Limiting the number of sessions coming from the same IP address

seba · ‎03-31-2003

Is it possible to limit in the Cisco PIX the number of simultaneous sessions established from the same source addess to an internal service?

Thank you in advance

shannong · ‎03-31-2003

The Pix can limit the number of concurrent inboud connections to a particular host but the limit applies to all sources. It is not possible to limit the number of inboud sessions by source IP on the Pix.

seba · ‎03-31-2003

Thank you,

Then, how can I limit the number of concurrent inboud connections to a particular host ?

shannong · ‎03-31-2003

The [static] command used to make hosts available on the outside has two additional parameters at the end to define the maximum number of established connections and the maximum number of half-open sessions.

static (inside,outside) 207.63.69.1 192.168.1.1 netmask 255.255.255.255 50 10

This command would only allow 50 concurrent sessions to this host and only allow 10 half-open sessions. If it's a web server, be careful about setting these numbers very low because opening a single web page can result in serveral sessions being built to make requests.