Description

UTM web-filtering engine will hit a capacity limit in terms of sessions that it can scan, if the number of sessions processed reaches the "Web-filtering sessions in total" value. 

Symptoms

Web-filtering statistics output will indicate an increase in the value of "Too-many-requests" : 

Example:

UTM web-filtering statistics:
Total requests: 629306
White list hit: 0
Black list hit: 0
 Default action hit: 629306
 Custom category permit: 0
 Custom category block: 0
 Custom category quarantine: 0
 Custom category qurantine block: 0
 Custom category quarantine permit: 0
 Safe-search redirect: 68
 Safe-search rewrite: 0
 Web-filtering sessions in total: 8192000
 Web-filtering sessions in use: 8167771
 sessions matched with dynapp policy: 0
 sessions matched with default policy: 0
 sessions matched with final policy: 1018541
    Fallback:            log-and-permit          block
    Default                       0                       426365
    Timeout                      0                            0
    Connectivity               0                            0
    Too-many-requests 0                    75889366
 
 
 

Solution

In the case of the SRX5K devices using SPC3 cards, we can see that the number of web-filtering sessions in total is dependent of the inserted SPC3 cards.

Please scale your capacity depending on the expected number of sessions that should be processed by the UTM engine.

 

1xSPC3 card:

labroot@SRX> show chassis fpc pic-status 
Slot 1   Online       SPC3                                          
  PIC 0  Online       SPU Cp-Flow
  PIC 1  Online       SPU Flow
 
labroot@SRX> show security utm web-filtering statistics 
UTM web-filtering statistics: 
    Web-filtering sessions in total:      4096000
 
 
2xSPC3 card:
labroot@SRX> show chassis fpc pic-status 
FPC 5           SPC3
  PIC 0        SPU Cp-Flow
  PIC 1         SPU Flow
FPC 6            SPC3
  PIC 0            SPU Flow
  PIC 1            SPU Flow
 
labroot@SRX> show security utm web-filtering statistics
    Web-filtering sessions in total:      8192000
 

3xSPC3 card:
labroot@SRX> show chassis fpc pic-status 
Slot 0   Online       SPC3                                          
  PIC 0  Online       SPU Cp
  PIC 1  Online       SPU Flow
Slot 2   Online       SPC3                                          
  PIC 0  Online       SPU Flow
  PIC 1  Online       SPU Flow
Slot 3   Online       SPC3                                          
  PIC 0  Online       SPU Flow
  PIC 1  Online       SPU Flow

labroot@SRX> show security utm web-filtering statistics 
 UTM web-filtering statistics: 
    Web-filtering sessions in total:      10240000
    
4xSPC3 card:
labroot@SRX> show chassis fpc pic-status 
Slot 0   Online       SPC3                                          
  PIC 0  Online       SPU Cp
  PIC 1  Online       SPU Flow
Slot 1   Online       SPC3                                          
  PIC 0  Online       SPU Flow
  PIC 1  Online       SPU Flow
Slot 2   Online       SPC3                                          
  PIC 0  Online       SPU Flow
  PIC 1  Online       SPU Flow
Slot 3   Online       SPC3                                          
  PIC 0  Online       SPU Flow
  PIC 1  Online       SPU Flow

labroot@SRX> show security utm web-filtering statistics 
 UTM web-filtering statistics: 
    Web-filtering sessions in total:      14336000

 

Total SPC3 CardsActive Flow SPUsCP SPU RoleCP SPU CapacityFlow SPU Capacity (Per Unit)Total UTM Web-Filtering Sessions
1x SPC31Cp-Flow2,048,0002,048,0004,096,000
2x SPC33Cp-Flow2,048,0002,048,0008,192,000
3x SPC35Cp02,048,00010,240,000
4x SPC37Cp02,048,00014,336,000

 

 
After this limit is hit, in further sessions, Webfilter takes a fallback action, which can be configured to either 'drop' or 'allow and log'.

Modification History

23 June 2026: created