terraform-example-foundation icon indicating copy to clipboard operation
terraform-example-foundation copied to clipboard

Default Cloud NAT setting change suggestion

Open russStarr opened this issue 3 years ago • 0 comments

Based on experience in the field, I'm finding that these default Cloud NAT settings are not the most resilient to production traffic:

https://github.com/terraform-google-modules/terraform-example-foundation/blob/2f3e2291ebfd93e66b54d763924f2201e8dbf023/3-networks/modules/base_shared_vpc/nat.tf#L76-L90

Specifically, see the following recommendations:

  • line 82, nat_ip_allocate_option is set to "MANUAL_ONLY" by default. Changing this to AUTO_ONLY will allow Cloud NAT to grow the number of External IP addresses being used, which can prevent port exhaustion.
  • One additional setting that should be added is enable_dynamic_port_allocation. This will allow for more dynamic allocation of ports, especially during periods of bursty network activity.

Caveat: Cloud NAT can have nuanced recommendations based on customers exact requirements. I believe that making changes to these default settings offers more resilience for a majority of the users that wish to build from this example foundation.

russStarr avatar Aug 01 '22 18:08 russStarr