Menu

Join the Conversation

To sign in, use your existing MySonicWall account. To create a free MySonicWall account click "Register".

Sign In Register

TZ670 - Control Plane Flood Protection Threshold Exceeded

NathanFSNathanFS Newbie ✭
in Firewall Security Services

Hi all, 

I've got 2 x TZ670 SonicWall devices in HA installed at work. They are working as they should be. No reported issues on the network. 

However, I can see a warning in the logs for "Control Plane Flood Protection Threshold Exceeded" The frustrating thing, is that the log gives no info on what might be causing it (image below). I know it is Core 0 that it relates to, but cannot find historic Core 0 data as I don't think that is a feature that the device has. 

I've reached out to SonicWall support that recommended upping the threshold from 75% to 95% which in my mind is only masking an issue. We do not have DPI-SSL currently enabled and we have a very simple network topology. 

2 x Ubiquiti Aggregate switch 10Gbe OM4 connections to the firewalls and the 2 x Ubiquiti Enterprise 48 Port 2.5 GBe switches. 

Our incoming leased line is 500Mbps DL & 500Mbps UL. 

We have approximately 50 workstations connected the switches on 1Gbe and 43 VOIP phones connected using POE. 

Could it simply be a firmware issue or a false positive? Currently both running 7.1.1-7058-R6162

Any advice or help would be greatly appreciated. 

 

image.thumb.png.def046964ceee4a464868aa26e485268.png

Category: Firewall Security Services
Reply
Tagged:

Answers

  • ArkwrightArkwright Community Legend ✭✭✭✭✭

    Check your throughput stats, do you see these events coinciding with peaks in thoughput?

  • NathanFSNathanFS Newbie ✭
    https://community.sonicwall.com/technology-and-support/discussion/comment/22775#Comment_22775

    No Spikes in throughput. The highest throughput I have seen is 450mbps. The TZ670 is rated for 5.0Gbps without DPI-SSL.

    image.png

    Our maximum connections has never peaked over 17000 and the limit is 375000

    Core 0 highest usage shows as 45%

    image.png

  • TKWITSTKWITS Community Legend ✭✭✭✭✭

    The entire point of this feature is to protect the control plane from being overwhelmed with non-control traffic and slow the system management functions down.

    https://www.sonicwall.com/support/technical-documentation/docs/sonicosx-7-0-0-0-firewall/Content/Firewall_Advanced/firewall-advanced-controlplane-floodprotection.htm

    My understanding when the log entry is generated is that the control plane is dropping non-control traffic because the amount of non-control traffic on the control plane reached the remainder (25% of control plane) of the specified threshold (75%) - right?

    AFAIK there is no historic control plane data in the UI (and no way to obtain core specific data via SNMP), and the only real way to see usage is on the System Dashboard under 'System Status \ Management Plane'.

    The log entry is stating its protecting management functions, and supports suggestion is to INCREASE the threshold (in theory reducing the allowed amount of non-control traffic). Wait, wouldn't that also increase the number of times we see the log entry (since were only allowing the remainder and are already hitting it with a lower threshold)?

    So really I don't think this setting is clear, nor does it function the way its understood to. I think the threshold is actually the usage amount of allowed non-control traffic to hit the control plane. So 75% means up to 75% usage of the control plane is allowed for non-control data.

    Anyone else agree?

Sign In or Register to comment.