The firewall connection limit policy allows or denies traffic based on a matching tuple: source address, destination address, and service; and connection count. The purpose is to detect anomalous connection requests.
The limit you specify can be based on the following counts:
The FortiADC system evaluates firewall connection limit policy rules before other rules. It matches traffic against the connection limit table, beginning with the first rule. If no rule matches, the connection is forwarded for further processing. If a rule matches, and the limit has not been reached, the connection is forwarded for further processing. If a rule matches and the limit has been reached, the connection is dropped.
By default, if firewall connection limit rules are not configured, the system does not perform connection limit policy processing. The firewall connection limit can be configured for non-SLB traffic and for Layer 7 SLB traffic, but not Layer 4 SLB traffic.
Note: The purpose of the firewall connection limit is distinct from the virtual server connection limit. The firewall connection limit setting is a security setting; the virtual server connection limit is a capacity setting.
Before you begin:
Settings | Guidelines |
Name |
Configuration name. Valid characters are After you initially save the configuration, you cannot edit the name. |
Ingress Interface |
Select the interface that receives traffic. |
Egress Interface |
Select the interface that forwards traffic. |
Source |
Select a source address object to use to form the matching tuple. |
Destination |
Select a destination address object to use to form the matching tuple. |
Service |
Select a service object to use to form the matching tuple. |
Type |
Specify whether the limit is per rule or per host. |
Side |
When the connection limit is per host, specify whether the connection counter gets incremented when the host IP address appears in:
|
Limit |
Maximum concurrent sessions. The default is 1,048,576. |
Reordering |
|
|
After you have saved a rule, reorder rules as necessary. The rules table is consulted from top to bottom. The first rule that matches is applied and subsequent rules are not evaluated. |