Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

High current conns in service policy.

Hi,

We have the following policy on a firewall to limit the maximum number of connections:

policy-map global_policy

class HTTP

  set connection conn-max 2250 embryonic-conn-max 100 per-client-max 20 per-client-embryonic-max 5

  set connection timeout half-closed 0:05:00 idle 0:05:00

If we look in the logs we see that connections are being dropped because of this:

Feb 05 2014 12:33:12: %ASA-3-201011: Connection limit exceeded 2250/2250 for input packet from x.x.x.x/63257 to x.x.x.x/80 on interface outside

Feb 05 2014 12:33:12: %ASA-3-201011: Connection limit exceeded 2250/2250 for input packet from x.x.x.x/53429 to x.x.x.x/80 on interface outside

Feb 05 2014 12:33:12: %ASA-3-201011: Connection limit exceeded 2250/2250 for input packet fromx.x.x.x/48613 to x.x.x.x/80 on interface outside

And these show true if we look at the service policy

XXXX# show service-policy global

Global policy:

  Service-policy: global_policy

    Class-map: HTTP

      Set connection policy: conn-max 2250 embryonic-conn-max 100 per-client-max 20 per-client-embryonic-max 5

        current embryonic conns 2, current conns 2250, drop 15870337

      Set connection timeout policy:

        half-closed 0:05:00 idle 0:05:00

        DCD: disabled, retry-interval 0:00:15, max-retries 5

        DCD: client-probe 0, server-probe 0, conn-expiration 0

However the connections on the firewall and servers aren’t high

xxxxx# show conn count

529 in use, 2485 most used

Can anyone explain why this is, not sure if it is bug or is normal expected behavour. Is this "current conns" figure meant to corresond to the firewall conns, or is taking from something else? I guess they only way to remove this is to remove and re-add the policy, just wanted to get peoples thoughts on it or see if I was missing something.

This is on an ASA5510 running Software Version 8.2(5)41

Thanks

127
Views
0
Helpful
0
Replies
CreatePlease login to create content