Panorama sessions in ACC view show much higher session counts than the session count on the firewall

[timspenc]

Hi all, a bit of a mystery one here. can anyone explain this?

For example, "show session info" on the firewall cli and Dashboard GUI currently shows about 

but in Panorama under ACC

We're showing more like 500,000 connections!?!?!?

Can anyone explain this?

Thanks in advance

[PavelK]

Hello @timspenc

thanks for posting!

Have you used Device Name filter under ACC to limit the logs only to a single Firewall?

Also, could you check the session count from Health under: Panorama > Managed Devices > Health > [Select Firewall] > Sessions > Session Count. This will give you more accurate information about number of sessions over time depending on Time Filter defined under Actions.

Kind Regards

Pavel

[timspenc]

Thankyou for your response @PavelK 

I've looked at your suggestions to see if they help.

I thought you might be right about listing just the one firewall in Panorama however it didn't help.

Even if I log on to the Active firewall and check ACC there we see lots of sessions as below.

and yet when I check the health status over the same 12 hour timeframe, we see the real amounts

I didn't know about those graphs under health before so it was good to learn of those. Thank you.

I just wish I could understand why the ACC tabs in both the firewall and Panorama do not correlate with what the firewalls are actually doing??

Do other peoples graphs show the correct info for sessions??