Iron port webproxy maximum client connection

[madhankumar.g]

Hi,

We have Ironport S670 in configured in transparent mode as a standalone device. Internet access is slow through the proxy. Whether below total connections of  30656 can be an issue? How much connections this model of proxy can handle without any impact to traffic?

Model: S670

Version: 7.5.2-303

INGWPROXY> status

Enter "status detail" for more information.

Status as of:                  Tue Mar 04 12:21:27 2014 AST

Up since:                      Fri Feb 28 10:59:23 2014 AST (4d 1h 22m 4s)

System Resource Utilization:

  CPU                                    12.8%

  RAM                                    86.6%

  Reporting/Logging Disk                 21.2%

Transactions per Second:

  Average in last minute                   227

Bandwidth (Mbps):

  Average in last minute               191.095

Response Time (ms):

  Average in last minute                   642

Connections:

  Total connections                      30656

Regards,

Madhan kumar G

[madhankumar.g]

Hi,

Here is the status detail output.

status detail

Status as of:                  Tue Mar 04 12:25:51 2014 AST

Up since:                      Fri Feb 28 10:59:23 2014 AST (4d 1h 26m 28s)

System Resource Utilization:

  CPU                                    10.8%

  RAM                                    84.4%

  Reporting/Logging Disk                 21.6%

Transactions per Second:

  Average in last minute                   217

  Maximum in last hour                     296

  Average in last hour                     247

  Maximum since proxy restart              354

  Average since proxy restart               66

Bandwidth (Mbps):

  Average in last minute               116.146

  Maximum in last hour                 317.945

  Average in last hour                 168.970

  Maximum since proxy restart          499.903

  Average since proxy restart           65.080

Response Time (ms):

  Average in last minute                   597

  Maximum in last hour                     910

  Average in last hour                     719

  Maximum since proxy restart            12229

  Average since proxy restart              715

Cache Hit Rate:

  Average in last minute                     7

  Maximum in last hour                       9

  Average in last hour                       5

  Maximum since proxy restart               37

  Average since proxy restart                1

Connections:

  Idle client connections                 1806

  Idle server connections                 3355

  Total client connections               15503

  Total server connections               15457

Regards,

Madhan kumar G

[Michael Hautekeete]

The appliance can handle more than 100k total connections without any performance impacts. When you have slowness the connection count does not normally come into play unless the WSA is not closing the connections properly. Based on the status detail output you provided the majority of your connections are in use which is normal. With regards to slowness you should be looking at requests per second against the proxy CPU usage. You can find this data by using the 'rate' or 'proxystat' commands from the CLI. This will show you the proxy process CPU usage which will directly correlate to any slowness seen. Anything over 80% will begin to show slow performance. With regards to the S370 there are a few known performance issues, one is the BIOS and the other is the software code running. There should be an available upgrade for a BIOS firmware update that needs to be applied to your S370. As far as the software version, there is an issue with 7.7.0 that is fixed in the GA release that is scheduled for availability in the next few weeks. Our recommendation is to run 7.5.2 on the S370 and apply the BIOS firmware update. If both of these are true, then you may be overloading the proxy process. If you need assistance verifying you are overloading the proxy CPU then you will need to open a service request with TAC.

Best Regards,

Michael Hautekeete

Customer Support Engineer

Cisco Content Security - Web Security Appliance

http://www.cisco.com/en/US/products/ps11169/serv_group_home.html

https://supportforums.cisco.com/community/netpro/security/web

https://supportforums.cisco.com/community/feeds?community=2091

[hallvard.solem]

I think you should take a look at the recommended bandwidth through the appliance in this forum post:

https://supportforums.cisco.com/discussion/12101786/ironport-s660-capacity

I am pretty sure your S670 is overloaded.