Troubleshoot TLS/SSL oversubscription

Monitor and troubleshoot TLS/SSL oversubscription by configuring decryption policies, enabling logging, and adding SSL Flow Flags to connection EVENT views in the Cisco Secure Firewall Management Center.

If your managed device has TLS crypto acceleration enabled, you can view connection events to determine whether or NOT the devices are experiencing SSL oversubscription. You must add at least the SSL Flow Flags EVENT to the table view of connection events.

Before you begin

Configure a decryption policy with a setting for Handshake Errors on Undecryptable Actions page.

For more information, see Set default handling for undecryptable traffic.
Enable logging for your SSL rules as discussed in the section on logging decryptable connections in decryption rules in the Secure Firewall Management Center and Threat Defense Management Network Administration guide.

Follow these steps to troubleshoot TLS/SSL oversubscription:

Procedure

Step 1

Click Events & Logs > + Show more > Connection > Events.

Step 2

Click Table View of Connection Events.

Step 3

Click x on any column in the connection events table to add additional columns for at least SSL Flow Flags and SSL Flow Messages.

The image illustrates the addition of various SSL-related columns, including SSL Actual Action, SSL Flow ERROR, SSL Flow Flags, SSL Flow Messages, SSL Policy, and SSL Rule, to the table of connection events in a user interface dialog box.

The following example shows adding the SSL Actual Action, SSL Flow ERROR, SSL Flow Flags, SSL Flow Messages, SSL Policy, and SSL Rule columns to the table of connection events. (Look in the Disabled Columns section of the dialog box.)

Adding SSL flags to the list of connection events you wish to view.

Step 4

Click Apply.

TLS/SSL oversubscription is indicated by the values of ERROR_EVENT_TRIGGERED and OVER_SUBSCRIBED in the SSL Flow Flags column.

Step 5

If TLS/SSL oversubscription is occurring, log in to the managed device and enter any of the following commands:


Command	Result
show counters	If the value of TCP_PRX BYPASS_NOT_ENOUGH_MEM is large, consider upgrading your device to one with a larger capacity for SSL traffic or use Do NOT Decrypt rules for lower priority encrypted traffic.
show snort TLS-offload	If the value of BYPASS_NOT_ENOUGH_MEM is large, consider upgrading your device to one with a larger capacity for SSL traffic or use Do NOT Decrypt rules for lower priority encrypted traffic.