topic Re: Aggressive Aging in Firewall and Security Management

Aggressive Aging

Jason_Carrillo — Fri, 29 Mar 2019 16:35:41 GMT

TL;DR How does one determine if a connection entry was purged because Aggressive Aging?

Apologies if this has been answered previously, but I'm struggling to find information about how to track down when aggressive aging has occurred. I know that "fw ctl pstat" will tell me if it is active but is there a way to track down if it has happened recently.

We have some connections that are getting registered as out of state and I'd like to try and determine if they are the result of TCP start timeouts, TCP session timeouts or aggressive aging timeouts.

Some of them are easy to determine. Couple minutes after an accept, you get an ACK dropped out of state, probably the start timeout. Couple hours after an accept, you get out of state drops on the same port combinations, probably a session.

But the forty minute after accept drops for the same port combination are the ones that are stumping me. Within the session timeouts, way too far out to be a start timeout (unless something is REALLY wrong with our wireless network) but within the range of the Aggressive Aging settings.

Our connection limit is set to Automatic and the firewall itself doesn't seem to be under too much load.

Re: Aggressive Aging

Kaspars_Zibarts — Fri, 29 Mar 2019 18:37:11 GMT

Just search in smartlog, see attached screenshot

Re: Aggressive Aging

Jason_Carrillo — Fri, 29 Mar 2019 18:39:16 GMT

Perfect! Thank you. No sign of those logs in my walls, so AA doesn't appear to be the culprit.

Re: Aggressive Aging

Sascha_Bremshey — Tue, 13 Apr 2021 06:55:47 GMT

In case you don't want to download and open the screenshot:

Search term "aggressive_aging_general" is used.

Re: Aggressive Aging

KostasGR — Wed, 04 Aug 2021 14:41:10 GMT

Hello

By default when the connection table reaches 80% of its capacity the anti-Dos mechanism agressive aging takes place.

Has anyone configured a snmp trap mechanism in order to get a notification if capacity of connection table reaches 70% for example?

BR,

Kostas

Re: Aggressive Aging

pjoseph — Wed, 26 Jan 2022 17:53:18 GMT

Yes - we have set it to 45% to ensure we're capable of full site failover.