Description

This article provides an explanation on how to determine the session rate on SRX devices.

Symptoms

High session rate

High PFE CPU

Packet drops

Firewall reaching its session limit

Performance degradation

Solution

First get an overview of the session usage by checking the statistics using the below command. ​

 

> show security flow session--------This command will show the current active sessions and the total number of active sessions.

 

> show security flow session summary------This command will give a high-level overview of the session statistics, such as total active sessions, sessions-in-use, failed sessions, invalidated sessions etc.

 

​

To check at the PFE level you can use the below command

 

(vty)# show usp flow session summary​

​

Monitor the session rate using the below command. Running this command, multiple times will help us determine the session rate and if the session rate is constant or irregular .

> show security monitoring performance session

 

To check at the PFE level you can use the below command,​

​

- For Branch SRX Series (SRX3xx and SRX550M), ​

  (vty)# show octeon session detail​

​

    - For DataCenter SRX (SRX1500, SRX4k), SPC3 and vSRX​

  (vty)# show i386 session detail​

​

​- For High End SRX (SRX1k, SRX3k and SRX5k)​

  (vty)# show xlr session detail

 

We can check the session creation rate using the below command. This command will show the PFE CPU utilization, memory utilization, Current session rate and the session creation per second rate.show security monitoring fpc 0

Modification History

v1