reaching Session Count Limit

porq91 — Sat, 25 Jun 2022 07:40:29 GMT

Hello,

what exactly happens when the firewall reaches the Session Count Limit? Discard the new sessions? and above all as regards the globalprotect VPNs are impacted?
In my scenario I have two 5250 PAs working in HA Active / Passive and corporate VPNs go through globalprotect, I was wondering what happens if the FW reaches the session limit.

Thanks in advance.

Re: reaching Session Count Limit

aleksandar.astardzhiev — Sat, 25 Jun 2022 20:18:20 GMT

Hi @porq91 ,

I haven't managed to fill up the whole session table for any of my devices, so I am not 100%, but I believe you are correct - if the table is completely full firewall will probably start discarding new sessions with reason "resource-unavailable".

However before this happen, the "Accelerated Aging" feature should kick in. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cly9CAC

Basically if the session table utilization is above certain threshold, firewall will start aging out old session faster in attempt to free some space in the table.

Some interesting KBs about sessions and session timers.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVECA0

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRiCAK

topic reaching Session Count Limit in General Topics

reaching Session Count Limit

Re: reaching Session Count Limit