Aggressive Aging

[Jason_Carrillo]

TL;DR How does one determine if a connection entry was purged because Aggressive Aging?

Apologies if this has been answered previously, but I'm struggling to find information about how to track down when aggressive aging has occurred. I know that "fw ctl pstat" will tell me if it is active but is there a way to track down if it has happened recently. 

We have some connections that are getting registered as out of state and I'd like to try and determine if they are the result of TCP start timeouts, TCP session timeouts or aggressive aging timeouts. 

Some of them are easy to determine. Couple minutes after an accept, you get an ACK dropped out of state, probably the start timeout. Couple hours after an accept, you get out of state drops on the same port combinations, probably a session. 

But the forty minute after accept drops for the same port combination are the ones that are stumping me.  Within the session timeouts, way too far out to be a start timeout (unless something is REALLY wrong with our wireless network) but within the range of the Aggressive Aging settings.

Our connection limit is set to Automatic and the firewall itself doesn't seem to be under too much load. 

[Kaspars_Zibarts · Accepted solution]

Just search in smartlog, see attached screenshot

[Jason_Carrillo]

Perfect! Thank you. No sign of those logs in my walls, so AA doesn't appear to be the culprit.

[Sascha_Bremshey · Accepted solution]

In case you don't want to download and open the screenshot:

Search term "aggressive_aging_general" is used.

[KostasGR]

Hello 

By default when the connection table reaches 80% of its capacity the anti-Dos mechanism agressive aging takes place.

Has anyone configured a snmp trap mechanism in order to get  a notification if capacity of connection table reaches 70% for example?

BR,

Kostas

[pjoseph]

Yes - we have set it to 45% to ensure we're capable of full site failover.