ASA Service Policy Rules

[mudasir05]

Hello All,

I have configured service policy rules on my ASA 5545 :

policy-map CONNS
class AttackingTraffic
inspect http HTTPDOS
set connection conn-max 200000 embryonic-conn-max 10000 per-client-max 300 per-client-embryonic-max 20
set connection timeout idle 1:00:00 dcd 0:15:00 5
user-statistics accounting
class ips_class
user-statistics accounting
ips inline fail-open

===

After applying these rules i don't see any reduction in the total number of connections on ASA...those keep on increasing...also when i add http in Service for inspection then the http service used on the Server is not working and when i remove http the service starts working again.

Kindly let me know where i am wrong.

Thanks

[Flavio Miranda]

Hello,

  How does did you mark the traffic ? Can you show the wrole configuration?

 - If I  helped you somehow, please, rate it as useful.-

[mudasir05]

Hello,

u mean whole configuration of the ASA or just the below one?

CiscoASA# sh run policy-map
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map type inspect http http_inspect
parameters
protocol-violation action drop-connection log
class asdm_high_security_methods
drop-connection
match request header non-ascii
drop-connection
policy-map type inspect http HTTPDOS
parameters
match request uri regex AttackString
drop-connection
match request args regex AttackString
drop-connection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
inspect http http_inspect
class global-class
set connection advanced-options tcp-state-bypass
policy-map CONNS
class AttackingTraffic
inspect http HTTPDOS
set connection conn-max 200000 embryonic-conn-max 10000 per-client-max 300 per-client-embryonic-max 20
set connection timeout idle 0:05:00 dcd 0:15:00 5
user-statistics accounting
class ips_class
user-statistics accounting
ips inline fail-open
!

[Flavio Miranda]

Where are you marking your traffic? Do you have an ACL for that ?

Take a look here:

https://www.networkstraining.com/configuring-connection-limits-on-cisco-asa-firewalls-protect-from-dos/

-If I helped you somehow, please, rate it as useful.-

[mudasir05]

yes i have....pls chk the below lines of config:

access-list HTTPTRAFFIC extended permit tcp any host 192.168.3.16 eq https
access-list HTTPTRAFFIC extended permit tcp any host 192.168.3.17 eq https