Strata Cloud Manager Alert "NAT Resource Pool - NAT Pool Usage"

• Alert from Strata Cloud Manager regarding a high usage of NAT resource pool.
• Recommendation from Strata Cloud Manager to increase the NAT resource pool.

• PAN-OS
• Strata Cloud Manager

This alert indicates a high NAT pool usage which warns of a NAT Pool depletion follow the steps below to address this problem.

1. Identify the source NAT rule which is having a high NAT IP pool usage base on the metric nat_resources_dipp_dp-slot_rule_name (where rule name is replaced by the name of the NAT rule) emitted by the Strata Cloud Manager.
2. You can check the same from firewall CLI using the command below and compare the Used versus Available of this command for each of the NAT rules displayed.

> show running ippool

3. Review the configuration of that source NAT rule under firewall UI Policies> NAT and it validity base on the different NAT used cases in NAT Configuration Examples and in KB article Source NAT translation Types and typical use cases.
4. Address the high NAT pool usage using below option(s):
   1. Edit that source NAT rule under Policies > NAT by increasing its translated address Pool:
      1. Click the NAT policy that Strata Cloud Manager flagged for NAT pool depletion.
      2. Click the Translated Packet tab.
      3. Under Source Address Translation.
      4. Click Add.
      5. Key in the new IP address/es.
      6. Click OK.
      7. Click Commit on the upper right corner.
   2. Apply the same to all the source NAT DIP or DIPP rules which are having high NAT pool usage problem.
   3. If unable to add more public IPs to the translated address pool and if the problem of high pool usage affects DIPP NAT rule (s) then consider option B.
5. Increase the Oversubscription Rate for DIPP NAT:
   1. Click DEVICE> Setup tab.
   2. Click Session.
   3. Click Session Settings Gear.
   4. Under NAT Oversubscription Rate, choose a ratio value that is greater than the current configuration.
   5. To determine the current value of the NAT oversubscription rate use the command:

> show running ippool

as seen from the snapshot below:

6. Click OK.
7. Click Commit.

Note:

1. The NAT oversubscription rate is a firewall global setting and will affect all the NAT DIPP rules.
2. The NAT oversubscription rate is referring to the reusability of the translated IP and port. Increasing the oversubscription rate will increase the number of source device translations per NAT rule, but will provide lower the number of overall DIP and DIPP NAT rules allowed per firewall.
3. Step 5 will only affect DIPP NAT pool usage and will not help in case of DIP high NAT pool usage.

General Dynamic IP deployment recommendations to consider:
1) Try to allocate at least a one-to-one ratio of source IPs to translated addresses.
2) For multi-DP systems (like the PA-5250 and PA-7000 series) it is recommended to use 1.5x number of translated
IPs per 1x source IPs, to create a buffer to avoid retries and conflicts when the firewall is looking for an IP, which
can result in dropped packets. 
3) Configure Dynamic IP and Port fallback for Dynamic IP NAT rules to serve as a backup in case the Dynamic IP address pool runs out of IPs.
4) Configure hash-source as the session distribution policy on platforms with an FPP to improve performance in heavily NATed environments.
In the CLI - set session distribution policy hash source

Additional references used in this knowledge Article:
HOW TO CHANGE THE NAT OVERSUBSCRIPTION RATE
PACKET DROP DUE TO SOURCE NAT IP/PORT ALLOCATION FAILED
Dynamic IP and Port NAT Oversubscription