Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Embryonic Sessions Limit

Hello,

I am trying to get an idea of a recommended value for the embryonic sessions limit (tcp intercept) number for the nat and static statements on the FWSM. Any number between 0-65535 can be set, with the limit defaulting to 0 (unlimited embryonic sessions). In my mind, any number over 100 is excessive. Two hosts should be able to establish the three-way-handshake in a stable environment with well under 100 different attempts to send a packet with the SYN flag set in the TCP header. Has anyone else had experience with a 'good, safe' number to set the embryonic sessions limit? What impact is there, if any, to the FWSM memory consumption while acting as a connection proxy between two hosts?

Thanks for your time.

-m2

2 REPLIES

Re: Embryonic Sessions Limit

It really depends on the server, but usually I find 100 is enough. The only exceptions I've found are proxy servers etc where the firewall separates them from clients, where, 500 does the job.

I suggest setting it high (500), using "show local" to gauge a normal number of connections, and then set it to, say 10percent of that. If you get it wrong the log will tell you.

New Member

Re: Embryonic Sessions Limit

Grant,

Thanks for your reply and suggestions.

-m2

285
Views
5
Helpful
2
Replies