How to drop new SSL sessions when limit is reached in 6.1.X?

[eugenep]

We'd like to drop any new SSL sessions if the system has reached the SSL Decrypted Session Limit.

This page, How to Implement and Test SSL Decryption, says to run:

> set deviceconfig setting ssl-decrypt deny-setup-failure yes

but it doesn't seem to be there in version 6.1.4

In the Web UI, there is an option under when creating a Decryption Profile, to "Block sessions if resources not available".

Is that the same thing?

Thanks,

Eugene

[pankaku]

The option that you are referring  means "Terminate sessions if system resources are not available to process decryption" so the sessions will be dropped if the resources are not available.

Please rate the helpful answer.

[eugenep]

Yes, I've read the help documentation.

Does that include the fact that there are no sessions available? Is a session in this context, considered a resource?

[gwesson]

If you're out of sessions because your session table is full (show session info), a new session won't be installed whether or not it's SSL. A session is created on the first packet, and for SSL that typically means a TCP SYN packet on destination port 443.

If there is no available session, you won't get to the point where a decision can be made based on other factors.

So to answer your question, the "Block sessions if resources not available" means that the session has already been installed and there are no resources to actually handle the decryption.

Best regards,

Greg

[Raido_Rattameister]

There is difference in size of session table and max decrypted sessions.

For example max ssl sessions for 3050 and 3020 are following:

Max concurrent decryption sessions

3050 - 15,360

3020 - 7,936

Product Comparison

So your session table does not have to be full but ssl decryption resources can be fully allocated.