topic Re: How to drop new SSL sessions when limit is reached in 6.1.X? in General Topics

How to drop new SSL sessions when limit is reached in 6.1.X?

eugenep — Wed, 24 Jun 2015 01:06:20 GMT

We'd like to drop any new SSL sessions if the system has reached the SSL Decrypted Session Limit.

This page, How to Implement and Test SSL Decryption, says to run:

> set deviceconfig setting ssl-decrypt deny-setup-failure yes

but it doesn't seem to be there in version 6.1.4

In the Web UI, there is an option under when creating a Decryption Profile, to "Block sessions if resources not available".

Is that the same thing?

Thanks,

Eugene

Re: How to drop new SSL sessions when limit is reached in 6.1.X?

pankaku — Wed, 24 Jun 2015 01:16:37 GMT

The option that you are referring means "Terminate sessions if system resources are not available to process decryption" so the sessions will be dropped if the resources are not available.

Please rate the helpful answer.

Re: How to drop new SSL sessions when limit is reached in 6.1.X?

eugenep — Wed, 24 Jun 2015 01:24:05 GMT

Yes, I've read the help documentation.

Does that include the fact that there are no sessions available? Is a session in this context, considered a resource?

Re: How to drop new SSL sessions when limit is reached in 6.1.X?

gwesson — Wed, 24 Jun 2015 16:46:15 GMT

If you're out of sessions because your session table is full (show session info), a new session won't be installed whether or not it's SSL. A session is created on the first packet, and for SSL that typically means a TCP SYN packet on destination port 443.

If there is no available session, you won't get to the point where a decision can be made based on other factors.

So to answer your question, the "Block sessions if resources not available" means that the session has already been installed and there are no resources to actually handle the decryption.

Best regards,

Greg

Re: How to drop new SSL sessions when limit is reached in 6.1.X?

Raido_Rattameister — Thu, 25 Jun 2015 06:44:23 GMT

There is difference in size of session table and max decrypted sessions.

For example max ssl sessions for 3050 and 3020 are following:

Max concurrent decryption sessions

3050 - 15,360

3020 - 7,936

Product Comparison

So your session table does not have to be full but ssl decryption resources can be fully allocated.