{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation/", "slug": "dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation", "url": "https://update.dsesecurity.com/updates/dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation/" }, "title": "Include connection closure in a NAT Gateway port-cooldown investigation", "summary": "Same-destination port reuse timing depends on how the earlier flow ended.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:46+00:00", "modified_at": "2026-09-17T16:42:36+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 200, "potentially_affected": "Use this review for repeated outbound connections to the same destination endpoint through NAT Gateway. Identify the protocol, closing event and destination-side connection tracking before choosing a timing explanation.", "dse_recommendation": "DSE recommends retaining closure and retry timestamps with the destination firewall's relevant timeout configuration.", "primary_source": { "name": "Source Network Address Translation (SNAT) with Azure NAT Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/nat-gateway/nat-gateway-snat", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

NAT Gateway applies a cooldown before reusing a SNAT port for the same destination, and the timer varies with how the connection closed. Microsoft’s example places a port in cooldown for 65 seconds after a TCP FIN, exceeding the example destination firewall’s 20-second source-port timer. Microsoft cautions that the illustrated source-port assignments are conceptual examples rather than behavior to depend on. Microsoft Learn.

\n

Applicability

\n

Use this review for repeated outbound connections to the same destination endpoint through NAT Gateway. Identify the protocol, closing event and destination-side connection tracking before choosing a timing explanation.

\n

DSE recommendation

\n

DSE recommends retaining closure and retry timestamps with the destination firewall’s relevant timeout configuration. Review the applicable documented reuse timer with both network owners. Keep the example’s timing scoped to its stated closing event, and avoid promising that a subsequent flow will receive the same translated port.

\n

Verification

\n

In an approved diagnostic exercise, correlate sanitized flow observations with closure events and destination-side logs. Compare the observed sequence with the applicable timer instead of treating every closed connection identically. Document any evidence gap before changing application retry behavior or expanding outbound capacity.

\n

Official references

\n

Microsoft Learn: Source Network Address Translation (SNAT) with Azure NAT Gateway.

", "content_text": "Source facts\nNAT Gateway applies a cooldown before reusing a SNAT port for the same destination, and the timer varies with how the connection closed. Microsoft’s example places a port in cooldown for 65 seconds after a TCP FIN, exceeding the example destination firewall’s 20-second source-port timer. Microsoft cautions that the illustrated source-port assignments are conceptual examples rather than behavior to depend on. Microsoft Learn.\nApplicability\nUse this review for repeated outbound connections to the same destination endpoint through NAT Gateway. Identify the protocol, closing event and destination-side connection tracking before choosing a timing explanation.\nDSE recommendation\nDSE recommends retaining closure and retry timestamps with the destination firewall’s relevant timeout configuration. Review the applicable documented reuse timer with both network owners. Keep the example’s timing scoped to its stated closing event, and avoid promising that a subsequent flow will receive the same translated port.\nVerification\nIn an approved diagnostic exercise, correlate sanitized flow observations with closure events and destination-side logs. Compare the observed sequence with the applicable timer instead of treating every closed connection identically. Document any evidence gap before changing application retry behavior or expanding outbound capacity.\nOfficial references\nMicrosoft Learn: Source Network Address Translation (SNAT) with Azure NAT Gateway.", "content_markdown": "## Source facts\n\nNAT Gateway applies a cooldown before reusing a SNAT port for the same destination, and the timer varies with how the connection closed. Microsoft’s example places a port in cooldown for 65 seconds after a TCP FIN, exceeding the example destination firewall’s 20-second source-port timer. Microsoft cautions that the illustrated source-port assignments are conceptual examples rather than behavior to depend on. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/nat-gateway/nat-gateway-snat).\n\n## Applicability\n\nUse this review for repeated outbound connections to the same destination endpoint through NAT Gateway. Identify the protocol, closing event and destination-side connection tracking before choosing a timing explanation.\n\n## DSE recommendation\n\nDSE recommends retaining closure and retry timestamps with the destination firewall’s relevant timeout configuration. Review the applicable documented reuse timer with both network owners. Keep the example’s timing scoped to its stated closing event, and avoid promising that a subsequent flow will receive the same translated port.\n\n## Verification\n\nIn an approved diagnostic exercise, correlate sanitized flow observations with closure events and destination-side logs. Compare the observed sequence with the applicable timer instead of treating every closed connection identically. Document any evidence gap before changing application retry behavior or expanding outbound capacity.\n\n## Official references\n\n[Microsoft Learn: Source Network Address Translation (SNAT) with Azure NAT Gateway](https://learn.microsoft.com/en-us/azure/nat-gateway/nat-gateway-snat)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation/", "url": "https://update.dsesecurity.com/updates/dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Include connection closure in a NAT Gateway port-cooldown investigation", "item": "https://update.dsesecurity.com/updates/dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation/", "url": "https://update.dsesecurity.com/updates/dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation/", "headline": "Include connection closure in a NAT Gateway port-cooldown investigation", "description": "Same-destination port reuse timing depends on how the earlier flow ended.", "abstract": "Same-destination port reuse timing depends on how the earlier flow ended.", "articleBody": "Source facts\nNAT Gateway applies a cooldown before reusing a SNAT port for the same destination, and the timer varies with how the connection closed. Microsoft’s example places a port in cooldown for 65 seconds after a TCP FIN, exceeding the example destination firewall’s 20-second source-port timer. Microsoft cautions that the illustrated source-port assignments are conceptual examples rather than behavior to depend on. Microsoft Learn.\nApplicability\nUse this review for repeated outbound connections to the same destination endpoint through NAT Gateway. Identify the protocol, closing event and destination-side connection tracking before choosing a timing explanation.\nDSE recommendation\nDSE recommends retaining closure and retry timestamps with the destination firewall’s relevant timeout configuration. Review the applicable documented reuse timer with both network owners. Keep the example’s timing scoped to its stated closing event, and avoid promising that a subsequent flow will receive the same translated port.\nVerification\nIn an approved diagnostic exercise, correlate sanitized flow observations with closure events and destination-side logs. Compare the observed sequence with the applicable timer instead of treating every closed connection identically. Document any evidence gap before changing application retry behavior or expanding outbound capacity.\nOfficial references\nMicrosoft Learn: Source Network Address Translation (SNAT) with Azure NAT Gateway.", "datePublished": "2026-09-17T16:32:46+00:00", "dateModified": "2026-09-17T16:42:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Include connection closure in a NAT Gateway port-cooldown investigation" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 200, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Source Network Address Translation (SNAT) with Azure NAT Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/nat-gateway/nat-gateway-snat" } } ] } }