Should the value in the ‘Conns’ column of a SecureXL template be counted as a concurrent connection or an indicator how many connections used the particular template?
For example; for a particular vs I have approx. 50.000 connections in the fw1 & SecureXL connections table (asg_conns). However according ‘asg perf’ output there are over 6.000.000 concurrent connections for that specific vs. This is caused by one particular connection which is accelerated and templated and has the value of 6.000.000 in the ‘Conns’ column. Each time the firewall policy is installed or SecureXL is enabled/disabled the template is cleared and after a week or so the concurrent connections is back around 6 million and increasing. As result SNMP and ‘asg alert’ send email alerts due to the high amount of concurrent of connections which causes noise for the firewall administrator since there is no high load. As workaround the firewall administrator pushes the firewall policy every few days to clear the templates.
Is this behavior expected or something cosmetic? According TAC (last year), it works as designed.
As a solution we can assign a inspect handler (i.e. SIP) to the service so that each connection is forced to F2F, but again this should not the be to way to solve this issue.
Anyone else experience this behavior?