topic Re: Is it possible to limit concurrent session per source IP? in General Topics

Is it possible to limit concurrent session per Zone or per source IP?

BSadozai — Thu, 22 Nov 2012 16:05:49 GMT

Hi Guys.

I was looking to limit session per Zone or per src IP and I found this discussion, so we are in version 4.1.8 and cannot find any option on the QoS to do this limit ?

Thanks for your help

Re: Is it possible to limit concurrent session per source IP?

jleung — Thu, 22 Nov 2012 16:30:26 GMT

Hi,

It is not under the QoS setting.

To do this, you need to go to the policy tab and configure the DoS policy. You need to input the source and destination zones you want to apply the control, and choose

- protect instead of allow/any as the action

- classified instead of aggregated as the type of protection

- choose whether you want to consider a counter hit by just the src IP, src IP + Dst IP or just the dst IP

- create the DoS profile, and under the resource protection input the limit

Regards,

Jones

Re: Is it possible to limit concurrent session per source IP?

BSadozai — Fri, 23 Nov 2012 08:04:15 GMT

Hi,

Thanks for your quick answer.

This is greate.

Regards

Re: Is it possible to limit concurrent session per source IP?

BSadozai — Thu, 29 Nov 2012 15:23:15 GMT

Hi,
I have just a small question about the DoS profile, for a test I configured the profile with the value below for Syn flood:

Alarm Rate (packets/sec) 50
Activate Rate (packets/sec) 50
Maximal Rate (packets/sec) 800
Block Duration (seconds) 300

After flooding with 100pps I can see on the threat log that syn flood was detected and randomly was dropped, but how about the first value (Alarm Rate) where I should receive the Alarm ? as above I should receive an alarm after 50pps ?

Thanks for your help

Regards