Network address translation (NAT) in NSX-T can be configured on tier-0 and tier-1 logical routers.
For example, the following diagram shows two tier-1 logical routers with NAT configured on Tenant2NAT. The web VM is simply configured to use 172.16.10.10 as its IP address and 172.16.10.1 as its default gateway.
NAT is enforced at the uplink of the Tenant2NAT logical router on its connection to the tier-0 logical router.
To enable NAT configuration, Tenant2NAT must have a service component on an NSX Edge cluster. Thus, Tenant2NAT is shown inside the NSX Edge. For comparison, Tenant1 can be outside of the NSX Edge because it is not using any Edge services.