topic Iron port webproxy maximum client connection in Web Security

Iron port webproxy maximum client connection

madhankumar.g — Tue, 04 Mar 2014 09:25:25 GMT

Hi,

We have Ironport S670 in configured in transparent mode as a standalone device. Internet access is slow through the proxy. Whether below total connections of 30656 can be an issue? How much connections this model of proxy can handle without any impact to traffic?

Model: S670

Version: 7.5.2-303

INGWPROXY> status

Enter "status detail" for more information.

Status as of: Tue Mar 04 12:21:27 2014 AST

Up since: Fri Feb 28 10:59:23 2014 AST (4d 1h 22m 4s)

System Resource Utilization:

CPU 12.8%

RAM 86.6%

Reporting/Logging Disk 21.2%

Transactions per Second:

Average in last minute 227

Bandwidth (Mbps):

Average in last minute 191.095

Response Time (ms):

Average in last minute 642

Connections:

Total connections 30656

Regards,

Madhan kumar G

Iron port webproxy maximum client connection

madhankumar.g — Tue, 04 Mar 2014 09:27:39 GMT

Hi,

Here is the status detail output.

status detail

Status as of: Tue Mar 04 12:25:51 2014 AST

Up since: Fri Feb 28 10:59:23 2014 AST (4d 1h 26m 28s)

System Resource Utilization:

CPU 10.8%

RAM 84.4%

Reporting/Logging Disk 21.6%

Transactions per Second:

Average in last minute 217

Maximum in last hour 296

Average in last hour 247

Maximum since proxy restart 354

Average since proxy restart 66

Bandwidth (Mbps):

Average in last minute 116.146

Maximum in last hour 317.945

Average in last hour 168.970

Maximum since proxy restart 499.903

Average since proxy restart 65.080

Response Time (ms):

Average in last minute 597

Maximum in last hour 910

Average in last hour 719

Maximum since proxy restart 12229

Average since proxy restart 715

Cache Hit Rate:

Average in last minute 7

Maximum in last hour 9

Average in last hour 5

Maximum since proxy restart 37

Average since proxy restart 1

Connections:

Idle client connections 1806

Idle server connections 3355

Total client connections 15503

Total server connections 15457

Regards,

Madhan kumar G

Iron port webproxy maximum client connection

Michael Hautekeete — Tue, 04 Mar 2014 16:49:39 GMT

The appliance can handle more than 100k total connections without any performance impacts. When you have slowness the connection count does not normally come into play unless the WSA is not closing the connections properly. Based on the status detail output you provided the majority of your connections are in use which is normal. With regards to slowness you should be looking at requests per second against the proxy CPU usage. You can find this data by using the 'rate' or 'proxystat' commands from the CLI. This will show you the proxy process CPU usage which will directly correlate to any slowness seen. Anything over 80% will begin to show slow performance. With regards to the S370 there are a few known performance issues, one is the BIOS and the other is the software code running. There should be an available upgrade for a BIOS firmware update that needs to be applied to your S370. As far as the software version, there is an issue with 7.7.0 that is fixed in the GA release that is scheduled for availability in the next few weeks. Our recommendation is to run 7.5.2 on the S370 and apply the BIOS firmware update. If both of these are true, then you may be overloading the proxy process. If you need assistance verifying you are overloading the proxy CPU then you will need to open a service request with TAC.

Best Regards,

Michael Hautekeete

Customer Support Engineer

Cisco Content Security - Web Security Appliance

http://www.cisco.com/en/US/products/ps11169/serv_group_home.html

https://supportforums.cisco.com/community/netpro/security/web

https://supportforums.cisco.com/community/feeds?community=2091

I think you should take a

hallvard.solem — Mon, 10 Mar 2014 08:18:58 GMT

I think you should take a look at the recommended bandwidth through the appliance in this forum post:

https://supportforums.cisco.com/discussion/12101786/ironport-s660-capacity

I am pretty sure your S670 is overloaded.