XG 550 performance slow, high "Sessions" amount

RE: XG 550 performance slow, high "Sessions" amount

BeEf — Thu, 28 Jan 2021 20:16:30 GMT

Maybe DDoS mitigation is not working and the attack is coming from the other side ...

[quote userid="85479" url="~/xg-firewall/f/discussions/125609/xg-550-performance-slow-high-sessions-amount/459221#459221"]2) Set up a mirror port and try to find out whats actually happening.[/quote]

RE: XG 550 performance slow, high "Sessions" amount

Josh Rogalski — Thu, 28 Jan 2021 19:56:59 GMT

We have 2 totally separate ISP's that go into the XG 550 (with SD-Wan policy routes balancing traffic). One has DDOS mitigation at the ISP level, and one doesn't have it (being replaced later this year). When we get attacked we have at times disconnected the 2nd line that doesn't have DDOS protection on it. It stops the attack from that unprotected line, but it feels like the appliance raises it's sessions and memory just because that second line is disconnected.

RE: XG 550 performance slow, high "Sessions" amount

BeEf — Thu, 28 Jan 2021 19:38:06 GMT

1.8 Million is definitely too high.

Could be some attack that is "consuming" sessions. Or maybe some packets with randomizes source addresses going against a service you are providing (e.g. Webserver, DNS, ...)

1) Check the rules WAN -> LAN and whether IDS is switched on.

2) Set up a mirror port and try to find out whats actually happening.

I did not completely understand what you are doing with your two internet lines though ....

(From our experience it is not possible to defend a DDoS attack on the device itself. So mitigating at the ISP is the way you need to do this. However be prepared that the second line could also be attacked (we noticed wandering of the attack depending on the provider ...).

RE: XG 550 performance slow, high "Sessions" amount

LuCar Toni — Thu, 28 Jan 2021 16:43:29 GMT

Sessions are basically conntrack table entries. Seems like some system is overload your system with sessions. You should get some expertise inhouse to find the Rootcause of this attacked.

It could be a attack or a network issue with loops.

Maybe try the following:

Conntrack is resonsible for the sessions in XG firewall.

You can check which kind of connections is filling up this but you need Linux CLI knowledge to do so:

conntrack -L will list all current session (Basically 1.8M entries).

You can Pipe them up and start grap. conntrack -L | grep NEW | wc -l Will list basically all new Sessions current seens and count them.

https://www.linuxtopia.org/Linux_Firewall_iptables/x1347.html