In a customer scenario, it was seen that DNS sessions fail by source NAT and that the NAT port-overloading resource is exhausted. The customer has the exact DNS server IP address though. Given this, the customer would like to know which port overloading index the said DNS server will use.

This article explains how the port-overloading index can be calculated for a destination address and suggests one way to resolve the DNS session failure if the SRX is in a cluster setup.

The customer suspects that the DNS sessions are failing by source NAT and that the port-overloading resource is exhausted.

Here is the network topology:

DNS server: 192.168.1.1
Untrust zone
  node0---------node1      
Trust zone

By default, the SRX cluster works in active-active mode. The DNS clients are in the trust zone and need to query the DNS server by SRX source NAT. There is only one source NAT pool and one public IP address in the pool. All the clients are using this pool. The customer enables port-overloading with " port port-overloading-factor 32 " and finds that several DNS sessions have failed.

It is suspected that this failure is caused by source NAT.

Here is the source NAT pool details:

[flowd]FPC1.PIC0(vty)# show usp nat source-pool id 4 detail

Port flag: 0x13
Port assign: 0x1
Port overload: 32 <<<<
Port ranges: 2
1024-63487 (62464)
63488-65535 (2048)
Total port/in use: 8257536/0/1482869
Port max used/out of: 2661640/283866003
Hit success/failure: 105331064/283866003
IP/port-idx-max: 100.1.1.1/64
......
OL/proto/range idx: 8/0/0
nat-port-pool: low-high 32256-63487, next 35974, allocated 31228, avail 4                  <------------------
nat-bitmap: 0x39ad07c8, total-bits 31232
nat-bitmap-counter: 0/0/0

From the output of the source NAT pool details, we can see that index 8's resource is almost exhausted, which is the reason for the DNS session to have failed.

However, the customer has enabled port-overloading factor 32, so why is only index 8 exhausted?

The cause is that the SRX cluster is using a hash algorithm to determine which index the specific destination IP address will use. In the customer's scenario, several DNS sessions are using the same destination address, which means that they will use the same index resource.

Further, how can we calculate the port-overloading index for a destination address?

In SRX, port-overloading index is calculated by performing a XOR operation on the destination IP address and then MOD the result to the factor for the device to determine the index.

For example 192.168.1.1 is the IP in the DNS server IP in this case.

XOR the IP address:-
192 XOR 168 = 104
104 XOR 1 = 105
105 XOR 1 = 104
 
MOD the result with the Port-Overloading Factor for the device.(32 in this case)
104 MOD 32 = 8
Hence the Index 8.

Note: Since active-active mode is the default mode for the SRX cluster, this will make the SRX cluster use only half of the total NAT resource. The solution in this case is to change the mode to active-backup.

The command to switch an SRX cluster from active-active to active-backup mode is as follows:

set chassis cluster redundancy-mode active-backup

By default, the SRX cluster is deployed in active-active mode to allow users to use both nodes for data traffic (by having different RGs active on different nodes).

The said command is hidden and hence would require to be typed in full.

This change requires a reboot of both nodes simultaneously (or at least staggered in a way that both chassis' will be offline for a moment).

Further the said change will be visible with the output of the command:

Before

show chassis cluster information

Redundancy mode:
    Configured mode: active-active
    Operational mode: active-active

After

show chassis cluster information

Redundancy mode:
    Configured mode: active-backup
    Operational mode: active-backup

2019-07-24: Article checked for accuracy and validity; changes made to factor and index references; included recommendation in solution to make the SRX cluster use all of the NAT resources