F5 SNAT Exhaustion: tmsh show sys connection When Random Users Fail

F5 BIG-IP · Techclick CLI troubleshooting lab

Random users cannot connect through the VIP. Some work. The pool is green. Happens at peak hour.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on F5 BIG-IP for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

SNAT automap on a busy VIP can exhaust ephemeral ports. Connection table and SNAT stats show it.

Why this ticket shows up

One floating self-IP only has 64k ports. Large outbound or many short connections burn them.

Symptoms operators actually see

• Intermittent connect fails at noon

• SNAT translation errors

• One self-IP

• Lots of TIME_WAIT

CLI first — copy this block

Run these on the F5 BIG-IP device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

tmsh show sys connection | grep -c established
tmsh show ltm snat-translation
tmsh show sys tmm-traffic
tmsh list ltm virtual VS-WEB nat
tmsh show sys connection cs-client-addr 10.5.5.5

How to read that output

If SNAT translations are near the port limit, add a SNAT pool of extra self-IPs or enable SNAT pool rather than automap.

Triage order

1. Check connection counts vs SNAT pool size

2. Confirm the virtual uses automap

3. Add more translation addresses

4. Apply during a window

5. Watch failures drop at the next peak

Classic traps

What you see	Real cause	Fix
Raise pool members	Ports are on the F5 source	Fix SNAT
Disable SNAT	Servers may not route back	Use a larger SNAT pool
Reboot TMM	It will refill by lunch	Not a fix

Proof the ticket is closed

• SNAT pool has multiple IPs

• Peak failures stop

• Servers still see the expected source

Say this in an interview

Random peak-hour VIP fails with a green pool is SNAT ports until the numbers say otherwise.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/