When this limitation is reached, the block page shows 'The maximum web proxy user limit has been reached'.
By design, FortiOS limits the number of explicit proxy users. This includes both explicit FTP proxy and explicit web proxy users. The number of users varies by FortiGate model. For more information, see the Maximum Values Table.
The current usage can be seen in the GUI under System -> Global Resouces -> User & Device -> Concurrent Explicit Proxy Users.
In the CLI, usage can be determined with the following commands:
diagnose wad license detail
diagnose wad session count
diagnose wad user list
diagnose test application wad 2200
diagnose test app wad 157
diagnose test application wad 110
The command 'diagnose test application wad 2200' selects the first wad worker. A detailed description of the WAD selection and troubleshooting process is featured in Technical Tip: Overview of WAD process structure.
Example output with WAD worker index 0 on 'a':
FGT # diagnose test application wad 2200
Set diagnosis process: type=worker index=0 pid=433
Proxy-MI-01 # diagnose test application wad 110
users:
...
...
...
blackout users:
global concurrent user limit: 65536
Total allocated user:2364 stale_count:0, in_list=2364
Total shared user count:25662, shared user quota:32000, form_auth_keepalive=0,active=2364
Timeout: keep-alive-mode=0(600 sec), lifetime=disable(0 min)
Total allocated user refers to the amount of users from worker index 0. Shared user quota is the platforms limit. (Here, it is FG-1100.) Total shared user count refers to all unique users. If this value reaches the device's limit, the error message 'The Maximum web proxy user limit has been reached' will appear.
When wad-source-affinity is enabled, the WAD traffic dispatcher allows incoming traffic to be directly distributed among the WAD workers. Due to this, each WAD worker receives connection from the same source IP and this counts as a user in worker memory. This may lead to a situation where the maximum of web proxy users is reached even though the total amount of actual users is much smaller.
config system global
set wad-source-affinity enable
end
The way to resolve this is to set this setting to 'disable'.
| 
