Port block allocation CGN IP pool

Port block allocation (PBA) CGN IP pools reduce CGNAT logging overhead by creating a log entry only when a client first establishes a network connection and is assigned a port block. The number of log entries are reduced because a log entry is created when the port block is assigned, and not for each client connection.

When all of the client sessions have ended, FortiOS releases the port block and writes another log message. You can also configure logging to only write a log message when the port block is released. See Configuring hardware logging.

In general, because each customer environment is different, different configurations may be required to achieve optimal performance.

PBA allocates a contiguous set of source translation endpoints called port blocks. These port blocks are associated to a client by one IP address and a block of ports. Port blocks are allocated on-demand and have a fixed size.

Configure PBA IP pools carefully to adequately and efficiently service clients that may require a different number of simultaneous connections. Careful analysis and testing is required to find optimal values for the traffic conditions on your network.

You can also configure PBA with overload. Overload causes FortiOS to re-use ports within a block, allowing for more possible connections before running out of ports. To configure PBA with overload, see Overload with port-block-allocation CGN IP pool.

From the GUI

Go to Policy & Objects > IP Pools.
Select IP Pool.
Select Create New.
Give the IP pool a Name.

Type is set to CGN Resource Allocation and can't be changed.
Set Mode to Port Block Allocation.
Configure the External IP Range to specify the set of translation IP addresses available in the pool as a collection of IP prefixes with their prefix lengths. These are typically public-side addresses.
You can enable NAT64 to make this a NAT64 IP pool.
Optionally Exclude IPs from the External IP Range. You can include multiple single IP addresses.
Configure the Start port and End port to define the source port range for the IP pool.
Configure the Block Size to set the number of ports allocated in a block.
Enable or disable ARP reply to reply to ARP requests for addresses in the external address range.

From the CLI

Use the following command to configure PBA CGN IP pools from the CLI:

config firewall ippool

edit <name>

set type cgn-resource-allocation

set startip <ip>

set endip <ip>

set pba-interim-log <log-interval>

set arp-reply {disable | enable}

set arp-intf <interface-name>

set associated-interface <interface-name>

set cgn-spa disable

set cgn-overload disable

set cgn-fixedalloc disable

set cgn-block-size <number-of-ports>

set cgn-port-start <port>

set cgn-port-end <port>

set utilization-alarm-raise <usage-threshold>

set utilization-alarm-clear <usage-threshold>

set nat64 {disable | enable}

set exclude-ip <ip>, <ip>, <ip> ...

end

You can define a port-block allocation CGN IP pool by configuring the following:

External IP range (start-ip and end-ip). Specifies the set of translation IP addresses available in the pool as a collection of IP prefixes with their prefix lengths. These are typically public-side addresses.
NAT64 (nat64). Enable to make this a NAT64 IP pool.
Exclude IPs (exclude-ip). Specify external IP addresses that the CGN IP pool will not allocate. This is a security feature that allows you to exclude one or more IP addresses from being allocated if the IP pool could assign addresses that have been targeted by external attackers. You can only add single IP addresses. You cannot add IP address ranges. From the CLI you can use the ? to see how many IP addresses you can add. The limit depends on the FortiGate model.
Start port (cgn-port-start). The lowest port number in the port range. The range is 1024 to 65535. The default value is 5117. The range is 1024 to 65535.
End port (cgn-port-end). The highest possible port number in the port range. The default value is 65530. The range is 1024 to 65535.
Block size (cgn-block-size). The number of ports allocated in a block. The block size can be from 64 to 4096 in increments of 64 (for example, 64, 128, 192,..., 4096). The default value is 128. Use a smaller port block size to conserve available ports.
ARP reply (arp-reply). Enable to reply to ARP requests for addresses in the external address range.

CLI-only options:

Optionally enable interim logging (pba-interim-log) by setting a <log-interval>; which is the time between sending interim log messages while a session is active. Normally hyperscale hardware logging only sends log messages at the start or end of a session or both, depending on the logging mode. The default <log-interval> of 0 disables interim logging. For more information, see Interim logging for CGN sessions.
Optionally specify the interface (arp-intf) that replies to ARP requests.
Optionally specify the interface associated with this IP pool (associated-interface).
Generate an SNMP trap when the usage of the resources defined by an IP pool exceeds a threshold (utilization-alarm-raise). The range is 50 to 100 per cent.
Generate an SNMP trap when the usage of the resources defined by an IP pool falls below a threshold (utilization-alarm-clear). The range is 40 to 100 per cent.
When NAT64 is enabled , the option add-nat-64-route appears. This option is ignored by hyperscale firewall policies.
When NAT64 is enabled, the option subnet-broadcast-in-ippool appears. This option is enabled by default. If you disable this option, the subnetwork address and broadcast IP address are removed from the NAT64 IP pool. This configuration is required by some applications. If you set this option to disable you can't re-enable it.