Fortigate 300D. High session count

[Willem_Bargeman]

We have upgraded our Fortigate 300D cluster to firmware 5.2.2 from 5.2.1 because of a issue in this firmware. After upgrading we are experience high session load. 1 or 2 times a week. The session count will be rise to 3.000.000 sessions!. We have tried to clear all session but without any result. A full dump of the session table will show not more than 20.000 sessions. After restart one of the units everything is stable for a few day.

We have a case at support but this no solution.

Anyone that experience the same behavior? 

[emnoc]

Where are you seeing the  high session counts? ( logs  or gui widget ) 

Have you graph this with snmp and maybe cacti ? to confirm?

If you run the diag sys  session stat   what's the output? ( look at established and setup  fields )

What fwpolicy(s) do you have at the time and what has the highest counts?

[Willem_Bargeman]

Hi,

We see the high session count in the gui widget and also trough SNMP.

The session stats our showing a high session count that are in time_wait.

231623 in TIME_WAIT state

When we are clearing all session the session in time_wait are not cleared.

The policies with the most packages are the user browser policies. AV, web filter application filter and IPS are active.

[emnoc]

Will you have to do some work than to figure out what's causing the time_Wait

1: is it a attack

2: ungraceful client side closing

Yuo can get more details if you set filters and display these

e.g using the range 4 thru 9 but you can slect what's best for you ( proto-state )

FGT90DFW1 # diag sys session filter proto-state   <x>      <0-9> (from) ANY         0 ESTABLISHED 1 SYN_SENT    2 SYN_RECV    3 FIN_WAIT    4 TIME_WAIT   5 CLOSE       6 CLOSE_WAIT  7 LAST_ACK    8 LISTEN      9

diag sys session filter proto-state 4 7

diag sys session list

Than you track down possible three things;

1: the server(s)

2: and possible client(s)

3: policy-id (s)

[Willem_Bargeman]

Thanks for your information. I will try this next time. I keep you posted.

[van_k_jones]

Our Fortigate reports are showing really high session counts since upgrading to 5.2.2; 2.1 million during peak times; 1.3 million average per hour.  At peak, every one of our 5000 students would have to have 420 sessions open through the firewall and that seems highly unlikely.  We have opened a ticket with Fortinet.  Has support responded to your ticket yet?

Willem Bargeman wrote:

We have upgraded our Fortigate 300D cluster to firmware 5.2.2 from 5.2.1 because of a issue in this firmware. After upgrading we are experience high session load. 1 or 2 times a week. The session count will be rise to 3.000.000 sessions!. We have tried to clear all session but without any result. A full dump of the session table will show not more than 20.000 sessions. After restart one of the units everything is stable for a few day.

We have a case at support but this no solution.

Anyone that experience the same behavior? 

[Willem_Bargeman]

Hi,

Our issue was hardware related. We are running fine at our secondary unit. Support will replace the first one.

Any idea what kind of sessions are open? What is the status of the sessions? Could you post the result of the following command?

diagnose sys session stat

[graves]

I work with Van. Here's our diag sys session stat:

misc info: session_count=39711 setup_rate=511 exp_count=16 clash=245 memory_tension_drop=0 ephemeral=0/589824 removeable=0 delete=0, flush=0, dev_down=0/0 TCP sessions: 10 in NONE state 12151 in ESTABLISHED state 141 in SYN_SENT state 19 in SYN_RECV state 190 in FIN_WAIT state 345 in TIME_WAIT state 283 in CLOSE state 321 in CLOSE_WAIT state firewall error stat: error1=00000000 error2=00000000 error3=00000000 error4=00000000 tt=00000000 cont=000058b2 ids_recv=f0fe0aa5 url_recv=00000000 av_recv=003d33a6 fqdn_count=00000002 tcp reset stat: syncqf=1739 acceptqf=0 no-listener=1567 data=0 ses=24 ips=0 global: ses_limit=0 ses6_limit=0 rt_limit=0 rt6_limit=0