"flow_policy_nat" drop count incrementing in Global Counters

• Packet drops seen on NATed Traffic
• Security policy is configured to allow the traffic
• Global counters (show counter global) display increment of "flow_policy_nat" as  drop with the message "Session setup: source NAT IP/port  allocation error"

> show counter global filter severity drop | match nat
flow_policy_nat    744333986   41   drop   flow session Session setup: source NAT IP/port allocation error

• Palo Alto Firewalls
• Supported PAN-OS
• Source NAT configuration

• Source NAT configured as "Dynamic-IP" instead of "Dynamic-IP-and-Port"
• This can be verified under GUI: Policies > NAT > (name) > Translated Packet

1. Modify the NAT configuration under GUI: Policies > NAT > (name) > Translated Packet
2. Change the "Dynamic IP" to "Dynamic IP And Port"

GUI: Policies > NAT > (name) > Translated Packet

3. Commit the configuration.