Reducing the number of DNS and ICMP sessions

You can use the config system session-ttl command to reduce the number of DNS and ICMP sessions managed by a hyperscale firewall VDOM. Normally these are short lived sessions, and quickly removing them from the session table reduces session overhead.

Reduce the number of DNS sessions by setting the timeout for port 53 UDP sessions (protocol 17) to a low value, for example, 3 seconds:

config system session-ttl

config port

edit 1

set protocol 17

set timeout 3

set start-port 53

set end-port 53

end

Reduce the number of ICMP sessions by setting the timeout for protocol 1 sessions to 2 seconds:

config system session-ttl

config port

edit 2

set protocol 1

set timeout 2

end