Description

When implementing NAT pool port utilization monitoring for SRX chassis cluster, SNMP is showing 2x less utilization than CLI.

Symptoms

Outputs from SRX SNMP and CLI:

{primary:node0}
user@SRX> show snmp mib walk jnxJsNatPoolUtil    
jnxJsNatPoolUtil.6.112.111.111.108.45.50.1 = 22

{primary:node0}
user@SRX> show security nat resource-usage source-pool pool-2       
node0:
--------------------------------------------------------------------------

Pool name: pool-2
Total address: 1
Port-overloading-factor: 1
Total ports: 32256 Used: 14284 Avail: 17972
Current usage: 44%  Peak usage: 59% at 2025-04-29 11:37:34 UTC
  Address    Factor-index Port-range        Used     Avail     Total Usage
  192.168.2.254                      
             0            Single Ports     14284     16948     31232   45%
             -            Alg Ports            0      1024      1024    0%

node1:
--------------------------------------------------------------------------

Pool name: pool-2
Total address: 1
Port-overloading-factor: 1
Total ports: 32256 Used: 0   Avail: 32256
Current usage: 0%   Peak usage: 0% at 1970-01-01 00:00:00 UTC
  Address    Factor-index Port-range        Used     Avail     Total Usage
  192.168.2.254                      
             0            Single Ports         0     31232     31232    0%
             -            Alg Ports            0      1024      1024    0%

 

Solution

This behavior is by design:

  • SNMP looks at the chassis cluster as a whole, so it takes the percentage from both nodes - in the outputs above, 45% for node0 and 0% for node1. The resulting value is the average which is around 22% in this case. 
  • CLI output looks at each node separately - 45% utilization in node 0 part of the pool and 0% in node 1 part.

Modification History

2025-04-29 : Article Created