topic Multi Context - limiting connection resources in Network Security

Multi Context - limiting connection resources

johng231 — Tue, 12 Mar 2019 03:22:01 GMT

Hello-

I have setup a class-map to limit the number of connections for each separate contexts. I'm seeing an issue after applying it where the threshold is exceeding: "Drop-reason: (rm-conn-limit) RM connection limit reached"; however, the show resource usage shows the current and peak is no way near reaching the limit, only showing a couple of connections.

Version 9.1(4)

class default

limit-resource All 0

limit-resource Mac-addresses 65535

limit-resource ASDM 5

limit-resource SSH 5

limit-resource Telnet 5

limit-resource Conns 0

class FW-GEN

limit-resource Conns 300000

class FW-EC

limit-resource Conns 300000

class FW-MAIN

limit-resource Conns 300000

class FW-MARK

limit-resource Conns 300000

class FW-PCI

limit-resource Conns 300000

class FW-BUBBLE

limit-resource Conns 100000

class FW-LAB

limit-resource VPN Other 10

limit-resource Conns 300000

Resource Current Peak Limit Denied Context

SSH 1 2 5 0 admin

ASDM 0 4 5 0 admin

Conns 3 7 unlimited 0 admin

Hosts 3 7 unlimited 0 admin

Inspects [rate] 0 7 unlimited 0 admin

Routes 2 2 unlimited 0 admin

Conns 0 40 99000 0 BUBBLE

Hosts 0 32 unlimited 0 BUBBLE

Conns [rate] 0 125 unlimited 0 BUBBLE

Inspects [rate] 0 25 unlimited 0 BUBBLE

Mac-addresses 0 2 65535 0 BUBBLE

SSH 0 2 5 0 LAB

Syslogs [rate] 0 147 unlimited 0 LAB

Conns 2 178 299000 22830 LAB

Xlates 3 423 unlimited 0 LAB

Hosts 3 72 unlimited 0 LAB

Conns [rate] 0 250 unlimited 0 LAB

Inspects [rate] 0 67 unlimited 0 LAB

Routes 9 10 unlimited 0 LAB

Other VPN Sessions 43 45 10 2 LAB

Other VPN Burst 0 1 0 0 LAB

Packet-Tracert input inside

Result:

input-interface: inside

input-status: up

input-line-status: up

output-interface: outside

output-status: up

output-line-status: up

Action: drop

Drop-reason: (rm-conn-limit) RM connection limit reached

Is there anything else I can check to see why the connection limit is being reached?

Multi Context - limiting connection resources

Maykol Rojas — Sun, 29 Dec 2013 20:36:56 GMT

Has to be a new/Existing bug.

Please send me a message, if you need to solve this right away, go ahead and open a ticket.

Mike

Multi Context - limiting connection resources

Jigar Dave — Mon, 30 Dec 2013 05:45:24 GMT

limit on conn resources depend upon which hardware model you are using

this (http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/license.html#wpxref10155 ) shows table per hardware.

I am also interested to know if this is bug in the OS.

JD...

Multi Context - limiting connection resources

johng231 — Mon, 30 Dec 2013 16:22:27 GMT

I have opened up a ticket. I'll keep everyone posted on the findings.

The ASA hardware is a pair of 5585x SSP40 and it's not in production. We are only testing this in the LAB using multi context with a policy to restrict the number of connections so in case where one context gets overwhelmed, it won't affect the others. Looking for a simple class policy to apply to each context.

Thanks,

John

Multi Context - limiting connection resources

Maykol Rojas — Mon, 30 Dec 2013 17:14:04 GMT

Looks like a new one. I found the ticket. Will keep an eye on it.

Mike

I am having the exact same

Girma Misganaw Mitiku — Thu, 04 Feb 2016 10:30:46 GMT

I am having the exact same problem with ASA 5555 9.4, any updates on this?

- Make sure you have upgraded

amanharamaya — Mon, 22 Feb 2016 08:55:13 GMT

- Make sure you have upgraded to the latest version of ASA, SFR and FMC versions

- Make sure you do not have have not set unlimited connection timeouts on the Inside-Interface

- Make sure you have left Inside-Interface Per-client-max = 0 (default) , Per-client-embryonic-max = 0 (default) and Idle= 0 (default)

That Solved the Problem For me!