# In ElasticXL, each Security Group Member allocates only 1785 ports for Hide NAT instead of approximately 16600 ports

Product: ElasticXL  
Version: R82, R82.10  
OS: Gaia  
Last Modified: 2025-11-05

## Symptoms

- In ElasticXL, when moving to the context each Security Group Member with the `member` command, the CPview tool > `Advanced` tab > `NAT` tab > `Pool-IPv4` page > the `High port` section > the `Capacity` column shows 1785 ports for Hide NAT

Example:

## Cause

Incorrect calculation of Hide NAT ports in ElasticXL (50000 / 28 = 1785 instead of 50000 / 3 = 16666).

## Solution

This problem was fixed. The fix is included in:

- [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 44

If you choose not to upgrade, [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue ( **requires manual configuration**).

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.

For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the ElasticXL involved in the case.

### Configuration Part 1 of 2 - Install the hotfix

> Refer to the [R82 Scalable Platforms Administration Guide](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ScalablePlatforms_AdminGuide/Default.htm) \> Chapter "Common Procedures for Scalable Platforms" > Section "Installing and Uninstalling a Hotfix on Security Group Members".

### Configuration Part 2 of 2 - Enable the fix (Zero Downtime procedure)

**Important Notes:**

1. Follow these steps only on the Active ElasticXL Site.
   The Standby ElasticXL Site will synchronize the required configuration from the Active ElasticXL Site.
   - Steps in Gaia Portal to see the state of each ElasticXL Site:
     1. Connect to Gaia Portal on the ElasticXL.
     2. In the left panel, click **Cluster Management**.
   - In Gaia gClish to see the state of each ElasticXL Site:
     1. Connect to the command line on the ElasticXL.
     2. Log in.
     3. If the default shell is the Expert mode, then go to Gaia gClish: `gclish`
     4. Run: `show cluster info overview`

2. If the Security Group Member 1_01 is currently not part of the Security Group, then during this procedure, run the required commands on the ElasticXL Cluster Member 1_02.
   In such a case, the Security Group may drop some traffic.

**Enabling the fix:**

01. Connect to the command line on ElasticXL.

02. Log in.

03. If the default shell is the Expert mode, then go to Gaia gClish:

`gclish`

04. Make sure the ElasticXL Cluster Member **1_01** is in the state "ACTIVE".

`show cluster info overview`

05. Change the state of the ElasticXL Cluster Members **1_2** and **1_3** to "DOWN".

`set cluster members-admin-state ids 1_2 down`

`set cluster members-admin-state ids 1_3 down`

06. Go from Gaia gClish to the Expert mode:
    - If the default shell is the Expert mode, then exit from Gaia gClish:

`exit`
    - If the default shell is Gaia gClish, then go to the Expert mode:

`expert`

07. Enable the fix:

`exl_cli set cluster increase_nat_ports [--force]`

The "`--force`" option applies the change to all Active Security Group Members, which may cause:
    - A temporary packet loss
    - A temporary reset of NAT connections
    - A brief network disruption

08. Go from the Expert mode to Gaia gClish:
    - If the default shell is the Expert mode, then go to Gaia gClish:

`gclish`
    - If the default shell is Gaia gClish, then exit the Expert mode:

`exit`

09. Change the state of the ElasticXL Cluster Members **1_2** and **1_3** to "UP".

`set cluster members-admin-state ids 1_2 up`

`set cluster members-admin-state ids 1_3 up`

10. Examine the number of allocated Hide NAT ports:
    1. Run:

`cpview`
    2. At the top, click the "`Advanced`" tab > click the "`NAT`" tab > click the "`Pool-IPv4`" tab.
    3. In the "`High port`" section, examine the "`Capacity`" column - it must show the value 16600 (approximately).

#### NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.