> Source: [sk183481](https://support.checkpoint.com/results/sk/sk183481)

# sk183481 - In ElasticXL, each Security Group Member allocates only 1785 ports for Hide NAT instead of approximately 16600 ports

| Property | Value |
|----------|-------|
| Solution ID | sk183481 |
| Date Created | 2025-05-19 |
| Last Modified | 2025-11-05 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R82.10, R82 |
| OS | Gaia |

## Symptoms

- In ElasticXL, when moving to the context each Security Group Member with the "`member`" command, the CPview tool \> "`Advanced`" tab \> "`NAT`" tab \> "`Pool-IPv4`" page \> the "`High port`" section \> the "`Capacity`" column shows 1785 ports for Hide NAT

Example:

![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1747642210554/CPview_202505191119491.png)

## Cause

Incorrect calculation of Hide NAT ports in ElasticXL (50000 / 28 = 1785 instead of 50000 / 3 = 16666).

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 44

If you choose not to upgrade, [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue (**requires manual configuration**).

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the ElasticXL involved in the case.

### Configuration Part 1 of 2 - Install the hotfix

> Refer to the [R82 Scalable Platforms Administration Guide](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ScalablePlatforms_AdminGuide/Default.htm) \> Chapter "Common Procedures for Scalable Platforms" \> Section "Installing and Uninstalling a Hotfix on Security Group Members".

### Configuration Part 2 of 2 - Enable the fix (Zero Downtime procedure)

> Show / Hide this section  
> **Important Notes:**
>
> 1. Follow these steps only on the Active ElasticXL Site.  
>    The Standby ElasticXL Site will synchronize the required configuration from the Active ElasticXL Site.
>    * Steps in Gaia Portal to see the state of each ElasticXL Site:
>      1. Connect to Gaia Portal on the ElasticXL.
>      2. In the left panel, click **Cluster Management**.
>    * In Gaia gClish to see the state of each ElasticXL Site:
>      1. Connect to the command line on the ElasticXL.
>      2. Log in.
>      3. If the default shell is the Expert mode, then go to Gaia gClish: `gclish`
>      4. Run: `show cluster info overview`
> 2. If the Security Group Member 1_01 is currently not part of the Security Group, then during this procedure, run the required commands on the ElasticXL Cluster Member 1_02.  
>    In such a case, the Security Group may drop some traffic.
>
> **Enabling the fix:**
>
> 1. Connect to the command line on ElasticXL.
>
> 2. Log in.
>
> 3. If the default shell is the Expert mode, then go to Gaia gClish:
>
>    `gclish`
> 4. Make sure the ElasticXL Cluster Member **1_01** is in the state "ACTIVE".
>
>    `show cluster info overview`
> 5. Change the state of the ElasticXL Cluster Members **1_2** and **1_3** to "DOWN".
>
>    `set cluster members-admin-state ids 1_2 down`
>
>    `set cluster members-admin-state ids 1_3 down`
> 6. Go from Gaia gClish to the Expert mode:
>
>    * If the default shell is the Expert mode, then exit from Gaia gClish:
>
>      `exit`
>    * If the default shell is Gaia gClish, then go to the Expert mode:
>
>      `expert`
> 7. Enable the fix:
>
>    `exl_cli set cluster increase_nat_ports [--force]`
>
>    The "`--force`" option applies the change to all Active Security Group Members, which may cause:
>    * A temporary packet loss
>    * A temporary reset of NAT connections
>    * A brief network disruption
> 8. Go from the Expert mode to Gaia gClish:
>
>    * If the default shell is the Expert mode, then go to Gaia gClish:
>
>      `gclish`
>    * If the default shell is Gaia gClish, then exit the Expert mode:
>
>      `exit`
> 9. Change the state of the ElasticXL Cluster Members **1_2** and **1_3** to "UP".
>
>    `set cluster members-admin-state ids 1_2 up`
>
>    `set cluster members-admin-state ids 1_3 up`
> 10. Examine the number of allocated Hide NAT ports:
>
>     1. Run:
>
>        `cpview`
>     2. At the top, click the "`Advanced`" tab \> click the "`NAT`" tab \> click the "`Pool-IPv4`" tab.
>
>     3. In the "`High port`" section, examine the "`Capacity`" column - it must show the value 16600 (approximately).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content