self.assertEqual(s.out_port, self.icmp_external_id)
-
-    def test_multiple_users(self):
-        """ Deterministic NAT multiple users """
-
-        nat_ip = "10.0.0.10"
-        port_in = 80
-        external_port = 6303
-
-        host0 = self.pg0.remote_hosts[0]
-        host1 = self.pg0.remote_hosts[1]
-
-        self.vapi.nat_det_add_del_map(is_add=1, in_addr=host0.ip4, in_plen=24,
-                                      out_addr=socket.inet_aton(nat_ip),
-                                      out_plen=32)
-        flags = self.config_flags.NAT_IS_INSIDE
-        self.vapi.nat44_interface_add_del_feature(
-            sw_if_index=self.pg0.sw_if_index,
-            flags=flags, is_add=1)
-        self.vapi.nat44_interface_add_del_feature(
-            sw_if_index=self.pg1.sw_if_index,
-            is_add=1)
-
-        # host0 to out
-        p = (Ether(src=host0.mac, dst=self.pg0.local_mac) /
-             IP(src=host0.ip4, dst=self.pg1.remote_ip4) /
-             TCP(sport=port_in, dport=external_port))
-        self.pg0.add_stream(p)
-        self.pg_enable_capture(self.pg_interfaces)
-        self.pg_start()
-        capture = self.pg1.get_capture(1)
-        p = capture[0]
-        try:
-            ip = p[IP]
-            tcp = p[TCP]
-            self.assertEqual(ip.src, nat_ip)
-            self.assertEqual(ip.dst, self.pg1.remote_ip4)
-            self.assertEqual(tcp.dport, external_port)
-            port_out0 = tcp.sport
-        except:
-            self.logger.error(ppp("Unexpected or invalid packet:", p))
-            raise
-
-        # host1 to out
-        p = (Ether(src=host1.mac, dst=self.pg0.local_mac) /
-             IP(src=host1.ip4, dst=self.pg1.remote_ip4) /
-             TCP(sport=port_in, dport=external_port))
-        self.pg0.add_stream(p)
-        self.pg_enable_capture(self.pg_interfaces)
-        self.pg_start()
-        capture = self.pg1.get_capture(1)
-        p = capture[0]
-        try:
-            ip = p[IP]
-            tcp = p[TCP]
-            self.assertEqual(ip.src, nat_ip)
-            self.assertEqual(ip.dst, self.pg1.remote_ip4)
-            self.assertEqual(tcp.dport, external_port)
-            port_out1 = tcp.sport
-        except:
-            self.logger.error(ppp("Unexpected or invalid packet:", p))
-            raise
-
-        dms = self.vapi.nat_det_map_dump()
-        self.assertEqual(1, len(dms))
-        self.assertEqual(2, dms[0].ses_num)
-
-        # out to host0
-        p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
-             IP(src=self.pg1.remote_ip4, dst=nat_ip) /
-             TCP(sport=external_port, dport=port_out0))
-        self.pg1.add_stream(p)
-        self.pg_enable_capture(self.pg_interfaces)
-        self.pg_start()
-        capture = self.pg0.get_capture(1)
-        p = capture[0]
-        try:
-            ip = p[IP]
-            tcp = p[TCP]
-            self.assertEqual(ip.src, self.pg1.remote_ip4)
-            self.assertEqual(ip.dst, host0.ip4)
-            self.assertEqual(tcp.dport, port_in)
-            self.assertEqual(tcp.sport, external_port)
-        except:
-            self.logger.error(ppp("Unexpected or invalid packet:", p))
-            raise
-
-        # out to host1
-        p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
-             IP(src=self.pg1.remote_ip4, dst=nat_ip) /
-             TCP(sport=external_port, dport=port_out1))
-        self.pg1.add_stream(p)
-        self.pg_enable_capture(self.pg_interfaces)
-        self.pg_start()
-        capture = self.pg0.get_capture(1)
-        p = capture[0]
-        try:
-            ip = p[IP]
-            tcp = p[TCP]
-            self.assertEqual(ip.src, self.pg1.remote_ip4)
-            self.assertEqual(ip.dst, host1.ip4)
-            self.assertEqual(tcp.dport, port_in)
-            self.assertEqual(tcp.sport, external_port)
-        except:
-            self.logger.error(ppp("Unexpected or invalid packet", p))
-            raise
-
-        # session close api test
-        self.vapi.nat_det_close_session_out(socket.inet_aton(nat_ip),
-                                            port_out1,
-                                            self.pg1.remote_ip4,
-                                            external_port)
-        dms = self.vapi.nat_det_map_dump()
-        self.assertEqual(dms[0].ses_num, 1)
-
-        self.vapi.nat_det_close_session_in(host0.ip4,
-                                           port_in,
-                                           self.pg1.remote_ip4,
-                                           external_port)
-        dms = self.vapi.nat_det_map_dump()
-        self.assertEqual(dms[0].ses_num, 0)
-
-    def test_tcp_session_close_detection_in(self):
-        """ Deterministic NAT TCP session close from inside network """
-        self.vapi.nat_det_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4,
-                                      in_plen=32,
-                                      out_addr=socket.inet_aton(self.nat_addr),
-                                      out_plen=32)
-        flags = self.config_flags.NAT_IS_INSIDE
-        self.vapi.nat44_interface_add_del_feature(
-            sw_if_index=self.pg0.sw_if_index,
-            flags=flags, is_add=1)
-        self.vapi.nat44_interface_add_del_feature(
-            sw_if_index=self.pg1.sw_if_index,
-            is_add=1)
-
-        self.initiate_tcp_session(self.pg0, self.pg1)
-
-        # close the session from inside
-        try:
-            # FIN packet in -> out
-            p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
-                 IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
-                 TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
-                     flags="F"))
-            self.pg0.add_stream(p)
-            self.pg_enable_capture(self.pg_interfaces)
-            self.pg_start()
-            self.pg1.get_capture(1)
-
-            pkts = []
-
-            # ACK packet out -> in
-            p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
-                 IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
-                 TCP(sport=self.tcp_external_port, dport=self.tcp_port_out,
-                     flags="A"))
-            pkts.append(p)
-
-            # FIN packet out -> in
-            p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
-                 IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
-                 TCP(sport=self.tcp_external_port, dport=self.tcp_port_out,
-                     flags="F"))
-            pkts.append(p)
-
-            self.pg1.add_stream(pkts)
-            self.pg_enable_capture(self.pg_interfaces)
-            self.pg_start()
-            self.pg0.get_capture(2)
-
-            # ACK packet in -> out
-            p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
-                 IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
-                 TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
-                     flags="A"))
-            self.pg0.add_stream(p)
-            self.pg_enable_capture(self.pg_interfaces)
-            self.pg_start()
-            self.pg1.get_capture(1)
-
-            # Check if deterministic NAT44 closed the session
-            dms = self.vapi.nat_det_map_dump()
-            self.assertEqual(0, dms[0].ses_num)
-        except:
-            self.logger.error("TCP session termination failed")
-            raise
-
-    def test_tcp_session_close_detection_out(self):
-        """ Deterministic NAT TCP session close from outside network """
-        self.vapi.nat_det_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4,
-                                      in_plen=32,
-                                      out_addr=socket.inet_aton(self.nat_addr),
-                                      out_plen=32)
-        flags = self.config_flags.NAT_IS_INSIDE
-        self.vapi.nat44_interface_add_del_feature(
-            sw_if_index=self.pg0.sw_if_index,
-            flags=flags, is_add=1)
-        self.vapi.nat44_interface_add_del_feature(
-            sw_if_index=self.pg1.sw_if_index,
-            is_add=1)
-
-        self.initiate_tcp_session(self.pg0, self.pg1)
-
-        # close the session from outside
-        try:
-            # FIN packet out -> in
-            p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
-                 IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
-                 TCP(sport=self.tcp_external_port, dport=self.tcp_port_out,
-                     flags="F"))
-            self.pg1.add_stream(p)
-            self.pg_enable_capture(self.pg_interfaces)
-            self.pg_start()
-            self.pg0.get_capture(1)
-
-            pkts = []
-
-            # ACK packet in -> out
-            p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
-                 IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
-                 TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
-                     flags="A"))
-            pkts.append(p)
-
-            # ACK packet in -> out
-            p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
-                 IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
-                 TCP(sport=self.tcp_port_in, dport=self.tcp_external_port,
-                     flags="F"))
-            pkts.append(p)
-
-            self.pg0.add_stream(pkts)
-            self.pg_enable_capture(self.pg_interfaces)
-            self.pg_start()
-            self.pg1.get_capture(2)
-
-            # ACK packet out -> in
-            p = (Ether(src=self.pg1.remote_mac, dst=self.pg1.local_mac) /
-                 IP(src=self.pg1.remote_ip4, dst=self.nat_addr) /
-                 TCP(sport=self.tcp_external_port, dport=self.tcp_port_out,
-                     flags="A"))
-            self.pg1.add_stream(p)
-            self.pg_enable_capture(self.pg_interfaces)
-            self.pg_start()
-            self.pg0.get_capture(1)
-
-            # Check if deterministic NAT44 closed the session
-            dms = self.vapi.nat_det_map_dump()
-            self.assertEqual(0, dms[0].ses_num)
-        except:
-            self.logger.error("TCP session termination failed")
-            raise
-
-    @unittest.skipUnless(running_extended_tests, "part of extended tests")
-    def test_session_timeout(self):
-        """ Deterministic NAT session timeouts """
-        self.vapi.nat_det_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4,
-                                      in_plen=32,
-                                      out_addr=socket.inet_aton(self.nat_addr),
-                                      out_plen=32)
-        flags = self.config_flags.NAT_IS_INSIDE
-        self.vapi.nat44_interface_add_del_feature(
-            sw_if_index=self.pg0.sw_if_index,
-            flags=flags, is_add=1)
-        self.vapi.nat44_interface_add_del_feature(
-            sw_if_index=self.pg1.sw_if_index,
-            is_add=1)
-
-        self.initiate_tcp_session(self.pg0, self.pg1)
-        self.vapi.nat_set_timeouts(udp=5, tcp_established=5, tcp_transitory=5,
-                                   icmp=5)
-        pkts = self.create_stream_in(self.pg0, self.pg1)
-        self.pg0.add_stream(pkts)
-        self.pg_enable_capture(self.pg_interfaces)
-        self.pg_start()
-        capture = self.pg1.get_capture(len(pkts))
-        sleep(15)
-
-        dms = self.vapi.nat_det_map_dump()
-        self.assertEqual(0, dms[0].ses_num)
-
-    @unittest.skipUnless(running_extended_tests, "part of extended tests")
-    def test_session_limit_per_user(self):
-        """ Deterministic NAT maximum sessions per user limit """
-        self.vapi.nat_det_add_del_map(is_add=1, in_addr=self.pg0.remote_ip4,
-                                      in_plen=32,
-                                      out_addr=socket.inet_aton(self.nat_addr),
-                                      out_plen=32)
-        flags = self.config_flags.NAT_IS_INSIDE
-        self.vapi.nat44_interface_add_del_feature(
-            sw_if_index=self.pg0.sw_if_index,
-            flags=flags, is_add=1)
-        self.vapi.nat44_interface_add_del_feature(
-            sw_if_index=self.pg1.sw_if_index,
-            is_add=1)
-        self.vapi.set_ipfix_exporter(collector_address=self.pg2.remote_ip4,
-                                     src_address=self.pg2.local_ip4,
-                                     path_mtu=512,
-                                     template_interval=10)
-        self.vapi.nat_ipfix_enable_disable(domain_id=1, src_port=4739,
-                                           enable=1)
-
-        pkts = []
-        for port in range(1025, 2025):
-            p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
-                 IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
-                 UDP(sport=port, dport=port))
-            pkts.append(p)
-
-        self.pg0.add_stream(pkts)
-        self.pg_enable_capture(self.pg_interfaces)
-        self.pg_start()
-        capture = self.pg1.get_capture(len(pkts))
-
-        p = (Ether(src=self.pg0.remote_mac, dst=self.pg0.local_mac) /
-             IP(src=self.pg0.remote_ip4, dst=self.pg1.remote_ip4) /
-             UDP(sport=3001, dport=3002))
-        self.pg0.add_stream(p)
-        self.pg_enable_capture(self.pg_interfaces)
-        self.pg_start()
-        capture = self.pg1.assert_nothing_captured()
-
-        # verify ICMP error packet
-        capture = self.pg0.get_capture(1)
-        p = capture[0]
-        self.assertTrue(p.haslayer(ICMP))
-        icmp = p[ICMP]
-        self.assertEqual(icmp.type, 3)
-        self.assertEqual(icmp.code, 1)
-        self.assertTrue(icmp.haslayer(IPerror))
-        inner_ip = icmp[IPerror]
-        self.assertEqual(inner_ip[UDPerror].sport, 3001)
-        self.assertEqual(inner_ip[UDPerror].dport, 3002)
-
-        dms = self.vapi.nat_det_map_dump()
-
-        self.assertEqual(1000, dms[0].ses_num)
-
-        # verify IPFIX logging
-        self.vapi.ipfix_flush()
-        sleep(1)
-        capture = self.pg2.get_capture(2)
-        ipfix = IPFIXDecoder()
-        # first load template
-        for p in capture:
-            self.assertTrue(p.haslayer(IPFIX))
-            if p.haslayer(Template):
-                ipfix.add_template(p.getlayer(Template))
-        # verify events in data set
-        for p in capture:
-            if p.haslayer(Data):
-                data = ipfix.decode_data_set(p.getlayer(Set))
-                self.verify_ipfix_max_entries_per_user(data,
-                                                       1000,
-                                                       self.pg0.remote_ip4)
-
-    def clear_nat_det(self):
-        """
-        Clear deterministic NAT configuration.
-        """
-        self.vapi.nat_ipfix_enable_disable(domain_id=1, src_port=4739,
-                                           enable=0)
-        self.vapi.nat_set_timeouts(udp=300, tcp_established=7440,
-                                   tcp_transitory=240, icmp=60)
-        deterministic_mappings = self.vapi.nat_det_map_dump()
-        for dsm in deterministic_mappings:
-            self.vapi.nat_det_add_del_map(is_add=0, in_addr=dsm.in_addr,
-                                          in_plen=dsm.in_plen,
-                                          out_addr=dsm.out_addr,
-                                          out_plen=dsm.out_plen)
-
-        interfaces = self.vapi.nat44_interface_dump()
-        for intf in interfaces:
-            self.vapi.nat44_interface_add_del_feature(
-                sw_if_index=intf.sw_if_index,
-                flags=intf.flags)
-
-    def tearDown(self):
-        super(TestDeterministicNAT, self).tearDown()
-        if not self.vpp_dead:
-            self.clear_nat_det()
-
-    def show_commands_at_teardown(self):
-        self.logger.info(self.vapi.cli("show nat44 interfaces"))
-        self.logger.info(self.vapi.cli("show nat timeouts"))
-        self.logger.info(
-            self.vapi.cli("show nat44 deterministic mappings"))
-        self.logger.info(
-            self.vapi.cli("show nat44 deterministic sessions"))
-
-
 class TestNAT64(MethodHolder):
     """ NAT64 Test Cases """