PA-3320 Session's Setup Alerts for session limits reached

PAlmart — Thu, 07 Jan 2021 20:41:26 GMT

Today we had a networking issue that was random and hard to track down. Turns out to be DDOS attack to our Citrix. Since the Dashboard on the GUI doesn't show the BIG RED OMG Light when your maxed we missed it for sometime.

does anyone know how to setup Email alerts for sessions over a certain load. 20%.. 30%... 40%... AND 99%

Re: PA-3320 Session's Setup Alerts for session limits reached

reaper — Fri, 08 Jan 2021 00:14:44 GMT

I don't believe there is an explicit alert for session table utilization

accelerated ageing kicks in at 80% by default (device > setup > session > session setting) which may create a log entry in the system log

It is highly advisable to set up zone protection profiles (using SYN cookies) and enabling packet buffer protection on your zones

packet buffer protection will start to alert at 50% usage (of the packet buffer)

you could additionally set up a DoS protection rule that limits the total number of allowed concurrent sessions towards your citrix farm, to prevent a DDoS attack from flooding your entire firewall

topic PA-3320 Session's Setup Alerts for session limits reached in General Topics

PA-3320 Session's Setup Alerts for session limits reached

Re: PA-3320 Session's Setup Alerts for session limits reached