Description

It was noticed that while a Security Scan, the SRX Firewall lost connectivity

Symptoms

The SRX Firewall lost connectivity or it stop moving traffic. It was noticed that during the event, a Security Scan was happening.

Solution

This situation is most likely due to High CPU Usage. After analysis, it was noticed the firewall is using LACP with "periodic fast" option. This setting causes the transmission of LACP packets every second which may cause the CPU to increase depending on the load. 

 

periodic

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/periodic-edit-interfaces.html 

 

The recommendation is changing the LACP option to "periodic slow", that way the device will transmit LACP packets every 30 seconds causing the CPU Usage to be more stable. 

 

The connectivity loss caused by the High CPU Usage becasue of the Security Scan is not limited just to the LACP setting so, there could be any service or protocol involved.

Modification History

2024-07-22 : Article Created