Description

This article provides an example configuration for generating an SNMP trap when the source NAT pool port utilization reaches a user-defined threshold value (in the scenario when only one IP address is configured in the pool).

Solution

It is useful to generate an SNMP Trap when the source NAT pool port utilization reaches a user-defined threshold value because then the administrator can check the source NAT resource utilization further.

Note: With port-overloading-factor in use, the resource in one factor could be exhausted. For more information on port-overloading, see [SRX] - How can we calculate port-overloading factor with a destination address .
 

Example:

Source NAT pool setting: 

set security nat source pool test address 192.168.0.10/32
set security nat source pool test port port-overloading-factor 32


MIB value of source NAT port utilization: 

root# run show snmp mib walk jnxJsNatSrcNumPortInuse        
jnxJsNatSrcNumPortInuse.4.116.101.115.116.0.192.168.0.10 = 31232


SNMP configuration: 

{primary:node0}[edit snmp]then
root# show
trap-group test {
    categories rmon-alarm
    version v2;
    targets {
        192.168.0.135;
    }
}
rmon {
   alarm 10 {
        interval 10; <<<You can change it</span>
        variable jnxJsNatSrcNumPortInuse.4.116.101.115.116.0.192.168.0.10;
        sample-type absolute-value;
        request-type get-request;
        rising-threshold 30000;
        falling-threshold 20000;
        rising-event-index 10;
        falling-event-index 11;
    }
    event 10 {
        type log-and-trap;
        community test;
    }
    event 11 {
        type log-and-trap;
        community test;                
    }

Syslog configuration: 

{primary:node0}[edit system syslog]
root# show
file messages {
    any any;
    match SNMPD_RMON_EVENTLOG;
}

Verification: 

{primary:node0}[edit]
root# run show log messages    
Dec 11 11:36:04   snmpd[1389]: SNMPD_RMON_EVENTLOG: Event 10 triggered by Alarm 10, rising threshold (30000) crossed, (variable: jnxJsNatSrcNumPortInuse.4.116.101.115.116.0.192.168.0.10, value: 31232)
Dec 11 11:36:44   snmpd[1389]: SNMPD_RMON_EVENTLOG: Event 11 triggered by Alarm 10, falling threshold (20000) crossed, (variable: jnxJsNatSrcNumPortInuse.4.116.101.115.116.0.192.168.0.10, value: 0)

Modification History

2025-07-14: Added categories in the edit snmp trap-group.