Hot!CLI Connections per second

Author
CorneJvV
Silver Member
  • Total Posts : 79
  • Scores: 0
  • Reward points: 0
  • Joined: 2012/04/02 03:06:37
  • Status: offline
2014/09/03 05:37:42 (permalink)
0

CLI Connections per second

Hello All

My client is running a 60C and I think it might be too small for the environment.
How can I check how many connections per second or total connections are currently taking place on the device?

#1

11 Replies Related Threads

    Warren_Olson_FTNT
    Gold Member
    • Total Posts : 131
    • Scores: 3
    • Reward points: 0
    • Joined: 2014/06/05 06:57:10
    • Status: offline
    RE: CLI Connections per second 2014/09/03 07:31:01 (permalink)
    0
    CorneJvV,

    In the Dashboard section make sure you add the widget " Session History" to get an idea of how many sessions are currently/have been ocurring through the appliance.
    #2
    emnoc
    Expert Member
    • Total Posts : 5748
    • Scores: 373
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: offline
    RE: CLI Connections per second 2014/09/03 08:07:12 (permalink)
    0
    Alternative & from the cli


    get sys performance status
    diag sys session stat



    This will give some history and current status. You graph this in cacti also if your up to the challenge.

    PCNSE 
    NSE 
    StrongSwan  
    #3
    CorneJvV
    Silver Member
    • Total Posts : 79
    • Scores: 0
    • Reward points: 0
    • Joined: 2012/04/02 03:06:37
    • Status: offline
    RE: CLI Connections per second 2014/09/05 05:19:58 (permalink)
    0
    Hello All

    Thank you both for the replies.
    Just to confirm, the session count is the concurrent sessions and not the sessions per second?
    session_count=2817

    FOrtiGate60C# diag sys session stat
    misc info: session_count=2817 setup_rate=16 exp_count=0 clash=23804
    memory_tension_drop=0 ephemeral=0/30208 removeable=0 ha_scan=121
    delete=0, flush=0, dev_down=0/0
    TCP sessions:
    1004 in ESTABLISHED state
    133 in SYN_SENT state
    18 in SYN_RECV state
    22 in FIN_WAIT state
    373 in TIME_WAIT state
    35 in CLOSE state
    26 in CLOSE_WAIT state
    firewall error stat:
    error1=00000000
    error2=00000000
    error3=00000000
    error4=00000000
    tt=00000000
    cont=27488f07
    ids_recv=cbaee6d6
    url_recv=00000000
    av_recv=7790f387
    fqdn_count=00000001
    tcp reset stat:
    syncqf=234376 acceptqf=0 no-listener=4210102 data=0 ses=116 ips=0
    global: ses_limit=0 ses6_limit=0 rt_limit=0 rt6_limit=0
    FOrtiGate60C#
    #4
    Jupiter_FTNT
    Bronze Member
    • Total Posts : 33
    • Scores: 0
    • Reward points: 0
    • Joined: 2011/12/16 12:01:26
    • Status: offline
    RE: CLI Connections per second 2014/09/05 10:45:49 (permalink)
    0
    setup_rate=16

    This is connection per sec

    session_count=2817

    This is the concurrent sessions
    #5
    emnoc
    Expert Member
    • Total Posts : 5748
    • Scores: 373
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: offline
    RE: CLI Connections per second 2014/09/05 11:57:23 (permalink)
    0
    I would be very careful using those commands to benchmark if you FGT is to small. The get sys performance would at least give you an avg

    The # of session ( accumulative ) is one thing , the number of new connection ( per/sec ) is another , and the thru-put is entirely something else. Those cmds will not bevery helpful if you don' t have a baseline collection.

    You really should be graphing these over a course of time and then you will have useful information for making a wiser decision imho.

    PCNSE 
    NSE 
    StrongSwan  
    #6
    dasilva13
    Silver Member
    • Total Posts : 63
    • Scores: 0
    • Reward points: 0
    • Joined: 2014/08/11 12:31:52
    • Status: offline
    RE: CLI Connections per second 2014/09/10 06:47:56 (permalink)
    0
    What size environment are you running? IE, amount of users/UTM features enabled (IPS,AV,Web,DLP,FCT Etc)

    that would maybe help us decide whether or not you have the right size device.

    I my experience, the 60c is only for very small branch offices that don' t need a lot of features enabled.
    #7
    Matthew Mollenhauer
    Silver Member
    • Total Posts : 69
    • Scores: 0
    • Reward points: 0
    • Joined: 2013/07/07 20:06:48
    • Status: offline
    RE: CLI Connections per second 2014/09/11 04:34:05 (permalink)
    0
    We have a 60CX-ADSL-A in our London office, it' s more than big enough for the 7 users using ADSL when not using UTM.

    However running UTM features with 7 users will put the CPU at 100% when using about 10Mbps of the ADSL.

    Regards,
    Matthew
    #8
    sotir1984
    Bronze Member
    • Total Posts : 26
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/02/21 09:05:56
    • Status: offline
    Re: RE: CLI Connections per second 2018/06/06 01:44:50 (permalink)
    0
    Can i view session per second for a single policy?
    #9
    emnoc
    Expert Member
    • Total Posts : 5748
    • Scores: 373
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: offline
    Re: RE: CLI Connections per second 2018/06/06 08:26:36 (permalink)
    5 (1)
    Probably not but you can get   bps per session here's a few methods. You will need to explore and  research means that might pull the info.  I would not be  tto much worried on session setup unless you already at a near max value.
     
     
    http://socpuppet.blogspot.com/2014/09/howto-find-out-how-many-bps-policy-is.html
    http://socpuppet.blogspot.com/2014/09/exploring-diag-stats-fortigate.html
     

    PCNSE 
    NSE 
    StrongSwan  
    #10
    sotir1984
    Bronze Member
    • Total Posts : 26
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/02/21 09:05:56
    • Status: offline
    Re: RE: CLI Connections per second 2018/06/07 02:57:25 (permalink)
    0
    Hi,
     
    Thanks. My whole idea was to be able to adjust some ips signatures based on the new sessions per second on a single policy.
     
    For example a client has RDP allowed from outside in, and i have ips signature that serves as a brute force protection, allowing 200 new sessions per 10 seconds.
     
    -1984-
    #11
    bladex79
    New Member
    • Total Posts : 2
    • Scores: 0
    • Reward points: 0
    • Joined: 2020/07/07 21:58:50
    • Status: offline
    Re: RE: CLI Connections per second 2020/07/07 22:16:22 (permalink)
    0
    What would be the MIB's to use for Connections Per second (CPS) & concurrent connections? I FgSysSesCount captures concurrent connections but I cannot find one for CPS for Fortigate. :(
     
     
    #12
    Jump to:
    © 2020 APG vNext Commercial Version 5.5