reaching Session Count Limit

[porq91]

Hello,

what exactly happens when the firewall reaches the Session Count Limit? Discard the new sessions? and above all as regards the globalprotect VPNs are impacted?
In my scenario I have two 5250 PAs working in HA Active / Passive and corporate VPNs go through globalprotect, I was wondering what happens if the FW reaches the session limit.

Thanks in advance.

[aleksandar.astardzhiev · Accepted solution]

Hi @porq91 ,

I haven't managed to fill up the whole session table for any of my devices, so I am not 100%, but I believe you are correct - if the table is completely full firewall will probably start discarding new sessions with reason "resource-unavailable".

However before this happen, the "Accelerated Aging" feature should kick in. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cly9CAC 

Basically if the session table utilization is above certain threshold, firewall will start aging out old session faster in attempt to free some space in the table.

Some interesting KBs about sessions and session timers.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVECA0

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRiCAK