We'd like to drop any new SSL sessions if the system has reached the SSL Decrypted Session Limit.
This page, How to Implement and Test SSL Decryption, says to run:
> set deviceconfig setting ssl-decrypt deny-setup-failure yes
but it doesn't seem to be there in version 6.1.4
In the Web UI, there is an option under when creating a Decryption Profile, to "Block sessions if resources not available".
Is that the same thing?
The option that you are referring means "Terminate sessions if system resources are not available to process decryption" so the sessions will be dropped if the resources are not available.
Please rate the helpful answer.
If you're out of sessions because your session table is full (show session info), a new session won't be installed whether or not it's SSL. A session is created on the first packet, and for SSL that typically means a TCP SYN packet on destination port 443.
If there is no available session, you won't get to the point where a decision can be made based on other factors.
So to answer your question, the "Block sessions if resources not available" means that the session has already been installed and there are no resources to actually handle the decryption.
There is difference in size of session table and max decrypted sessions.
For example max ssl sessions for 3050 and 3020 are following:
Max concurrent decryption sessions
3050 - 15,360
3020 - 7,936
So your session table does not have to be full but ssl decryption resources can be fully allocated.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!