Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?




Hierarchy Level


When you use block allocation, one or more blocks of ports in a NAT pool address range are available for assignment to a subscriber.

Port block allocation is supported on MX series routers with MS-DPCs and on M Series routers with MS-100, MS-400, and MS-500 MultiServices PICS. Port block allocation is supported on MX series routers with MS-MPCs and MS-MICs starting in Junos OS release 14.2R2.


If you define the session lifetime globally for a Multiservices (ms-) interface (by using the session-timeout seconds statement at the [edit interfaces interface-name services-options] hierarchy level), the session is terminated even if traffic continues to flow beyond that time period. When continuous traffic transmission occurs, the session is reset immediately after the timeout period. When you configure the same value for the session timeout and the active port block allocation timeout, the system might not determine that the active port block timeout period has elapsed. As a result, when the active port block timeout elapses, the system might use the same block for the initial port allocation that was used previously. However, for the subsequent allocation of a port block, the system identifies the active block timeout value correctly and allocates a port from a new block. This behavior is expected when the session timeout and port block timeout values are identical. To avoid this problem, we recommend that you configure different values for session timeout and port block timeout so that the JSERVICES_NAT_PORT_BLOCK_ALLOC system logging message is generated at correct intervals of the active port block timeout value.


If you make any configuration changes to a NAT pool that has secured port block allocation configured, you must delete the existing NAT address pool, wait at least 5 seconds, and then configure a new NAT address pool. We also strongly recommend that you perform this procedure if you make any changes to the NAT pool configuration, even when secured port block allocation is not configured.


active-block-timeout timeout-seconds

Interval, in seconds, during which a block is active. After the timeout elapses, a new block is allocated, even if ports are available in the active block.

  • Range: 0 through 86400. When you specify 0, the active block transitions to inactive only when it runs out of ports and a new block is allocated. Any inactive block without any ports in use will be freed to the NAT pool, unless it is active block. The range is 1 through 512.

  • Default: 120

block-size block-size

Number of ports included in a block.

  • Range: For the Multiservices DPC only, 1 through 32,000

  • Range: For the Multiservices MPC and Multiservices MIC only, 1 through the total number of configured ports. For example, for a port range of 1024 through 61,024, the block-size range is 1 through 60,000.

  • Default: 128

max-blocks-per-address max-blocks

Maximum number of blocks that can be allocated to a user address. The range is 1 through 512.

Required Privilege Level

interface—To view this statement in the configuration.

interface-control—To add this statement to the configuration.

Release Information

Statement introduced in Junos OS Release 11.2.