How to drop new SSL sessions when limit is reached in 6.1.X?

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L3 Networker

How to drop new SSL sessions when limit is reached in 6.1.X?

We'd like to drop any new SSL sessions if the system has reached the SSL Decrypted Session Limit.

This page, How to Implement and Test SSL Decryption, says to run:

> set deviceconfig setting ssl-decrypt deny-setup-failure yes

but it doesn't seem to be there in version 6.1.4

In the Web UI, there is an option under when creating a Decryption Profile, to "Block sessions if resources not available".

Is that the same thing?

Thanks,

Eugene

Highlighted
L5 Sessionator

The option that you are referring  means "Terminate sessions if system resources are not available to process decryption" so the sessions will be dropped if the resources are not available.

Please rate the helpful answer.

Highlighted
L3 Networker

Yes, I've read the help documentation.

Does that include the fact that there are no sessions available? Is a session in this context, considered a resource?

Highlighted
L7 Applicator

If you're out of sessions because your session table is full (show session info), a new session won't be installed whether or not it's SSL. A session is created on the first packet, and for SSL that typically means a TCP SYN packet on destination port 443.

If there is no available session, you won't get to the point where a decision can be made based on other factors.

So to answer your question, the "Block sessions if resources not available" means that the session has already been installed and there are no resources to actually handle the decryption.

Best regards,

Greg

Highlighted
L7 Applicator

There is difference in size of session table and max decrypted sessions.

For example max ssl sessions for 3050 and 3020 are following:

Max concurrent decryption sessions

3050 - 15,360

3020 - 7,936

Product Comparison

So your session table does not have to be full but ssl decryption resources can be fully allocated.

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!