Is it possible to limit concurrent session per source IP?

cancel
Showing results for 
Search instead for 
Did you mean: 

Is it possible to limit concurrent session per source IP?

Not applicable

Hello,

I have a PAN-2050 installed in vitual wire reaching max concurrent session  (262143) and discarding sessions in peak hours unable to create new sessions. I would like to know if it is possible to configure or create a rule to limit the max concurrent session per source IP. Or maybe per appication.

I couldn´t find information abour that in Admin or Command Guide. Does anybody have experience with similar issue?

Thanks.

1 ACCEPTED SOLUTION

Accepted Solutions

L4 Transporter

This is not possible. You could use QOS to limit bandwidth but we have no way to limit users to a max number of sessions.

Steve Krall

View solution in original post

17 REPLIES 17

L4 Transporter

This is not possible. You could use QOS to limit bandwidth but we have no way to limit users to a max number of sessions.

Steve Krall

View solution in original post

L4 Transporter

I believe this feature is coming in the next major release (Q12011).

Cheers,

Kelly

Hi Alberto,

Next release you can configure DoS policy for your internal LAN, based on source IP to do session limit. Users who create more than the limit will not be able to create new session.

Rgds,

Jones

Hello Jones,

are you talking about the upcoming PAN-OS 4 release ?

rgds

Roland

Yes it is in Nice.

Hi,

"..based on Source IP..." ??

How can I create a policy to rate limit a DoS attack if I don't know the SrcIP?

I thought it could be DstIP based, to control and differentiate better the victivm of attacks, leaving "ANY" as SrcIP.

Is it correct, isn't it?

Thanks

Hi,

The policy will be based on the check on the number of connections per source IP. So you do not need to know the source IP but you can say each source IP cannot have more then x amount of connections.

What you also can check is the sessions that are active. If you reach the limit of session you might want to decrease the timeout on DNS for example. This can lead to a fewer number of active connections.

Marcel

Uhm,

and what about if I need to have different rates for different services, for example 1000 max sessions toward a WEB server and 2000 max sessions toward a DNS server?

And also, If I have 200 different SrcIPs wich make 10 sessions per second each toward the same DstIP I have a total of 2.000 sessions per second but only 10 sessions per second from each SrcIP...so It's not useful to limit by SrcIP, imho.

Does 4.0 achieve this?

So, Can I do DoS policy based on SrcIP, DstIP and application and rate limit all this component?

Thanks

You can build different rules based on the destination address but limit the connections per src-ip. It would be a rule based configuration like you have at the moment for the security rules, nat rules etc.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!