NAT hide failure, VSX R80.30 with IP range

[Kaspars_Zibarts]

I have a case for @Timothy_Hall  🙂

We are running VSX R80.30.

There are 10 CoreXL instances, dynamic NAT (sk103656) and SXL NAT templates (sk71200) enabled by default in R80.30

Up until now we used gateway public IP (so single IP) to hide our traffic going to O365 and everything worked without any issues. Dynamic NAT feature handles "hide NAT, dest IP, proto" limitations perfectly.

Today we decided to change the NAT from single IP to IP range (sk140432). Never mind the reasons, but it still should work and technically make it better as we would have more IPs for hide NAT.

BUT! As the sun came up and people returned to work (despite corona virus), we started getting NAT hide failures in logs:

We had 20 IPs actually in the IP range. And SK156852 actually says to use port range instead of single IP 🙂 NOT!

The feeling I get with IP range enabled, "dynamic NAT" gets turned off / ignored and gateway returns to static port pools and they would be rather small with 10 FWK cores plus SXL NAT templates enabled.

Any other ideas?

[Wolfgang]

@Kaspars_Zibarts 

have a look

"NAT Hide Failure" error in SmartLog / SmartView Tracker "NAT Exhausted Pool" 

Wolfgang

[Kaspars_Zibarts]

well, that was the whole point of my article - SK made it worse 🙂 IP range killed the NAT!

[Timothy_Hall]

When doing  a many-to-fewer NAT, the same source IP address will always be assigned to the same address pool for source port allocations via a simple modulus function detailed in sk140432.  Could the fact that your range of 20 addresses is not a power of 2 (2,4,8,16, etc.) somehow have led to suboptimal distribution of source addresses between the 20 pools?  I can't remember ever setting up a many-to-fewer NAT to an address range that was not a power of two for some reason; I don't think it is mandatory but I can't remember why I always did it that way either.  🙂  Worth a try?

[Kaspars_Zibarts]

Thanks Tim! That's a very good point! I'll see how it works next time as I have ready made NAT stats too to have a quick look!

https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/NAT-table-fwx-alloc-top-users/m-p...