We observed packet loss and broken streams to the internet.

The Port Block Allocation is limited to 64 ports (32*2) for one user which is not sufficient. The main reason for the dropped packets is that NAT is unable to allocate dynamic IP (DIP).

security{
   nat {
     source {
          pool Gi-Casa-VR-Pool {
            routing-instance {
              Customer_Routing-Instance;
            }
            address {
              1.1.1.0/22;
            }
            port {
              block-allocation {
                block-size 32;
                maximum-blocks-per-host 2;
                interim-logging-interval 1800;
                last-block-recycle-timeout 120;
              }
            }

The flow trace options show that packets were dropped due to a failure in DIP allocation :

Oct 8 17:00:33 17:00:33.846377:CID-0:THREAD_ID-25:LSYS_ID-00:RT: packet passed, Permitted by policy.
.
Oct 8 17:00:33 17:00:33.846392:CID-0:THREAD_ID-25:LSYS_ID-00:RT: dip alloc failed. dip_id = 0/0
Oct 8 17:00:33 17:00:33.846393:CID-0:THREAD_ID-25:LSYS_ID-00:RT: packet dropped, dip alloc failed      >>>>>>>>> Packet dropped due to dip allocation failed
Oct 8 17:00:33 17:00:33.846393:CID-0:THREAD_ID-25:LSYS_ID-00:RT:set_nat_invalid: natp:id 4348121107
Oct 8 17:00:33 17:00:33.846394:CID-0:THREAD_ID-25:LSYS_ID-00:RT:flow_initiate_first_path: first pak no session
Oct 8 17:00:33 17:00:33.846395:CID-0:THREAD_ID-25:LSYS_ID-00:RT: flow find session returns error.
Oct 8 17:00:33 17:00:33.846395:CID-0:THREAD_ID-25:LSYS_ID-00:RT:flow_proc_rc: -1.
Oct 8 17:00:33 17:00:33.846396:CID-0:THREAD_ID-25:LSYS_ID-00:RT: ---- flow_process_pkt rc 0x7 (fp rc -1)

Increase the block size or maximum blocks per host