a (source) NAT question

[Andre_Backs]

Hello learned people, please consider this

Scenario:

On a Fortigate 200D OS v5.4.1 I need to source NAT multiple subnets into one subnet before going into a IPSec tunnel.

e.g. 10.87.1.0/24, 10.92.22.0/24, 10.100.5.0/24 (up to some 70 subnets) need to go into the IPSec tunnel as subnet 10.123.128.0/24.

I constructed a IPv4 Policy for this using NAT and a Dynamic IP Pool in the IP Pool Configuration. The IP Pool is of type Overload with IP range 10.123.128.0 - 10.123.128.127 and option ARP Reply checked.

I noticed in testing that my source IP addresses were NATted to the new subnet with only the network modified (i.e. 172.16.100.109 is NATted to 10.123.128.109)

Questions:

1 - will I run into problems if a large number of clients (more than 500) start using this construct

2 - can I monitor the IP NAT table somewhere

3 - can I monitor for NAT conflicts/failures/mishaps

4 - should I use a larger IP pool

5a - is using 10.123.128.0 as a starting addres for the IP range a bad idea?

5b - should the IP Pool range honour network boundaries (i.e. don't use x.x.x.0 and x.x.x.255) ?

I thank you for your replies.