Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Umirzak
New Contributor III

NAT port is exhausted.

gents, can someone explain why frotigate receive a lot of critical errors NAT port is exhausted, how to resolve?

yesterday i have activated support contract and since that time i receiving this critical error. 

 

AJ
AJ
8 REPLIES 8
adambomb1219
SuperUser
SuperUser

What is the exact error message?  What type of NAT is being used here?  Inbound or outbound?  Both?

ozkanaltas
Valued Contributor III

Hello @Umirzak ,

 

It's related to your snat (IP Pool) object. If you use SNAT on your firewall policy this pool can be exhausted related to your snat configuration. You know every IP address has 65535 ports. If all ports are used, Fortigate warns you.

 

This problem happens to a lot of different causes. Misconfiguration, long session time, etc..

 

You can check which has exhausted your IP pool object in the Firewall&Policy -> IP Pool menu.

 

If you share the configuration with us we can advise to you. 

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Understanding-NAT-port-allocation-on-Chass...

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Umirzak
New Contributor III

i've checked Firewall&Policy -> IP Pool menu there are no any configuration.

AJ
AJ
ozkanaltas
Valued Contributor III

Hello @Umirzak ,

 

Okay, If you can't use the IP pool. You need to check the firewall policy list. There could be a policy configured with "NAT" enabled and "Use Outgoing interface Address" Enabled. Can you check your firewall policy list? Do you have any exclamation marks on there? 

 

In my opinion, you use snat for internet access. There could be too many connections processed by this rule. Because of that ports could be exhausted. 

 

You can clear your session table or if you can, reboot your unit. 

 

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Umirzak
New Contributor III

okay, i have 4 policy with NAT enabled

LAN>WAN

DMZ>WAN

Remote Connection > LAN

LAN>MGMT LAN

what policy i need to edit? 

AJ
AJ
ozkanaltas
Valued Contributor III

Hello @Umirzak ,

 

Edit does not solve your problem.

 

You need to kill the session. If you have an exclamation mark on these policies.

You can filter these sessions by policy id and you can kill all sessions. 

 

diagnose sys session filter policy <Policy_ID>
diagnose sys session clear

 

These commands clear all sessions about that policy. You should be careful with that.  

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Umirzak
New Contributor III

@ozkanaltas i did it, it's temp solution? because fortigate receives NAT port is exhausted  error after several time. 

 

AJ
AJ
ozkanaltas
Valued Contributor III

Hello @Umirzak ,

 

There could be a lot of causes for this. You need to find the root cause.

 

-There could be a lot of clients for this connection.
-Your session time there could be too long.

 

If you can, you add one more IP address for snat with the IP pool object.You can review this document .

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-SNAT-with-IP-pool/ta-p/19...

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors