Why connections count of ASA is much more than PA's ?

[neilwu]

Hi,

I use V-Wire between ASA and core switch.

I found the connections count of ASA is much more than PA's.

Does anyone know how to explain about this ?

Thanks.

 

[OtakarKlier]

Someone can correct me if I remember this incorrectly, however the way the two devices report are different. I beleive the way the ASA reports is by rule hits while the PAN uses Sessions. So the ASA may have more than the PAN. I recall this when purchasing the current PAN's and trying to size them appropriatly.

[cpainchaud]

funny, i usually experience the contrary

[reaper · Accepted solution]

The asa may be counting the 'connections per second' while the PAN will show you 'number of concurrently active sessions'

for more details you can run '> show session info' from the CLI which may show you the packetrate may be closer to the details of the ASA:

> show session info
--------------------------------------------------------------------------------
Number of sessions supported:                    65534
Number of active sessions:                       20
Number of active TCP sessions:                   13
Number of active UDP sessions:                   7
Number of active ICMP sessions:                  0
Number of active BCAST sessions:                 0
Number of active MCAST sessions:                 0
Number of active predict sessions:               0
Session table utilization:                       0%
Number of sessions created since bootup:         1664505
Packet rate:                                     8/s
Throughput:                                      4 kbps
New connection establish rate:                   0 cps
--------------------------------------------------------------------------------