config security dos http-connection-flood-protection
The HTTP Connection Flood policy enforces a limit on the number of TCP connections from a client, identified by a session cookie. This policy operates at the application layer, leveraging the cookie to track and restrict the connection rate for each client.
Before you begin:
- You must have Read-Write permission for Security settings.
After you have configured HTTP Connection Flood policies, you can reference them in the DoS Protection Profile.
Syntax
config security dos http-connection-flood-protection
edit <name>
set status {enable|disable}
set connect-limit-per-session <integer>
set action {pass|deny|period-block|captcha}
set block-period <integer>
set log {enable|disable}
set severity {high|medium|low}
set max-concurrent-conn <integer>
next
end
|
status |
Enable or disable this HTTP Connection Flood policy. This is disabled by default. |
|
connect-limit-per-session |
Define the maximum number of TCP connections allowed per HTTP session. This limit applies to connections sharing the same session cookie. The default value is set to 1, with an acceptable range of 1-1024. |
|
action |
Specify the action to take when the HTTP Connection Flood policy is triggered.
|
|
block-period |
The block-period option is available is action is period-block. Specify the duration (in seconds) for blocking connections. The default value is 60 seconds, with an acceptable range of 1 to 3600 seconds. During this period, HTTP requests containing the blocked cookie will result in the associated TCP connection being terminated. This blocking action persists even after the FortiADC is rebooted. |
|
log |
Enable or Disable logging. When enabled, the action will be logged. |
|
severity |
Select the severity level.
The default value is high. |
|
max-concurrent-conn |
Specify the shared memory block count allocated for enforcing connection limits. The default value is 100000. |
Example
config security dos http-connection-flood-protection
edit "c1"
set status enable
set connect-limit-per-session 5
set max-concurrent-conn 80000
set action deny
set log enable
set severity medium
next
end