Connection peak exceeded on vsx

[starmen2000]

Hi mates

I'm getting a 'Vsx firewall peak connection exceeded' warning. It has given me this warning twice in two days. The limit is set to 24,000. How can we increase this limit on VSX?

Thanks 

[Alex-]

You can modify the maximum number of connections in a VS by editing the VS, selecting Optimizations and entering the desired number.

Press OK, then install the policy.

[the_rock]

Below is what @Alex- is referring to. I would strongly suggest you choose automatic option, as gateway itself calculates the amount handles based on cpu/memory.

Andy

 

[Alex-]

On VSX, this option is grayed out and you need a manual entry, So if 24K peaks every now and then you could go to 30 or 40K and monitor with either HCP or vsx stat -l.

[the_rock]

Ah yes, right, I totally forgot about that : - (. I recall back in R77.30, was the same way, pretty sure.

Andy

[Bob_Zimmerman · Accepted solution]

I would bump it to 250k or more. The point of the hard connections table limit is to protect other VSs on the system from resource exhaustion attacks against one VS. That is, if someone tries to fill up the connections table of your Internet VS, they won't also take down your interior VSs or the VS handling a second Internet connection. Ever since R67 (the first version to move to the 2.6 kernel), the connections table has been able to use many gigabytes of space, so the practical limit for the whole box is generally in the tens of millions of connections.

Unless you're running a hundred VSs on a box, or you're running with very little RAM, tiny tables don't protect you from anything. Instead, they just shoot you in the foot like this over and over as load increases.

[genisis__]

The easiest way to monitor is via SNMP.

I've setup a table which combines Connection Limit, Current connections & Peak Connections.  In this way you can monitor over time.