Alarms in an NSX environment report SNAT port usage is high and/or Edge is out of TX/ RX buffer

Products

• VMware NSX

Issue/Introduction

During regular use of an NSX prepared environment, the following alarms may appear in the NSX interface:

• NSX UI Alarm "SNAT ports usage on logical router <Logical Router UUID> for SNAT IP <SNAT IP> has reached the high threshold value of 80%. New flows will not be SNATed when usage reaches the maximum limit."
• SNAT Port Usage On Gateway is High alarm
• Edge NIC out of receive / transmit buffer alarm

You may also see alarms similar to:

• Edge Datapath CPU very high alarm
• Edge Datapath CPU high usage alarm
• Edge Datapath NIC throughput high alarm on NSX Edge VM and Bare Metal Edge

Environment

• VMware NSX

Cause

All of these alarms are caused by high amounts of traffic being processed by the Edge's various components. 

A high amount of traffic can consist of:

• A large number of packets per second being sent / received by the Edge(s)
• A large number of connections being processed by the Edge(s) (such as SNAT or Firewall connections / ports used)
• A large amounts of data flowing through the Edge network card(s) (throughput)
• Any combination of the above

Resolution

Perform an environment workload evaluation with tools such as VCF Operations for Networks to determine the source of the excessive traffic. Based on your knowledge of your environment and its needs, decide the best plan to move forward such as:

• Add more Edges (virtual or bare metal) to the cluster
• Increase the form factor of virtual Edges (from medium/large to large/extra large)
• Move specific workloads to different environments
• Reduce the overall workload in the environment

You may be able to use High Datapath CPU Utilization and SNAT Port Exhaustion on NSX Edge Nodes to identify the source of some of the heavy workload and act on this traffic as necessary.