TCP connection limit

S891 — Tue, 12 Mar 2019 06:04:42 GMT

Hi,

I would like to limit scanning and syn flooding on ASA. I am thinking I can restrict any outside host to only be able to initiate maximum 500 tcp connections total to inside host at a given time it would help prevent syn flood and port scan attacks.

Anyone else done this so please share config. Any other suggestion for scanning and syn-flood attack prevention?

Thanks

Hi,You can refer to this

Vibhor Amrodia — Wed, 10 Jun 2015 09:27:53 GMT

Hi,

You can refer to this document for the complete configuration that you would need:-

http://www.cisco.com/c/en/us/td/docs/security/asa/asa80/configuration/guide/conf_gd/protect.html

You need to use the "per-client-max n" value set to 500

Refer:-

http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s1.html#pgfId-1627430

Example configuration:-

hostname(config)# class-map CONNS

hostname(config-cmap)# match any

hostname(config-cmap)# policy-map CONNS

hostname(config-pmap)# class CONNS

hostname(config-pmap-c)# set connection per-client-max 500

hostname(config-pmap-c)# service-policy CONNS interface outside

NOTE:- Match the specific traffic that you want to match this limit restriction onto.

Thanks and Regards,

Vibhor Amrodia

topic Hi,You can refer to this in Network Security

TCP connection limit

Hi,You can refer to this