Port Block Allocation (PBA) for CGN to reduce logs
Port Block Allocation (PBA), a Carrier Grade NAT (CGN) feature, can reduces the number of log messages generated by NAT operations.
PBA can be configured using by going to Firewall Objects > Virtual IPs > IP Pools. It can also be configured using the CLI.
config firewall ippool
edit ippool
set type port-block-allocation
set block-size <integer>
set num-blocks-per-user <integer>
end
end
You configure PBA by creating a private IP address range and assigning multiple port ranges (or blocks) to that IP address range. When a connection is received from the IP range, the source port is translated to a ports in the first range. A log message is written when this happens.
As more connections are received from this IP address range they are assigned to other ports in the first port block. Eventually all of the ports in the block will be used. When a new connection is received, another block of ports is started and a log message is written.
So instead of writing a log message for every NAT event, log messages are only written when a new block of ports is started and again when its used up.