topic Re: How to check NAT IP over-utilized or not? in Next-Generation Firewall Discussions

How to check NAT IP over-utilized or not?

Ankit1Singh — Thu, 07 Mar 2024 17:01:31 GMT

Hi Mates,

We have particular Source NAT based on IP address and want to understand if there is any way to check the current utilization of IP's for NAT. This might help to add more IPs to prevent from overutilized.

Thanks in advance.

Ankit

Re: How to check NAT IP over-utilized or not?

M.Schapdick — Fri, 08 Mar 2024 15:34:38 GMT

If you mean the port utilization used for your source NAT IPs you can check with

show running ippool

while Used shows the current allocation of each of your NAT policies, Available shows what's available in total. The Available value is higher depending on oversubscription-rate, which is the Ratio value shown, which differs between firewall models.

Docs: Dynamic IP and Port NAT Oversubscription

Re: How to check NAT IP over-utilized or not?

Ankit1Singh — Fri, 08 Mar 2024 23:09:48 GMT

Thanks for your reply, But I am confused with below 2 output. How can I understand whether we have enough space for the natting.

(active)> show running nat-rule-ippool show-freelist yes rule XXX

VSYS 2 Rule yes:

Rule: XXX, Pool index: 114, memory usage: 36472

-----------------------------------------

Oversubscription Ratio: 4

Number of Allocates: 1033739

Last Allocated Index: 11824

-----------------------------------------

------------ Private Pool ---------------

Number of Allocates: 0

Last Allocated Index: 0

(active)> show running ippool | match XXX

XXX Dynamic IP/Port 51621 206427 36472 4

Please help to understand.