On SSR 6.3.7, sessions were not switching to additional available public IP addresses configured in the WAN interface's source NAT pool. Traffic continued using the primary NAT IP address even when port allocation issues occurred, resulting in session failures and packet drops.
- Logs contain repeated messages indicating NAT port exhaustion: Ports in DB are exhausted for 2/1/1/122.187.101.162/6
- Traffic continues using the primary NAT IP address while other configured NAT IP addresses remain unused.
- New sessions fail, resulting in packet drops.
- NAT port counters may become inconsistent or display negative values, even when the issue appears to have been temporarily resolved.
To check NAT port allocation and usage, run:
show network-interface source-nat-rules node node0 name xe-1-0 detail
Review the `Total Ports`, `Ports In Db`, `Ports In Mem`, `Ports Released`, and `Ports In Use` columns. Negative counter values may indicate inconsistent NAT port tracking.
Investigation identified the following issues in SSR 6.3.7:
1. NAT pool allocation: The router moved to the next public NAT IP address only when the current address had no available ports. If the primary address continued returning ports that were already in use, it was not treated as exhausted. Consequently, additional NAT IP addresses remained unused, causing new session failures.
2. NAT port tracking inconsistency: In some cases, NAT port records were not fully rebuilt after a restart. This caused port counters to become inconsistent and display negative values, allowing the issue to recur.
3. HA startup timing: The NAT pool could begin accepting traffic before its persisted state had fully loaded. Sessions transferred between HA nodes during this window could allocate ports from a pool that was not yet ready, resulting in inconsistent NAT state.
### Fix Available in SSR 7.0.5-r2
The following improvements were implemented in SSR 7.0.5-r2:
- Improved NAT port tracking to prevent negative counters and inconsistencies.
- Fixed HA timing issues that could cause NAT pool state inconsistencies.
- Improved NAT port allocation and release handling to support correct port reuse and utilization of the configured NAT IP address pool.
### Verification
After upgrading to a fixed release, verify NAT pool usage with:
show network-interface source-nat-rules name xe-0-0 detail
Confirm that:
- NAT port counters do not contain unexpected negative values.
- Ports are allocated and released correctly.
- Additional NAT IP addresses are utilized as required under load.
- New sessions establish successfully without NAT-related packet drops.
Note: The example interface and IP addresses may differ depending on the device configuration.