On PiX running 6.3, you can do it using the options max_conns /emb_limit of the static command.
But pix6.3 does not verify the TCP checksum of packets transiting through the firewall. It holds the half-open TCP connection open until the embryonic timeout in 2mins.
Because the firewall is holding a connection open, any additional packets with the same protocol, IP addresses, and ports will be treated as part of the existing half-open connection. In this case, a legitimate SYN packet following the malformed SYN will be discarded because it is outside of the window of acceptable sequence numbers established by the malformed packet.
However, if you upgrade to 7.0 or above then you can try something like this to check for tcp connections coming on any interface of the PIX.
access-list TCP-ACL permit tcp any any
class-map TCPX
match access-list TCP-ACL
policy-map global_policy
class TCPX
set connection conn-max 500
set connection embryonic-conn-max 200
set connection timeout embryonic 0:00:10
service-policy global_policy global
-------------------
You can refer this doc.
http://www.cisco.com/warp/public/707/cisco-sr-20051128-pix.shtml
Hope this helps.
