topic Re: how can i limit the Maximum Number of connections per ip in General Topics

how can i limit the Maximum Number of connections per ip

Kumasan — Wed, 02 Aug 2017 10:44:48 GMT

Hi everyone

i have a question is how to limit the maximum number of sessions per ip or per zone ?

hope someone can help me.

Re: how can i limit the Maximum Number of connections per ip

Raido_Rattameister — Wed, 02 Aug 2017 14:03:03 GMT

This can be done with DoS protection.

https://live.paloaltonetworks.com/t5/Tutorials/How-to-Set-Up-DoS-Protection/ta-p/71164

Also check out zone protection.

In general you apply broad zone protection and then use DoS protection to be more specific for specific IP or subnet.

Re: how can i limit the Maximum Number of connections per ip

BPry — Wed, 02 Aug 2017 15:07:50 GMT

@Kumasan,

Specifically within zone protection and DoS policies you are going to want to look at the Resources Protection tab.

Re: how can i limit the Maximum Number of connections per ip

Kumasan — Thu, 03 Aug 2017 03:54:36 GMT

@BPry,

thanks for your reply . in my opinion ,the maximum concurrent sessions in zone protection profiles which is limit the total number of session in this zone , not session per ip . Is it correct or not ?

Re: how can i limit the Maximum Number of connections per ip

reaper — Thu, 03 Aug 2017 09:17:59 GMT

the maximum concurrent sessions in zone-protection are a total cumilative for the entire zone

in dos-protection the aggregate functions for all cumulative sources towards a single destination and the classified functions as a per source per destination limitation

Re: how can i limit the Maximum Number of connections per ip

BPry — Thu, 03 Aug 2017 14:35:51 GMT

@Kumasan,

Reaper already gave you the information you were looking for.

I'm a big supporter of utilizing all of the possible scenarios when it comes to actually securing your network. If you have a reason to utilize zone protection you likely also have a reason to enabel DoS protection profiles. Zone Protection by nature will be very high-level protection as you have to set the limits within reason to not interupt normal traffic flow; with DoS profiles you can get way more granular and properly secure hosts instead of just the zone. I highly recommend utilizing both.

Re: how can i limit the Maximum Number of connections per ip

ThomasX — Fri, 16 Apr 2021 02:33:52 GMT

No answer ... my customer ask me this configure 😞

Re: how can i limit the Maximum Number of connections per ip

tamilvanan — Fri, 16 Apr 2021 13:14:16 GMT

Hope this below post link answers your query:

https://live.paloaltonetworks.com/t5/general-topics/is-it-possible-to-limit-concurrent-session-per-zone-or-per/td-p/19638