Security Features : Configuring the security connection limit
 
Configuring the security connection limit
The security connection limit policy allows or denies traffic based on a matching tuple: source address, destination address, and service; and connection count. The purpose is to detect anomalous connection requests.
The limit you specify can be based on the following counts:
Count of concurrent sessions that match the tuple.
Count of concurrent sessions from a single host that match the tuple.
The FortiADC system evaluates connection limit policy rules before other rules. It matches traffic against the connection limit table, beginning with the first rule. If no rule matches, the connection is forwarded for further processing. If a rule matches, and the limit has not been reached, the connection is forwarded for further processing. If a rule matches and the limit has been reached, the connection is dropped.
By default, if security connection limit rules are not configured, the system does not perform connection limit policy processing.
Note: The purpose of the security connection limit is distinct from the virtual server connection limit. The security connection limit setting is a security setting; the virtual server connection limit is a capacity setting.
Before you begin:
You must have a good understanding and knowledge of the capacity of your backend servers.
You must have created the address configuration objects and service configuration objects that define the matching tuple in your connection limit rules.
You must have Read-Write permission for Firewall settings.
To configure a security connection limit:
1. Go to Security > [Connection Limit | IPv6 Connection Limit].
2. Click Add to display the configuration editor.
3. Complete the configuration as described in Table 38.
4. Save the configuration.
5. Reorder rules, as necessary.
Table 38: Connection limit configuration
Settings
Guidelines
Name
Unique name. No spaces or special characters.
After you initially save the configuration, you cannot edit the name.
Ingress Interface
Select the interface that receives traffic.
Egress Interface
Select the interface that forwards traffic.
Source
Select a source address object to use to form the matching tuple.
Destination
Select a destination address object to use to form the matching tuple.
Service
Select a service object to use to form the matching tuple.
Type
Specify whether the limit is per rule or per host.
Side
When the connection limit is per host, specify whether the connection counter gets incremented when the host IP address appears in:
Source—Only increment the counter if the host is the source address.
Destination—Only increment the counter if the host is the destination address.
Both—Increment the counter if the host is the source or destination address.
Limit
Maximum concurrent sessions. The default is 1,048,576.
Reordering
After you have saved a rule, reorder rules as necessary. The rules table is consulted from top to bottom. The first rule that matches is applied and subsequent rules are not evaluated.