1

In Juniper SRX 5800 series Firewall , when we run the command 'show security flow session summary node 0' , we see that it shows large numbers of sessions as invalidated. But we don't know specifically which sessions are being termed as invalidated. We are particularly interested in getting the details of those invalidated sessions so to address them.

Can someone please help and guide by sharing some commands which will help us in identifying those sessions i.e. we could know their source and destination IP addresses , source port / destination port like we used to observe in security flow output.

Here is the output on our firewall.

user@Juniper-FWR-SRX5-1> show security flow session node 0 summary 
node0:
--------------------------------------------------------------------------

Flow Sessions on FPC7 PIC1:
Unicast-sessions: 736296
Multicast-sessions: 0
Services-offload-sessions: 0
Failed-sessions: 1818245650
Sessions-in-use: 766287
  Valid sessions: 732701
  Pending sessions: 2
  Invalidated sessions: 33584  <------
  Sessions in other states: 0
Maximum-sessions: 1048576

Flow Sessions on FPC8 PIC0:
Unicast-sessions: 739223
Multicast-sessions: 0
Services-offload-sessions: 0
Failed-sessions: 1822969742
Sessions-in-use: 761647
  Valid sessions: 735542
  Pending sessions: 2
  Invalidated sessions: 26103 <------
  Sessions in other states: 0
Maximum-sessions: 1048576 

Many Thanks !

2

There isn't a show command that shows this information. Invalidated sessions are sessions that are due for cleanup/deletion, holding them in memory so that they could be viewed may present other issues. The behavior can change slightly depending on some configuration settings (i.e. set security flow tcp-session rst-invalidate-session).

If your issue is a one-off occurrence that you need to troubleshoot, I believe JTAC has a method to do this. However, it's not something that could be done on a regular basis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.