Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 9: Configuring Proxies
Proxy basics
246
When to disable the Fast Path Sessions option
In most cases, the Fast Path Sessions option enhances system performance,
and in many of these cases the improvement is significant. However, there are
some cases where the Fast Path Sessions option may negatively affect
performance. Large data transfers on heavily loaded systems, primarily FTP or
HTTP traffic, can overload a system. The Sidewinder G2 will also “throttle”
these connections under very heavy load conditions to prevent them from
taking over the system.
Proxy session limits
There is an upper limit to the number of simultaneous sessions for certain
proxy configurations. Table 21 provides a summary of hard limits based on perprocess
resource limits.
Table 21: Proxy session limits (hard limits)
Proxy Session Limits
FTP 4000 sessions
t120 1000 sessions
all other TCP 8000 sessions a
UDP The number of ports plus two times the number of sessions
must not exceed 16,000. (The maximum number of enabled
ports for all services on all burbs must not exceed 8000.)
a. A maximum of 16 Telnet sessions are allowed in the “enter destination” or
“authentication” stage.
Tip: Session limits for each proxy can be lowered from the hard limits by editing
the simultaneous_sessions entry in the configuration file (*.conf) for each proxy.
Configuring multiple instances of certain proxies
Certain proxies (HTTP, HTTPS, generic TCP, and SQL) can be configured to
enable multiple instances of the same proxy in order to load the traffic across
the multiple instances. This is useful for hardware configurations with multiple
CPUs or sites that have experienced problems due to an exceedingly large
amount of concurrent connections through one of those proxies. A single proxy
instance for any of these proxies can handle up to 8000 sessions (a session
consists of two connections for most protocols), which is more than adequate
for most sites. However, if your site is consistently recording concurrent
sessions that hover around the 8000 range (or if you have experienced
problems because the number of connection attempts is significantly higher)
for any of these proxies, you may need to enable additional instances for that
proxy.