Dynamic IP and Port (DIPP) source NAT allows your firewall to translate
private source IP addresses to a shared pool of public IP addresses, enabling large
numbers of internal hosts to access external networks. In previous PAN-OS versions,
the PA-7500 Series supported up to 32,000 translated IP addresses system-wide for
DIPP NAT, but each individual NAT policy was limited to a maximum of 256 translated
IP addresses (equivalent to a /24 subnet). This constraint meant that, to make full
use of the system's translation capacity, you would need to configure and maintain
as many as 128 separate DIPP NAT policies, each with its own distinct address
block.
Beginning with PAN-OS 12.1.8 on the PA-7500 Series,
both limits are significantly expanded.
The system-wide DIPP translated IP capacity increases from 32,000 to 32,768
addresses (/17 subnet), and the per-policy cap increases from 256 to 32,768
translated IP addresses, meaning you can now assign an entire /17 address block to a
single NAT policy rule. This is achieved by upgrading the underlying DIPP pool data
structure from a fixed-size array to a dynamic array, allowing memory to scale
proportionally with the number of translated IP addresses you configure rather than
pre-allocating the maximum regardless of actual usage. The feature takes effect
automatically upon upgrade and requires no configuration changes.
This capability is most valuable if you operate at service-provider scale,
where your environment may require tens of thousands of public translated IP
addresses to support internet connectivity for a large subscriber base or to
interconnect multiple regional infrastructure segments. Rather than distributing
your translation addresses across dozens or hundreds of individual NAT rules, each
requiring its own address block and independent maintenance, you can consolidate
your entire DIPP NAT configuration into a single policy, reducing administrative
overhead and the risk of misconfiguration. If you upgrade from an earlier release
and later attempt to downgrade, PAN-OS will block the downgrade if your configured
DIPP pool sizes exceed the limits supported by the earlier image, providing a clear
error message that identifies the specific policy or system-wide count that must be
reduced before the downgrade can proceed.
