Description

UTM web-filtering engine will hit a capacity limit in terms of sessions that it can scan, if the number of sessions processed reaches the "Web-filtering sessions in total" value. 

Symptoms

Web-filtering statistics output will indicate an increase in the value of "Too-many-requests" : 

Example:

UTM web-filtering statistics:
Total requests: 629306
White list hit: 0
Black list hit: 0
 Default action hit: 629306
 Custom category permit: 0
 Custom category block: 0
 Custom category quarantine: 0
 Custom category qurantine block: 0
 Custom category quarantine permit: 0
 Safe-search redirect: 68
 Safe-search rewrite: 0
 Web-filtering sessions in total: 8192000
 Web-filtering sessions in use: 8167771
 sessions matched with dynapp policy: 0
 sessions matched with default policy: 0
 sessions matched with final policy: 1018541
    Fallback:            log-and-permit          block
    Default                       0                       426365
    Timeout                      0                            0
    Connectivity               0                            0
    Too-many-requests 0                    75889366
 
 
 

Solution

In the case of the SRX5K devices using SPC3 cards, we can see that the number of web-filtering sessions in total is dependent of the inserted SPC3 cards.

Please scale your capacity depending on the expected number of sessions that should be processed by the UTM engine.

 

1xSPC3 card:

labroot@SRX> show chassis fpc pic-status 
Slot 1   Online       SPC3                                          
  PIC 0  Online       SPU Cp-Flow
  PIC 1  Online       SPU Flow
 
labroot@SRX> show security utm web-filtering statistics 
UTM web-filtering statistics: 
    Web-filtering sessions in total:      4096000
 
 
2xSPC3 card:
labroot@SRX> show chassis fpc pic-status 
FPC 5           SPC3
  PIC 0        SPU Cp-Flow
  PIC 1         SPU Flow
FPC 6            SPC3
  PIC 0            SPU Flow
  PIC 1            SPU Flow
 
labroot@SRX> show security utm web-filtering statistics
    Web-filtering sessions in total:      8192000
 
 
After this limit is hit, on further sessions, Webfilter takes a fallback action, which can be configured to either 'drop' or 'allow and log'.

Modification History

23 June 2026: created