topic Re: ssl decryption enabled and proxy_wait_pkt_drop in General Topics

ssl decryption enabled and proxy_wait_pkt_drop

MP18 — Sun, 14 Oct 2018 06:47:30 GMT

ssl decryption is enabled on PA.

sh running resource monitor is also normal.

when i run below command i see

show counter global filter delta yes category proxy

Global counters:
Elapsed time since last sampling: 124.323 seconds

name value rate severity category aspect description
--------------------------------------------------------------------------------
proxy_process 104 0 info proxy pktproc Number of flows go through proxy
proxy_wait_pkt_drop 24 0 drop proxy pktproc The number of packets get dropped because of waiting status in ssl proxy
proxy_sessions 33 0 info proxy pktproc Current number of proxy sessions
proxy_sessions_forward 33 0 info proxy pktproc Current number of SSL-Forward decrypted sessions
proxy_broker_policy_skip 69 0 info proxy pktproc Sessions not processed by forwarding profile by policy
--------------------------------------------------------------------------------
Total counters shown: 5
--------------------------------------------------------------------------------

I read if proxy wait pkt drop counter is incrementing then it is resouce issue on the PA?

so which counter i should worry about ?

value or rate?

Re: ssl decryption enabled and proxy_wait_pkt_drop

BPry — Mon, 15 Oct 2018 16:05:28 GMT

@MP18,

What platform are you running; you may be running into platform limitations on the number of sessions you can actively decrypt at any one given time.

Re: ssl decryption enabled and proxy_wait_pkt_drop

MP18 — Mon, 15 Oct 2018 17:26:02 GMT

i have PA 220 running 8.1.3.

Re: ssl decryption enabled and proxy_wait_pkt_drop

BPry — Mon, 15 Oct 2018 21:16:38 GMT

@MP18,

On a 220 it's quite possible that you are running into some sort of resource contention depending on how much traffic you are actively attempting to decrypt. When working on a 220 you'll be looking at the following limitations.

SSL Decryption
Max SSL inbound certificates	25
SSL certificate cache (forward proxy)	128
Max concurrent decryption sessions	6,400

Re: ssl decryption enabled and proxy_wait_pkt_drop

MP18 — Mon, 15 Oct 2018 22:28:36 GMT

Many thanks for answering question.