Google Cloud Nat One rule needs more IP addresses

[Abdellatif051]

I have a Cloud NAT with this config (fake adresses):

• Source subnets & IP ranges: All subnets' primary and secondary IP ranges
• Cloud NAT IP addresses: Manual: 203.0.113.30, 203.0.113.40
  
  I added a customized rule 1:
• Match: 198.51.100.20/30
• source_nat_active_ips: 203.0.113.20All network service tier are premium.

After I added this custom rule I have a status alert: Rule needs one more IP address.

There is no mention in the documentation that requires us to add multiple addresses in a single cloud nat rule.

Alert screenshot: 

Architecture screenshot:

Is that normal ?

Has anyone had this problem before?

[diannemcm]

Hi @Abdellatif051 ,

Welcome to Google Cloud Community!

Sharing with you this documentation that illustrates the steps on how to create NAT rules. I replicated on cloud console and it shows below result:

Disclaimer: Policy restricts IP address display.

Note that: 

• NAT IP addresses across NAT rules must not overlap.
• A rule must either have a non-empty Active or non-empty Drain IP address. If the rule has an empty Active IP address, new connections that match the NAT rule are dropped. See NAT rules specifications

I hope the above information is helpful.

[Abdellatif051]

Hello @diannemcm 

Thank you for your response !

- All ip addresses across my NAT rules are not overlapped.

- I do not have any drained or an empty active IP address.

I created the same resources in 2 personal Google Cloud Projects and it works without any warning.

This warning is only displayed in my client google cloud organization.

After some modification I noticed that is related to Port allocation:

- Minimum ports per VM instance is below 2048 => Warning not displayed.

- Equal or greater than 2048 => Warning displayed.

Depending on traffic we need 2048 as Minimum ports per VM instance, and all our applications are in cloud run (Traffic routing: route all traffic to the VPC)

I searched all the documentation and I did not find a relationship between NAT port allocation and custom rule.

Did i miss something ?