Network & Infrastructure / Segmentation, TLS & Secure Connectivity
SNAT port exhaustion under high outbound concurrency
Applications intermittently fail to open outbound sessions through a shared egress while existing connections remain usable. The translation pool can run out of usable mappings before bandwidth is exhausted.
Environment and inputs: Stateful network boundaries, TLS endpoints and IPsec gateways; use the deployed security policy and implementation manual. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Collect active translations, creation failures, source-address pool size, destination concentration and connection lifetimes. Distinguish NAT allocation errors from endpoint ephemeral-port or conntrack exhaustion.
Explain the result
Translation capacity depends on implementation, tuple reuse rules and workload concurrency. One public address is not an unlimited number of simultaneous outbound connections to the same service.
Plan the fix
Reduce unnecessary connection churn, use application pooling appropriately and size the approved egress pool for measured peak concurrency. Avoid shortening state lifetimes below valid application behavior.
Check the result and rollback
Load-test representative destinations and idle patterns while tracking failed allocations. Restore prior timeouts if sessions break, and require reserve capacity during loss of one egress node.