[SRX] The PFE CPU is high due to high invalid session rate.

Description

The PFE CPU is high due to high invalid session rate.

Symptoms

Burst traffic and high session rate are common causes of high PFE CPU.

From the information captured at high PFE CPU, the session rate is high.

root@srx> show security monitoring performance session

fpc 0 pic 0

Last 60 seconds:

0: 95594 1: 98854 2: 79028 3: 103643 4: 72427 5: 44406 <<<<

6: 11654 7: 3671 8: 4629 9: 3488 10: 4414 11: 3278

12: 4247 13: 3113 14: 4052 15: 2790 16: 3619 17: 4563

18: 3411 19: 4363 20: 3222 21: 4168 22: 3021 23: 3972

24: 2833 25: 3792 26: 2651 27: 3578 28: 4536 29: 3402

30: 4363 31: 3221 32: 4171 33: 3023 34: 3986 35: 2839

36: 3790 37: 2639 38: 3593 39: 4546 40: 3405 41: 4344

42: 3211 43: 4158 44: 3028 45: 3964 46: 2827 47: 3783

48: 2547 49: 3492 50: 4439 51: 3300 52: 4261 53: 3124

54: 4087 55: 2933 56: 3875 57: 2735 58: 3696 59: 2560

Checking the session summary found a large number of invalid sessions.

root@srx> show security flow session summary

Unicast-sessions: 20119

Multicast-sessions: 0

Services-offload-sessions: 0

Failed-sessions: 0

Sessions-in-use: 109304

Valid sessions: 19560

Pending sessions: 2

Invalidated sessions: 89742 <<<<

Sessions in other states: 0

Maximum-sessions: 384000

Check invalid flow session to confirm invalid session information and then decide what to do next.

For example, in this case, the invalid session information is found to be tcp attack traffic.

#show usp flow session invalid

(in)* : 100.100.100.100/38894 -> 10.1.1.1/26844;6, If: 73 (8), flag: 0041, wsf: 0, diff: 0

(in)* : 100.100.100.100/43343 -> 10.1.1.1/56265;6, If: 73 (8), flag: 0041, wsf: 0, diff: 0

(in)* : 100.100.100.100/39119 -> 10.1.1.1/1004;6, If: 73 (8), flag: 0041, wsf: 0, diff: 0

(in)* : 100.100.100.100/37126 -> 10.1.1.1/1853;6, If: 73 (8), flag: 0041, wsf: 0, diff: 0

(in)* : 100.100.100.100/55686 -> 10.1.1.1/9207;6, If: 73 (8), flag: 0021, wsf: 0, diff: 0

Solution

Enable Screen or interface firewall filter to block tcp attack traffic.

( OR) In some situation applying GEOIP address instead of source-address any for wide open internet facing policy will help to reduce invalid sessions and pfe cpu utilization. Note that GEO IP Feeds require ATP cloud subscription ( Refer https://www.juniper.net/documentation/us/en/software/atp-cloud/atp-cloud-admin-guide/topics/concept/atp-cloud-geoip-overview.html more details .

Here is the example configuration

BEFORE :

set security policies global policy PUBLIC_MAIL_ACCESS match source-address any 
set security policies global policy PUBLIC_MAIL_ACCESS match destination-address MAILSERVER_GROUP
set security policies global policy PUBLIC_MAIL_ACCESS match application CUSTOM_APP_GROUP 
set security policies global policy PUBLIC_MAIL_ACCESS then permit application-services idp-policy ABC_POLICY
 
AFTER:
 
set security policies global policy PUBLIC_MAIL_ACCESS match source-address GEOIP_US 
set security policies global policy PUBLIC_MAIL_ACCESS match destination-address MAILSERVER_GROUP
set security policies global policy PUBLIC_MAIL_ACCESS match application CUSTOM_APP_GROUP 
set security policies global policy PUBLIC_MAIL_ACCESS then permit application-services idp-policy ABC_POLICY
 

Modification History

2024-10-08 : Article Created