A branch using DIA with CGNAT reports that new internet sessions intermittently fail. CGNAT pool counters show increasing out-of-ports errors, while…

The key symptoms are "increasing out-of-ports errors" while "out-of-address errors remain zero." This indicates that the CGNAT pool has available public IP addresses but has exhausted the available TCP/UDP port numbers for a given IP address. Each new session requires a unique source port for translation. When all 64,511 usable ports for an IP are allocated, new sessions are dropped, resulting in "out-of-ports" errors. The intermittent nature of the failures is consistent with the pool reaching its port limit during peak usage.

B. If the NAT pool had no IP addresses, the "out-of-address" error counter would be increasing, which contradicts the scenario.

C. A rule matching the wrong zone is a policy misconfiguration that would likely cause consistent failures, not intermittent ones tied to port exhaustion counters.

D. OSPF is a LAN-side routing protocol and is unrelated to the DIA/CGNAT function, which handles address and port translation for internet-bound traffic.

1. Versa Networks, "Versa Operating System (VOS) CGNAT Configuration Guide," Release 21.2.2, Document ID: VOS-21.2.2-CGNAT-C-G, Section: "Monitoring and Troubleshooting CGNAT," pp. 55-57. (Explains the meaning of out-of-ports and out-of-address errors).

2. Versa Networks, "Versa Operating System (VOS) CLI Reference Guide," Release 21.2.2, Document ID: VOS-21.2.2-CLI-REF, Section: "show cgnat pool counters," pp. 345-346. (Details the CLI command and its output fields, including the error counters).