Description

On SRX platforms, high global data SHM usage seen in some Junos versions lead to certain security features to not work as expected.

Symptoms

In some Junos versions, the services (eg. IDP or APPID) use different PFE global data SHM memory size. For example, in Junos 19.4, when using IDP, high global data SHM usage might be seen as below: 

> request pfe execute command "show arena" target fwdd | match data | refresh 2                         
---(refreshed at 2022-01-01 12:16:27 JST)---
 2    6c9f4dc0     177209340      32900896     144308444   81  global data SHM
---(refreshed at 2022-01-01 12:16:36 JST)---
 2    6c9f4dc0     177209340      34148336     143061004   80  global data SHM
---(refreshed at 2022-01-01 12:16:45 JST)---
 2    6c9f4dc0     177209340      31399688     145809652   82  global data SHM  <<<

> request pfe execute command "show services mum" target fwdd   
================ cluster1.node0 ================
SENT: Ukern command: show services mum

Memory usage manager:  gsm
Total free space to start with: 177181504
Active customers: 1
Max customers: 12
Yellow zone limit: 44295376
Orange zone limit: 31892670 <<<
Red zone limit: 15946335
Mum flags: 0
Operational zone:      Orange  <<< When free memory is lower than Orange zone limit value

When SRX is working under Orange zone, some security features might not work as expected.

Solution

Services use different memory size in different Junos versions which might cause high global data SHM resource. This is one limitation. Once SRX is working under Orange zone, some security features might not work as expected, which is also per security feature design.

To avoid entering Orange zone, upgrade Junos to release 20.x since the memory assignment is optimized. Refer to PR1620888 - Traffic may get dropped due to memory issue on some SRX devices. The issue is resolved in the following Junos releases:

  • 20.4R3-S2, 
  • 21.1R3,
  • 21.2R2-S1,
  • 21.2R3,
  • 21.3R1-S2,
  • 21.3R2,
  • 21.4R1,
  • 22.1R1 and later releases

After upgrading to Junos 20.4R3-S2.6, the total free space increases to a much higher level. However, the Orange zone limit value does not change too much, which can help SRX avoid to enter Orange zone.
  

> request pfe execute command "show services mum" target fwdd                        
================ cluster1.node0 ================
SENT: Ukern command: show services mum

Memory usage manager:  gsm
Total free space to start with: 282037784  <<<
Active customers: 1
Max customers: 12
Yellow zone limit: 53375554
Orange zone limit: 38430398   <<<
Red zone limit: 19215199
Mum flags: 0
Operational zone:      Green   <<<

Modification History