How to drop new SSL sessions when limit is reached in 6.1.X?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

How to drop new SSL sessions when limit is reached in 6.1.X?

L3 Networker

We'd like to drop any new SSL sessions if the system has reached the SSL Decrypted Session Limit.

This page, How to Implement and Test SSL Decryption, says to run:

> set deviceconfig setting ssl-decrypt deny-setup-failure yes

but it doesn't seem to be there in version 6.1.4

In the Web UI, there is an option under when creating a Decryption Profile, to "Block sessions if resources not available".

Is that the same thing?

Thanks,

Eugene

4 REPLIES 4

L5 Sessionator

The option that you are referring  means "Terminate sessions if system resources are not available to process decryption" so the sessions will be dropped if the resources are not available.

Please rate the helpful answer.

Yes, I've read the help documentation.

Does that include the fact that there are no sessions available? Is a session in this context, considered a resource?

If you're out of sessions because your session table is full (show session info), a new session won't be installed whether or not it's SSL. A session is created on the first packet, and for SSL that typically means a TCP SYN packet on destination port 443.

If there is no available session, you won't get to the point where a decision can be made based on other factors.

So to answer your question, the "Block sessions if resources not available" means that the session has already been installed and there are no resources to actually handle the decryption.

Best regards,

Greg

Cyber Elite
Cyber Elite

There is difference in size of session table and max decrypted sessions.

For example max ssl sessions for 3050 and 3020 are following:

Max concurrent decryption sessions

3050 - 15,360

3020 - 7,936

Product Comparison

So your session table does not have to be full but ssl decryption resources can be fully allocated.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011
  • 2689 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!