Is it possible to limit concurrent session per Zone or per source IP?

[BSadozai]

Hi Guys.

I was looking to limit session per Zone or per src IP and I found this discussion, so we are in version 4.1.8 and cannot find any option on the QoS to do this limit ?

Thanks for your help

[jleung · Accepted solution]

Hi,

It is not under the QoS setting.

To do this, you need to go to the policy tab and configure the DoS policy. You need to input the source and destination zones you want to apply the control, and choose

- protect instead of allow/any as the action

- classified instead of aggregated as the type of protection

- choose whether you want to consider a counter hit by just the src IP, src IP + Dst IP or just the dst IP

- create the DoS profile, and under the resource protection input the limit

Regards,

Jones

[BSadozai]

Hi,

Thanks for your quick answer.

This is greate.

Regards

[BSadozai]

Hi,
I have just a small question about the DoS profile, for a test I configured the profile with the value below for Syn flood:

Alarm Rate (packets/sec) 50
Activate Rate (packets/sec) 50
Maximal Rate (packets/sec) 800
Block Duration (seconds) 300

After flooding with 100pps I can see on the threat log that syn flood was detected and randomly was dropped, but how about the first value (Alarm Rate) where I should receive the Alarm ? as above I should receive an alarm after 50pps ?

Thanks for your help

Regards