Juniper Firewall Session High problem

Question: Session 100%

650) this.width=650; "src=" http://s13.sinaimg.cn/middle/86444311gc7ad7b31424c&690 "width=" 397 "height=" 195 " Name= "image_operate_12831345449159896" alt= "Juniper Firewall <wbr>session <wbr> high problem" title= "Juniper Firewall < Wbr>session <wbr> High Problem "style=" margin:0px;padding:0px;border:0px;list-style:none;/>

Log error:

Session utilization have reached 43257, which is 90% of the system capacity!

Session connection too high

Workaround:

1. Log in to the firewall via Telnet or Consol method

2. Use Get session to see the total number of session sessions, if it is more than 3,001 is not normal

alloc 48000/max 48064, Alloc failed 2682725821, mcast all
Total reserved 0, free sessions in shared pool 64
ID 36/s**,vsys 0,flag 04000000/0000/0001,policy 1,time 5,
If 0 (Nspflag 800801): 192.168.0.57/40148->46.249.48.237/4
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 6 (Nspflag 800800): 116.90.85.5/40148<-46.249.48.237/41

S token 4,vlan 0,tun 0,vsd 0,route 5
ID 41/s**,vsys 0,flag 04000000/0000/0001,policy 1,time 6,
If 0 (Nspflag 800801): 192.168.0.57/33967->46.249.48.237/3
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 6 (Nspflag 800800): 116.90.85.5/33967<-46.249.48.237/38
S token 4,vlan 0,tun 0,vsd 0,route 5
ID 42/s**,vsys 0,flag 04000000/0000/0001,policy 1,time 5,
If 0 (Nspflag 800801): 192.168.0.57/39410->46.249.48.237/2

3. Use Get Session | I 192.168 views 192.168. Session connection Condition of segment

Ssg140-> Get Session | I 192.168
If 0 (Nspflag 800801):192.168.0.57/46487->46.249.48.237/12707,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/55007->46.249.48.237/39983,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/48080->46.249.48.237/2469,17,848f69dc69bc,ses
S token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/43232->46.249.48.237/47998,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/39463->46.249.48.237/33930,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/46013->46.249.48.237/45993,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/37948->46.249.48.237/61889,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/38786->46.249.48.237/14897,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/37535->46.249.48.237/2187,17,848f69dc69bc,ses
S token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/32769->46.249.48.237/58035,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/44854->46.249.48.237/19293,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/34863->46.249.48.237/50367,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/44754->46.249.48.237/9409,17,848f69dc69bc,ses
S token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/42375->46.249.48.237/30999,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/41061->46.249.48.237/18728,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/45544->46.249.48.237/58502,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/37048->46.249.48.237/52232,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/35874->46.249.48.237/7843,17,848f69dc69bc,ses
S token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/56577->46.249.48.237/35131,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/57100->46.249.48.237/13237,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/48264->46.249.48.237/16853,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1
If 0 (Nspflag 800801): 192.168.0.57/56332->46.249.48.237/44035,17,848f69dc69bc,se
SS Token 3,vlan 0,tun 0,vsd 0,route 1

4. Find out the fault server address is 192.168.0.57

5, through the clear session Src-ip 192.168.0.57 View the connection number of the session of 192.168.0.57

Ssg140-> Clear Session Src-ip 192.168.0.57
Total cleared software sessions:47877

6. Enter 192.168.0.57 server top-23:52:34 up days, 4:48, 3 users, Load average:2.72, 2.92, 2.81
tasks:308 Total, 3 running, 305 sleeping, 0 stopped, 0 zombie
Cpu (s): 8.5%us, 2.7%sy, 0.0%ni, 88.7%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
mem:16316340k Total, 1599156k used, 14717184k free, 154852k buffers
swap:33554424k Total, 0k used, 33554424k free, 866596k cached

PID USER PR NI VIRT RES SHR S%cpu%MEM time+ COMMAND
7178 Root 0 131m 4952 1188 R 100.0 0.0 3919:56 perl
7050 Root 0 118m 4040 1952 R 100.0 0.0 4148:07 python
1 Root 0 19272 1548 1260 S 0.0 0.0 0:02.48 Init
2 Root 0 0 0 0 S 0.0 0.0 0:00.00 Kthreadd
3 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/0
4 Root 0 0 0 0 S 0.0 0.0 0:00.04 ksoftirqd/0
5 root RT 0 0 0 0 S 0.0 0.0 0:00.00 migration/0
6 root RT 0 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
7 Root RT 0 0 0 0 S 0.0 0.0 0:00.03 MIGRATION/1
8 root RT 0 0 0 0 S 0.0 0.0 0:00.00 MIGRATION/1
9 Root 0 0 0 0 S 0.0 0.0 0:00.00 KSOFTIRQD/1

Find the problem

This article is from the "Dream to Reality" blog, please be sure to keep this source http://lookingdream.blog.51cto.com/5177800/1826423

Juniper Firewall Session High problem