How can I increase my SNAT ports for my app service experiencing SNAT port exhaustion?

Question

I have an app service that has been working without major SNAT port issues for years. During this Azure planned maintenance for Dec 11 - 21, 2023 suddenly my SNAT port usage has jumped by a factor of 10. My app service is mostly unresponsive. We have a single HTTP connection which is reused for the app service. We have DB connection pooling as well. My app service supports my web app frontend and makes external calls to other APIs not hosted in Azure. I need help ASAP. Neither of my app services (frontend or backed) use VNAT,

Answer 1

@Pamela Reynolds Thanks for reaching here!

So, to add further for solving a SNAT port exhaustion issue for App Service, you can follow the general guidance in the Problem Solving section of Outbound connections in Azure, which applies to App Service web applications. The guidance includes:

• Reusing connections in the application
• Using connection pooling in the application
• Using less aggressive retry logic in the application
• Using keepalives to reset the outbound idle timeout

In addition, you can also try these App Service-specific solutions:

• Make sure the backend services can respond quickly
• Scale out the App Service plan to more instances
• Use App Service Environment, which has more SNAT ports for each worker instance, due to its smaller instance pool size

A load test should simulate real world data at a steady pace.

Suggest you refer below detailed blog links would be helpful-

• https://4lowtherabbit.github.io/blogs/2019/10/SNAT/
• Azure App Services: Efficient Management of SNAT Connections

Let us know if further query or issue remains.

Answer 2

Hi Pamela Reynolds,

There are some ways to avoid the SNAT port limitation on azure web app;

• connection pools: By pooling your connections, you avoid opening new network connections for calls to the same address and port.
• service endpoints: You don't have a SNAT port restriction to the services secured with service endpoints.
• private endpoints: You don't have a SNAT port restriction to services secured with private endpoints.
• NAT gateway: With a NAT gateway, you have 64k outbound SNAT ports that are usable by the resources sending traffic through it. https://learn.microsoft.com/en-us/azure/app-service/troubleshoot-intermittent-outbound-connection-errors

It depends on your application architecture you can add eaither a service connection or private endpoint to communicate to your app service.

Additional help:

• https://learn.microsoft.com/en-us/azure/private-link/create-private-endpoint-portal
• https://learn.microsoft.com/en-us/azure/service-connector/quickstart-portal-app-service-connection

Cheers,

Luis

---

If the information helped address your question, please Accept the answer.

Answer 3

.....................