Professional Cloud Network Engineer

Dynamic Port Allocation Configuration and Auto-Scaling Behavior

Dynamic port allocation is a configuration for a Cloud NAT gateway that automatically adjusts the number of source ports assigned to a virtual machine (VM) based on its current traffic needs. You configure this by setting a minimum and maximum number of ports per VM. The gateway then scales the allocated ports for each VM independently, allowing a VM with bursty traffic to use more ports without permanently taking them from less active VMs.

The scaling mechanism works in power-of-two increments. When a VM's port usage approaches its current allocation, the gateway doubles the number of ports assigned to that VM, up to the configured maximum limit. When the VM's traffic subsides and ports are no longer in use, the gateway gradually reduces the allocation back toward the minimum. This dynamic behavior is incompatible with Endpoint-Dependent Mapping (EDM); if you enable EDM on a Public NAT gateway, you must use static port allocation instead.

Port Exhaustion Diagnostics and NAT Gateway Optimization

Port exhaustion occurs when a Cloud NAT gateway or a specific VM runs out of available source IP and port combinations, causing new outbound connections to fail. You diagnose this by monitoring specific Cloud Monitoring metrics. The key metric is router.googleapis.com/nat/dropped_sent_packets_count, which tracks dropped packets and groups them by reason, such as OUT_OF_RESOURCES (when a VM exhausts its ports) or ENDPOINT_INDEPENDENT_CONFLICT (when a port mapping conflict happens).

To optimize the gateway and prevent these drops, you can tune connection timeouts and ensure adequate NAT IP capacity. You can reduce the TCP TIME_WAIT timeout from its default of 120 seconds to as low as 5 seconds, which allows source ports to be reused more quickly. You can also adjust the TCP Transitory and Established Connection Idle Timeouts to better match your application's behavior. To scale capacity, you add more static external IP addresses to the NAT gateway's pool or enable automatic IP allocation, ensuring the total number of available ports meets the demand from all connected VMs.

Static Port Allocation Mechanics and Capacity Planning

Static port allocation is a configuration where you set a fixed, minimum number of source ports for each VM behind a Cloud NAT gateway. This method is required if you enable Endpoint-Independent Mapping (EIM) on a Public NAT gateway. With static allocation, each VM gets the same reserved number of ports, which does not change even if some VMs are idle while others are very active.

Planning capacity with static allocation involves calculating the required number of NAT IP addresses. Each NAT IP provides 64,512 usable source ports. You multiply the number of VMs by the ports allocated per VM to get the total ports needed, then divide by 64,512 to find the minimum number of NAT IPs required. For example, 100 VMs each with 1024 ports need about 102,400 total ports, requiring at least two NAT IP addresses (since 2 * 64,512 = 129,024 ports).

A key operational trade-off is the connection limit per destination. The number of ports per VM defines the maximum simultaneous connections that VM can have to a single destination endpoint (a specific IP, port, and protocol). Enabling EIM can introduce mapping conflicts if a single VM tries to use many of its internal source ports to talk to the same destination, potentially reducing this effective limit and causing dropped packets.

Key Facts

• Dynamic port allocation automatically scales source ports per VM between a configured min and max using power-of-two increments, but it is incompatible with Endpoint-Dependent Mapping (EDM).
• Port exhaustion is diagnosed using the Cloud Monitoring metric router.googleapis.com/nat/dropped_sent_packets_count, with reasons like OUT_OF_RESOURCES indicating a VM has run out of allocated ports.
• Static port allocation assigns a fixed number of ports per VM and is mandatory when Endpoint-Independent Mapping (EIM) is enabled on a Public Cloud NAT gateway.
• Each NAT IP address provides 64,512 usable source ports for capacity planning.
• Tuning the TCP TIME_WAIT timeout from its default of 120 seconds down to 5 seconds allows for faster port reuse and can help prevent exhaustion.

Frequently Asked Questions

What is the main difference between static and dynamic port allocation in Cloud NAT?

Static allocation reserves a fixed number of source ports for each VM, which never changes. Dynamic allocation allows the number of ports per VM to automatically scale up and down between a minimum and maximum limit based on the VM's current traffic, improving port utilization for uneven workloads.

When must I use static port allocation?

You must use static port allocation if you need to enable Endpoint-Independent Mapping (EIM) on a Public Cloud NAT gateway, as dynamic allocation is incompatible with this feature.

How do I know if my Cloud NAT gateway is experiencing port exhaustion?

Monitor the Cloud Monitoring metric router.googleapis.com/nat/dropped_sent_packets_count. A high count with the reason OUT_OF_RESOURCES indicates that VMs are exhausting their allocated ports, while ENDPOINT_INDEPENDENT_CONFLICT points to mapping conflicts when EIM is enabled.

How many NAT IP addresses do I need for 50 VMs with static allocation of 2048 ports each?

You first calculate total ports needed: 50 VMs * 2048 ports = 102,400 ports. Each NAT IP provides 64,512 ports. 102,400 / 64,512 ≈ 1.59, so you need to round up to 2 NAT IP addresses to have sufficient capacity.