Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

CLI Reference

config firewall connlimit

Use this command to create connection limit security rules for IPv4 addresses.

The firewall connection limit policy allows or denies traffic based on a matching tuple: source address, destination address, and service; and connection count. The purpose is to detect anomalous connection requests.

The limit you specify can be based on the following counts:

  • Count of concurrent sessions that match the tuple.
  • Count of concurrent sessions from a single host that match the tuple.

The FortiADC system evaluates firewall connection limit policy rules before other rules. It matches traffic against the connection limit table, beginning with the first rule. If no rule matches, the connection is forwarded for further processing. If a rule matches, and the limit has not been reached, the connection is forwarded for further processing. If a rule matches and the limit has been reached, the connection is dropped.

By default, if firewall connection limit rules are not configured, the system does not perform connection limit policy processing. The firewall connection limit can be configured for non-SLB traffic and for Layer 7 SLB traffic, but not Layer 4 SLB traffic.

Note: The purpose of the firewall connection limit is distinct from the virtual server connection limit. The firewall connection limit setting is a security setting; the virtual server connection limit is a capacity setting.

Before you begin:

  • You must have a good understanding and knowledge of the capacity of your backend servers.
  • You must have created the address configuration objects and service configuration objects that define the matching tuple in your connection limit rules.
  • You must have read-write permission for firewall settings.

Syntax

config firewall connlimit

config rule

edit <name>

set connection-limit <integer>

set destination-address <datasource>

set in-interface <datasource>

set out-interface <datasource>

set service <datasource>

set source-address <datasource>

set type {host | rule}

set side {both | destination | source}

next

end

end

connection-limit

Maximum concurrent sessions. The default is 1,048,576.

destination-address

Destination address object to use to form the matching tuple.

in-interface

Interface that receives traffic.

out-interface

Interface that forwards traffic.

service

Service object to use to form the matching tuple.

source-address

Source address object to use to form the matching tuple.

type

Whether the limit is per rule or per host.

side

When the connection limit is per host, specify whether the connection counter gets incremented when the host IP address appears in:

  • source—Only increment the counter if the host is the source address.
  • destination—Only increment the counter if the host is the destination address.
  • both—Increment the counter if the host is the source or destination address.

Example

FortiADC-VM # config firewall connlimit

FortiADC-VM (connlimit) # config rule

FortiADC-VM (rule) # edit dest-rule

Add new entry 'dest-rule' for node 1890

 

FortiADC-VM (dest-rule) # get

in-interface :

out-interface :

source-address :

destination-address :

service :

type : host

side : both

connection-limit : 1048576

 

FortiADC-VM (dest-rule) # set in-interface port4

FortiADC-VM (dest-rule) # set out-interface port5

FortiADC-VM (dest-rule) # set destination-address fw-dest-addr1

FortiADC-VM (dest-rule) # set service fw-http

FortiADC-VM (dest-rule) # set type rule

FortiADC-VM (dest-rule) # end

 

config firewall connlimit

Use this command to create connection limit security rules for IPv4 addresses.

The firewall connection limit policy allows or denies traffic based on a matching tuple: source address, destination address, and service; and connection count. The purpose is to detect anomalous connection requests.

The limit you specify can be based on the following counts:

  • Count of concurrent sessions that match the tuple.
  • Count of concurrent sessions from a single host that match the tuple.

The FortiADC system evaluates firewall connection limit policy rules before other rules. It matches traffic against the connection limit table, beginning with the first rule. If no rule matches, the connection is forwarded for further processing. If a rule matches, and the limit has not been reached, the connection is forwarded for further processing. If a rule matches and the limit has been reached, the connection is dropped.

By default, if firewall connection limit rules are not configured, the system does not perform connection limit policy processing. The firewall connection limit can be configured for non-SLB traffic and for Layer 7 SLB traffic, but not Layer 4 SLB traffic.

Note: The purpose of the firewall connection limit is distinct from the virtual server connection limit. The firewall connection limit setting is a security setting; the virtual server connection limit is a capacity setting.

Before you begin:

  • You must have a good understanding and knowledge of the capacity of your backend servers.
  • You must have created the address configuration objects and service configuration objects that define the matching tuple in your connection limit rules.
  • You must have read-write permission for firewall settings.

Syntax

config firewall connlimit

config rule

edit <name>

set connection-limit <integer>

set destination-address <datasource>

set in-interface <datasource>

set out-interface <datasource>

set service <datasource>

set source-address <datasource>

set type {host | rule}

set side {both | destination | source}

next

end

end

connection-limit

Maximum concurrent sessions. The default is 1,048,576.

destination-address

Destination address object to use to form the matching tuple.

in-interface

Interface that receives traffic.

out-interface

Interface that forwards traffic.

service

Service object to use to form the matching tuple.

source-address

Source address object to use to form the matching tuple.

type

Whether the limit is per rule or per host.

side

When the connection limit is per host, specify whether the connection counter gets incremented when the host IP address appears in:

  • source—Only increment the counter if the host is the source address.
  • destination—Only increment the counter if the host is the destination address.
  • both—Increment the counter if the host is the source or destination address.

Example

FortiADC-VM # config firewall connlimit

FortiADC-VM (connlimit) # config rule

FortiADC-VM (rule) # edit dest-rule

Add new entry 'dest-rule' for node 1890

 

FortiADC-VM (dest-rule) # get

in-interface :

out-interface :

source-address :

destination-address :

service :

type : host

side : both

connection-limit : 1048576

 

FortiADC-VM (dest-rule) # set in-interface port4

FortiADC-VM (dest-rule) # set out-interface port5

FortiADC-VM (dest-rule) # set destination-address fw-dest-addr1

FortiADC-VM (dest-rule) # set service fw-http

FortiADC-VM (dest-rule) # set type rule

FortiADC-VM (dest-rule) # end