ASA embryonic connections configuration

[jmprats]

Where is it supposed I have to set embryonic limits? in the static command or with a class-map? what is the difference?

and

How can I monitor embryonic connections?

Thanks

[andrew.prince · Accepted solution]

see the below doc

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_connlimits.html

HTH>

[Federico Coto Fajardo · Accepted solution]

Hi,

In the old day of PIXes you set the max embryonic limit in the static or nat commands.

In ASAs today is better to do it via MPF (Modular Policy Framework).

There's no hard limit for max embryonic connections since it depends on your setup.

Using MPF (class-maps) is more flexible and gives you more options than using the static/nat commands.

Can monitor the established or embryonic connections using sh conn or show local-host.

Federico.

[jmprats]

And, one more question

for a server, what limit is supposed to be bigger: max connections or max embryonic?

Because in the configuration guide, we have one example of each case

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_connlimits.html#wp1080734

There is one example with conn-max < embryonic:

set connection conn-max 1000 embryonic-conn-max 3000

and one with conn-max > embryonic:

hostname(config-pmap-c)# set connection conn-max 600

hostname(config-pmap-c)# set connection embryonic-conn-max 50

What is more logical and why?
Thanks

[Federico Coto Fajardo]

The max-connection limit is for the total amount of connections allowed at any given time.
The max-embryonic is for non-fully established TCP connections.

The purpose is different.
A lot of embryonic connections could indicate a TCP SYN attack.

If you set the max-connection limit you could be denying legitimate connections, because it just check for the total
amount.

Federico.