Description

While upgrading from 18.2R2-S4 to 18.4R3-S4 the validation Failed during the validation against the current configuration due to Source NAT pools contain too many ports.
 

From the shown error during the upgrade this mean that the configuration is handling about 20970 IPs (pools) and by multiplying those IPs by 64512 (ports per IP) it is equal to 1352816640 (1352M) , This amount is higher than the capacity value.
 

We can increase the source NAT port capacity to 2.4G on SRX5400, SRX5600, and SRX5800 devices with next-generation Services Processing Cards (SPCs) using the port-scaling-enlargement statement.

Symptoms

The validation Failed during the validation against the current configuration due to Source NAT pools contain too many ports.

 

Validating against /config/juniper.conf.gz

cp: /var/db/certs/common/local/*: No such file or directory

cp: /var/db/certs/common/key-pair/*: No such file or directory

cp: /var/db/certs/common/certification-authority/*: No such file or directory

Network security daemon: <source-daemon>nsd</source-daemon>

Network security daemon: <edit-path>[edit security nat source]</edit-path>

Network security daemon: <statement>pool</statement>

Network security daemon: <message>Source NAT pools contain too many ports (Current: 1352816640 &gt; Capacity: 402653184), and currently there are 20970 IPs. To ensure that the total port number is not beyond the capacity, you can delete the pool based port range and configure the global port ranges like the following:

Network security daemon:  set security nat source pool-default-port-range 1024 to 19648

Network security daemon:  set security nat source pool-default-twin-port-range 63488 to 64063

Network security daemon: Or configure the below command which only take effect on NGSPC to enlarge ports scaling.

Network security daemon:  set security nat source port-scaling-enlargement</message>

Network security daemon: </xnm:error>

mgd: error: configuration check-out failed

Validation failed

umount: unmount of /.mount/var/val/chroot/packages/mnt/jweb-srx32-340f5321 failed: Device busy

ERROR: Current configuration not compatible with junos-install-srx5000-x86-64-18.4R3-S4.tgz

Solution

Adding port-scaling-enlargement command :

 

set security source nat port-scaling-enlargement

 

Modification History

2024-09-11 : Article Created