Maximum recommended forwarding hosts on Edge SWG (ProxySG)

Products

• ProxySG Software - SGOS

Issue/Introduction

The Edge SWG with many forwarding hosts defined and in use in Policy with the following symptoms:

- High CPU utilization

- Slow service for client requests

- Unexpected restarts when changing or committing Policy

- Unexpected restarts if DNS or other networking issues occur

- Restarts with the following signature found in the Mini-Context section in the Sysinfo file:

Hardware exception code: 0x0
Software exception code: 0x3a0004
Page fault linear address: 0x0
Process group: "PG_HEALTH_CHECKS"
Process: "HC Watchdog" in "" at .text+0x0

Cause

The Edge SWG experiences performance issues or restarts unexpectedly when more than 1000 forwarding hosts are defined.

Resolution

Keep the forwarding hosts to fewer than 1000 entries. Forwarding TCP tunneled requests can be done with Policy rewrite without using forwarding hosts.

If you require more than the recommended limit of forwarding hosts, optimize your policy by allowing the compiler to automatically induce a hash table. Currently, the compiler only induces a hash table for condition definitions. To optimize your policy, use a [server_url.domain] section.

Non-Optimized Policy Example 

<Forward>
  server_url.domain="host1.peer-56-93.toferpod.bluecoat.com" forward("fwdhost1") forward.fail_open(no)
  server_url.domain="host2.peer-56-93.toferpod.bluecoat.com" forward("fwdhost2") forward.fail_open(no)
...

Optimized Policy Example

<Forward>
  [server_url.domain] forward.fail_open(no)
  "host1.peer-56-93.toferpod.bluecoat.com" forward("fwdhost1")
  "host2.peer-56-93.toferpod.bluecoat.com" forward("fwdhost2")
...

If you had a set of hosts for which the forward_fail_open() value should be yes, then use a separate section for those hosts.