Azure Firewall: Identifying SourceIPs with High SNAT Port Utilization

Question

I received an alert that the SNAT port utilization for my Azure Firewall is high. Is there a way to see which SourceIPs are consuming more SNAT port data? I tried using a Kusto query but was unsuccessful. Can anyone help me identify the SourceIPs with high SNAT port utilization for my Azure Firewall?

Answer 1

@SafiyullahSA

Thank you for reaching out.

I understand you are getting SNAT port exhaustion alert for your Azure Firewall. And you wish to know which Source IP contributed the most in SNAT port exhaustion.

I think Top flows log will be helpful in this scenario. The Top flows log (known in the industry as Fat Flows), shows the top connections that are contributing to the highest throughput through the firewall. This query returns the top flows across Azure Firewall instances and these are the columns available.

Meanwhile as documented here If your firewall is running into SNAT port exhaustion, you should add at least five public IP address. This increases the number of SNAT ports available.

Hope this helps! Please let me know if you have any questions. Thank you!

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.