# Include connection closure in a NAT Gateway port-cooldown investigation

> Same-destination port reuse timing depends on how the earlier flow ended.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:46+00:00
- Modified: 2026-09-17T16:42:36+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Same-destination port reuse timing depends on how the earlier flow ended.

## Potentially affected

Use this review for repeated outbound connections to the same destination endpoint through NAT Gateway. Identify the protocol, closing event and destination-side connection tracking before choosing a timing explanation.

## DSE recommendation

DSE recommends retaining closure and retry timestamps with the destination firewall's relevant timeout configuration.

## Article

## Source facts

NAT Gateway applies a cooldown before reusing a SNAT port for the same destination, and the timer varies with how the connection closed. Microsoft’s example places a port in cooldown for 65 seconds after a TCP FIN, exceeding the example destination firewall’s 20-second source-port timer. Microsoft cautions that the illustrated source-port assignments are conceptual examples rather than behavior to depend on. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/nat-gateway/nat-gateway-snat).

## Applicability

Use this review for repeated outbound connections to the same destination endpoint through NAT Gateway. Identify the protocol, closing event and destination-side connection tracking before choosing a timing explanation.

## DSE recommendation

DSE recommends retaining closure and retry timestamps with the destination firewall’s relevant timeout configuration. Review the applicable documented reuse timer with both network owners. Keep the example’s timing scoped to its stated closing event, and avoid promising that a subsequent flow will receive the same translated port.

## Verification

In an approved diagnostic exercise, correlate sanitized flow observations with closure events and destination-side logs. Compare the observed sequence with the applicable timer instead of treating every closed connection identically. Document any evidence gap before changing application retry behavior or expanding outbound capacity.

## Official references

[Microsoft Learn: Source Network Address Translation (SNAT) with Azure NAT Gateway](https://learn.microsoft.com/en-us/azure/nat-gateway/nat-gateway-snat).

## Primary reference

- Name: Source Network Address Translation (SNAT) with Azure NAT Gateway | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/nat-gateway/nat-gateway-snat
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Include connection closure in a NAT Gateway port-cooldown investigation,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-134-include-connection-closure-in-a-nat-gateway-port-cooldown-investigation/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.