Explicit proxy sessions and user limits
Web browsers and web servers open and close multiple sessions with the explicit web proxy. Some sessions open and close very quickly. HTTP 1.1 keepalive sessions are persistent and can remain open for long periods of time. Sessions can remain on the explicit web proxy session list after a user has stopped using the proxy (and has, for example, closed their browser). If an explicit web proxy session is idle for more than 3600 seconds it is torn down by the explicit web proxy. See
RFC 2616 for information about HTTP keepalive/persistent HTTP sessions.
This section describes proxy sessions and user limits for both the explicit web proxy and the explicit FTP proxy. Session and user limits for the two proxies are counted and calculated together. However, in most cases if both proxies are active there will be many more web proxy sessions than FTP proxy sessions.
The FortiGate unit adds two sessions to its session table for every explicit proxy session started by a web browser and every FTP session started by an FTP client. An entry is added to the session table for the session from the web browser or client to the explicit proxy. All of these sessions have the same destination port as the explicit web proxy port (usually 8080 for HTTP and 21 for FTP). An entry is also added to the session table for the session between the exiting FortiGate interface and the web or FTP server destination of the session. All of these sessions have a FortiGate interface IP address and the source address of the session and usually have a destination port of 80 for HTTP and 21 for FTP.
Proxy sessions that appear in the Top sessions dashboard widget do not include the Policy ID of the web-proxy or ftp-proxy security policy that accepted them. However, the explicit proxy sessions appear in the Top Sessions dashboard widget with a destination port that matches the explicit proxy port number (usually 8080 for the web proxy and 21 for the FTP proxy). The proxied sessions from the FortiGate unit have their source address set to the IP address of the FortiGate unit interface that the sessions use to connect to their destinations (for example, for connections to the Internet the source address would be the IP address of the FortiGate interface connected to the Internet).
FortiOS limits the number of explicit proxy users. This includes both explicit FTP proxy and explicit web proxy users. The number of users varies by FortiGate model from as low as 10 to up to 18000 for high end models. You can use the following command to display the limit on the number of explicit web proxy users for a FortiGate unit:
get test wad 62
Total user count:1, shared user quota:500, shared user count:1 form_auth_keepalive=0 vd=root max=0 guarantee=0 used=1
This command output shows that the explicit proxy user limit (the shared user quota) for this FortiGate unit is 500 users.
You cannot change this limit. If your FortiGate unit is configured for multiple VDOMs this limit must be shared by all VDOMs. You can also use VDOM resource limiting to limit the number of explicit proxy users for the FortiGate unit and for each VDOM. To limit the number of explicit proxy users for the FortiGate unit from the web‑based manager enable multiple VDOMs and go to System > VDOM > Global Resources set the number of Concurrent explicit proxy users or use the following command:
config global
config system resource-limits
set proxy 50
end
end
To limit the number of explicit proxy users for a VDOM, from the web‑based manager enable multiple VDOMs and go to System > VDOM > VDOM and edit a VDOM or use the following command to change the number of explicit web proxy users for VDOM_1:
config global
config system vdom-property
edit VDOM_1
set proxy 25
end
end
The VDOM resource limit pages on the web‑based manager also display the current number of explicit web proxy users. You can also use the get test wad 60 CLI command to view the number of explicit web proxy users. For example:
get test wad 60
IP based users:
user:0x9ab8350 username:User1, vf_id:0, ip_addr:10.31.101.10, ref_cnt:9
Session based users:
user:0x9ac3c40, username:User2, vf_id:0, ref_cnt:3
user:0x9ab94f0, username:User3, vf_id:0, ref_cnt:1
Total allocated user:3
Total user count:3, shared user quota:50, shared user count:3
Users may be displayed with this command even if they are no longer actively using the proxy. All idle sessions time out after 3600 seconds.
The command output shows three explicit proxy users. The user named User1 has authenticated with a security policy that includes IP-based authentication and the user’s source IP address is 10.31.101.10. The users named User2 and User3 have authenticated with a security policy that includes session-based authentication.
You can use the following command to flush all current explicit proxy users. This means delete information about all users and force them re-authenticate.
get test wad 61
| Users that authenticate with explicit web-proxy or ftp-proxy security policies do not appear in the User & Device > Monitor > Firewall list and selecting De-authenticate All Users has no effect on explicit proxy users. |
How the number of concurrent explicit proxy users is determined depends on their authentication method:
• For session-based authenticated users, each authenticated user is counted as a single user. Since multiple users can have the same user name, the proxy attempts to identify users according to their authentication membership (based upon whether they were authenticated using RADIUS, LADAP, FSAE, local database etc.). If a user of one session has the same name and membership as a user of another session, the explicit proxy assumes this is one user.
• For IP Based authentication, or no authentication, or if no web-proxy security policy has been added, the source IP address is used to determine a user. All sessions from a single source address are assumed to be from the same user.
The explicit proxy does not limit the number of active sessions for each user. As a result the actual explicit proxy session count is usually much higher than the number of explicit web proxy users. If an excessive number of explicit web proxy sessions is compromising system performance you can limit the amount of users if the FortiGate unit is operating with multiple VDOMs.