Connection to cloud controller over CGNAT

I have a customer on CGNAT running Alta APs. When the main router was provisioned with a CGNAT IP, the APs have no connectivity to the Alta cloud. We provisioned them a public IP and they showed connected immediately.

The initial adoption appeared to work, but then the AP immediately went into a “disconnected” state and did not receive SSID Configuration.

All other internet traffic is working properly in this scenario except the Alta AP management connectivity.