Include connection closure in a NAT Gateway port-cooldown investigation

Source facts

NAT Gateway applies a cooldown before reusing a SNAT port for the same destination, and the timer varies with how the connection closed. Microsoft’s example places a port in cooldown for 65 seconds after a TCP FIN, exceeding the example destination firewall’s 20-second source-port timer. Microsoft cautions that the illustrated source-port assignments are conceptual examples rather than behavior to depend on. Microsoft Learn.

Applicability

Use this review for repeated outbound connections to the same destination endpoint through NAT Gateway. Identify the protocol, closing event and destination-side connection tracking before choosing a timing explanation.

DSE recommendation

DSE recommends retaining closure and retry timestamps with the destination firewall’s relevant timeout configuration. Review the applicable documented reuse timer with both network owners. Keep the example’s timing scoped to its stated closing event, and avoid promising that a subsequent flow will receive the same translated port.

Verification

In an approved diagnostic exercise, correlate sanitized flow observations with closure events and destination-side logs. Compare the observed sequence with the applicable timer instead of treating every closed connection identically. Document any evidence gap before changing application retry behavior or expanding outbound capacity.

Official references

Microsoft Learn: Source Network Address Translation (SNAT) with Azure NAT Gateway.