[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]

Setting Destination-Based Session Limits

In addition to the SYN, UDP, and ICMP flood detection and prevention screen options, setting a destination-based session limit can ensure that JUNOS Software allows only an acceptable number of concurrent connection requests—no matter what the source—to reach any one host.

Before You Begin

For background information, read Understanding Session Table Flood Attacks.

In this example, you want to limit the amount of traffic to a Web server at 1.2.2.5. The server is in the DMZ zone. After observing the traffic flow from the external zone to this server for a month, you have determined that the average number of concurrent sessions it receives is 2000. Based on this information, you decide to set the new session limit at 4000 concurrent sessions. Although your observations show that traffic spikes sometimes exceed that limit, you opt for firewall security over occasional server inaccessibility.

To set the destination-session limit, use either J-Web or the CLI configuration editor.

This topic covers:

J-Web Configuration

To configure screens:

  1. Select Configure>CLI Tools>Point and Click CLI.
  2. Next to Security, click Configure or Edit.
  3. Next to Screen, click Configure.
  4. Next to Ids option, click Add new entry.
  5. In the Name box, type 4000-limit-session.
  6. Next to the Limit session, select the check box and click Configure.
  7. In the Destination ip based box, type 4000 and click Commit.
  8. To configure another Destination-ip-based 100, repeat Step d through Step g and click Commit.
  9. To save and commit the configuration, click Commit.

To configure zones:

  1. Select Configure>CLI Tools>Point and Click CLI.
  2. Next to Security, click Configure or Edit.
  3. Next to Zones, click Configure.
  4. Next to Security zone, click Add new entry.
  5. In the Name box, type external_zone.
  6. In the Screen box, type 100-limit-session and click Commit.
  7. To save and commit the configuration, click Commit.

CLI Configuration

user@host# set security screen ids-option 4000-limit-session limit-session destination-ip-based 4000
user@host# set security screen ids-option 100-limit-session limit-session destination-ip-based 100
user@host# set security zones security-zone external_zone screen 100-limit-session

Related Topics

[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]