Network Address Translation (NAT)

Monitor subscriber port utilization (cSRX, MX240, MX480, MX960, SRX1500, SRX1600, SRX2300, SRX4200, SRX4300, SRX4600, SRX4700, SRX5400, SRX5600, SRX5800, and vSRX3.0)–You can monitor and manage port utilization when deploying Carrier Grade Network Address Translation (CGNAT).

Configure threshold limits to receive notifications when port or port block usage exceeds the configured thresholds.

• If a pool is configured as Port Block Allocation (PBA) and a subscriber uses more port blocks than the threshold, a notification is generated.

• For Deterministic NAT (DETNAT) pools, if a subscriber uses more ports than the threshold in the allocated block, a notification is generated.

The system log messages are:

• RT_SRC_NAT_SUBS_POOL_ALARM_DAMPENINGRT_NAT: RT_SRC_NAT_SUBS_POOL_ALARM_RAISE: Subscriber ip: 10.0.0.1, Source NAT pool: pool-name, Pool type: PBA, threshold: 90%, current: 100%
• RT_SRC_NAT_SUBS_POOL_ALARM_CLEARRT_NAT: RT_SRC_NAT_SUBS_POOL_ALARM_CLEAR: Subscriber ip: 10.0.0.1, Source NAT pool: pool-name, Pool type: PBA, threshold: 50%, current: 25%
• RT_SRC_NAT_SUBS_POOL_ALARM_RAISERT_NAT: RT_SRC_NAT_SUBS_POOL_ALARM_DAMPENING: Subscriber IP: 10.1.1.2, NAT pool: pool-name, threshold alarm [raise, clear] suppressed for 2 times in last 10 seconds

[See jnxJsSrcNatSubThresholdStatus, jnxJsNAT, Monitor Subscriber Port Utilization Using Carrier Grade NAT, subscriber-pool-utilization-alarm, and pool-utilization-alarm (Security Source NAT Pool).]

Support for DS-Lite fragmentation (SRX Series Firewall)―Configure the pre-fragmentation and post-fragmentation MTU options on Dual-Stack Lite (DS-Lite) tunnels.

• Pre-fragmentation–Enable or disable pre-fragmentation or clear the df bit in the IP packet.

• Post-fragmentation–Enable or disable post-fragmentation to fragment the IPv6 packet. By default, post-fragmentation is off. When enabled, the IPv6 packet fragments; otherwise, if the MTU exceeds, an ICMP error message is sent to the originator.

[See softwire-name.]