topic Re: Connection peak exceeded on vsx in Firewall and Security Management

Connection peak exceeded on vsx

starmen2000 — Wed, 02 Aug 2023 17:46:03 GMT

Hi mates

I'm getting a 'Vsx firewall peak connection exceeded' warning. It has given me this warning twice in two days. The limit is set to 24,000. How can we increase this limit on VSX?

Thanks

Re: Connection peak exceeded on vsx

Alex- — Wed, 02 Aug 2023 19:52:24 GMT

You can modify the maximum number of connections in a VS by editing the VS, selecting Optimizations and entering the desired number.

Press OK, then install the policy.

Re: Connection peak exceeded on vsx

the_rock — Wed, 02 Aug 2023 23:05:37 GMT

Below is what @Alex- is referring to. I would strongly suggest you choose automatic option, as gateway itself calculates the amount handles based on cpu/memory.

Andy

Re: Connection peak exceeded on vsx

Alex- — Thu, 03 Aug 2023 05:50:01 GMT

On VSX, this option is grayed out and you need a manual entry, So if 24K peaks every now and then you could go to 30 or 40K and monitor with either HCP or vsx stat -l.

Re: Connection peak exceeded on vsx

the_rock — Thu, 03 Aug 2023 11:59:59 GMT

Ah yes, right, I totally forgot about that : - (. I recall back in R77.30, was the same way, pretty sure.

Andy

Re: Connection peak exceeded on vsx

Bob_Zimmerman — Thu, 03 Aug 2023 14:54:10 GMT

I would bump it to 250k or more. The point of the hard connections table limit is to protect other VSs on the system from resource exhaustion attacks against one VS. That is, if someone tries to fill up the connections table of your Internet VS, they won't also take down your interior VSs or the VS handling a second Internet connection. Ever since R67 (the first version to move to the 2.6 kernel), the connections table has been able to use many gigabytes of space, so the practical limit for the whole box is generally in the tens of millions of connections.

Unless you're running a hundred VSs on a box, or you're running with very little RAM, tiny tables don't protect you from anything. Instead, they just shoot you in the foot like this over and over as load increases.

Re: Connection peak exceeded on vsx

genisis__ — Thu, 03 Aug 2023 20:44:42 GMT

The easiest way to monitor is via SNMP.

I've setup a table which combines Connection Limit, Current connections & Peak Connections. In this way you can monitor over time.