This article explains that the pool-utilization-alarm will only work for source NAT pool IP address resource utilization monitoring, and it will not work for IP port resource utilization monitoring.

An administrator wanted to monitor the source NAT pool resource utilization status, so the following settings were configured:

set security nat source pool test address 11.1.1.10/32  <<<<here, only one IP address</span>
set security nat source pool test port port-overloading-factor 32
set security nat source pool-utilization-alarm raise-threshold 50
set security nat source pool-utilization-alarm clear-threshold 40
...

However, when packets are dropped according to the src_nat_alloc_fail counter, no alarm logs were reported in the syslog file.

Example:

root@SRX-1400% srx-cprod.sh -s spu -c 'show usp nat counters ' | grep src_nat_alloc_fail
            src_nat_alloc_fail :  2921931
loc_fail-1400% srx-cprod.sh -s spu -c 'show usp nat counters ' | grep src_nat_al 
            src_nat_alloc_fail :  2921931
loc_fail-1400% srx-cprod.sh -s spu -c 'show usp nat counters ' | grep src_nat_al 
            src_nat_alloc_fail :  2979534
loc_fail-1400% srx-cprod.sh -s spu -c 'show usp nat counters ' | grep src_nat_al 
            src_nat_alloc_fail :  3021995
loc_fail-1400% srx-cprod.sh -s spu -c 'show usp nat counters ' | grep src_nat_al 
            src_nat_alloc_fail :  3102520 <<<Keeps increasing</span>

root@SRX-1400> show log messages | match alarm 
Dec  7 15:43:52  SRX-1400 mgd[16500]: UI_CMDLINE_READ_LINE: User 'root', command 'show log messages | match alarm ' <<<No alarm log seen</span>

The pool-utilization-alarm will only work for source NAT pool IP address resource monitoring. When only one IP address is in the pool, and the resource changes based on IP port utilization, the pool-utilization-alarm will not work for this situation.

The correct way to use the pool-utilization-alarm is when the source NAT Pool is set as follows:

Example:

set security nat source pool test address 11.1.1.10/32 to 11.1.1.13/32 <<<<
set security nat source pool-utilization-alarm raise-threshold 50
set security nat source pool-utilization-alarm clear-threshold 40
...

To collect the related alarm message, set the syslog and security log as follows:

set system syslog file messages any any
set security log mode event  <<<To send the log to the RE (file messages), then you can see the related log from file messages. Normally, it is recommended to use stream mode for security log. This is only for an example.</span>
set security log traceoptions file jdebug-nat
set security log traceoptions flag all  <<<Without it, the related alarm log will not be collected</span>

{primary:node0}[edit]
root@SRX-1400# run show log jdebug-nat | match trap    
Dec  7 15:18:12 rtlogd: NAT port usage trap received, id 1
Dec  7 15:18:31 rtlogd: NAT port usage trap received, id 1
Dec  7 15:18:34 rtlogd: NAT port usage trap received, id 1
Dec  7 15:18:34 rtlogd: NAT port usage trap received, id 1
Dec  7 15:18:34 rtlogd: NAT port usage trap received, id 1
Dec  7 15:24:03 rtlogd: NAT port usage trap received, id 1

{primary:node0}[edit]
root@SRX-1400# run show log messages | match alarm      
Dec  7 15:38:58  SRX-1400 RT_NAT: RT_SRC_NAT_ALARM_RAISE: Source NAT pool: test, threshold: 50%, current: 50%
Dec  7 15:39:05  SRX-1400 RT_NAT: RT_SRC_NAT_ALARM_CLEAR: Source NAT pool: test, threshold: 40%, current: 39%