Modify the Oversubscription Rate for DIPP NAT

1. View the DIPP NAT oversubscription rate.

   1. Select DeviceSetupSessionSession Settings. View the NAT Oversubscription Rate setting.
2. Set the DIPP NAT oversubscription rate.

   1. Edit the Session Settings section.
   2. In the NAT Oversubscription Rate list, select 1x, 2x, 4x, or 8x, depending on which ratio you want.

      The Platform Default setting applies the default oversubscription setting for the model. If you want no oversubscription, select 1x.
   3. Click OK and Commit the change.

      • If you have a PA-7500 Series firewall running PAN-OS 12.1.5 or a later release and you plan to maximize the DIPP NAT translated IP addresses to 32,000, you must reduce the oversubscription ratio to 1x in most configurations. Furthermore, if you configure a PA-7500 Series firewall with more than 16,000 DIPP NAT translated IP addresses, you can't downgrade to a PAN-OS version earlier than PAN-OS 12.1.5.
      • Beginning with PAN-OS 12.1.8, the PA-7500 Series supports up to 32,768 DIPP NAT translated IP addresses system-wide and up to 32,768 translated IP addresses per DIPP NAT policy rule.
        As the configured translated IP count approaches 32,768, the oversubscription ratio degrades and may be set to 1x (no oversubscription). If you downgrade from PAN-OS 12.1.8, the following conditions each independently block the downgrade:
        • When the system-wide DIPP NAT translated IP count exceeds 32,000. You must reduce the number of DIPP NAT IP addresses, commit, and retry the downgrade.
        • When a single DIPP NAT policy rule has more than 256 translated IP addresses. Identify any DIPP NAT policy rule with more than 256 translated IP addresses and reduce each such policy to 256 or fewer addresses. If needed, split a large policy into multiple rules. Commit the configuration and then retry the downgrade.