Forum Discussion

gpracer69's avatar
gpracer69
Icon for Nimbostratus rankNimbostratus
Aug 29, 2017

Why am I seeing so many pending active sessions in my APM?

I am currently seeing about 1,000 pending active sessions on my APM. I am running APM 13.0.0 Build 1645. I have a Access Profile that keeps disallowing users access because the Max In Progress Sessions Per Client IP limit was being reached. I had it set to 1000 previously and users were being blocked because I had about 1000 pending active sessions to that Access Profile. The pending active sessions have a user of n/a and they are all coming from the NAT IP addresses of my users. When I look at the session details for the pending active sessions they all just have two lines:

 

Received User-Agent header: ..... New session from client IP x.x.x.x at VIP x.x.x.x Listener

 

They persist for quite a while before dropping off. I can't find anything in the configuration that would be causing this to happen. Has anyone experience this kind of activity in the APM before? I hate having to modify the Access Profile setting just to get around this.

 

BIG-IP Access Policy Manager (APM)
security
  • Jad_Tabbara__J1's avatar
    Jad_Tabbara__J1
    Icon for Cirrostratus rankCirrostratus
    Aug 29, 2017

    Hello,

     

    Are you monitoring/scanning your VSs ? In that case it may generate new APM session...

     

    You can reduce the "Access Policy Timeout" that is by default to 5min (300 seconds). The APM will clear that sessions faster.

     

    For definition about this timeout check : https://support.f5.com/csp/article/K12300

     

    Hope it helps