32 ServerIron ADX Security Guide
53-1002440-03
Maximum concurrent connection limit per client
1
Maximum concurrent connection limit per client
This feature restricts each client to a specified number of connections, based on the client’s
subnet, to prevent any one client from using all available connections.

Limiting the number of concurrent connections per client

This feature restricts each client to a specified number of concurrent connections, based on the
client’s subnet, to prevent any one client from using all available connections.
You associate a configured client subnet with a maximum permissible connection value. The
association is stored in the ServerIron by means of a Dynamic Prefix (DP) trie. The key stored in the
DP trie is the associated maximum connection value. The choice of the DP trie for storing the client
subnet allows to define different prefix lengths and subnet masks for each client subnet. Since the
DP trie lookup returns the longest prefix match, it is not required that all configured client subnets
should have the same subnet mask.
Configuring the max connection limit per client consists of the following tasks:
•Configure the maximum connections allowed per client address or prefix
•Applying configured number of maximum connections to a specific VIP

Configure the maximum number of connections

1. Begin by creating a policy set or group by entering commands such as the following.
ServerIronADX(config)#client-connection-limit max-conn1
Syntax: [no] client-connection-limit <name>
Enter a name for the policy set or group for <name>.
Use the no form of the com mand to delete the policy group.
After creating a name, the CLI changes to the config-client-max-conn level.
2. Next, create the policy for maximum number of connections using one of the following
methods.
Create a policy for the maximum number of connections for specific clients
To set a maximum number of connections for a clients in a subnet, enter the a command such as
the following.
ServerIronADX(config)# client-connection-limit max-conn1
ServerIronADX(config-client-max-conn)# max-conn 100.1.1.0 255.255.255.0 10
In the example above, clients with IP addresses in the 100.1.1.0 subnet will be allowed only 10
connections.
Syntax: [no] max-conn [<client-ip-address> <client-subnet-mask> <max-connections>
Enter the clients’ IP address and subnet mask for <client-ip-address> <client-subnet-mask>
Enter a number from 0 to any val ue for <max-connections>. There is not default for this parameter.
Specifying a maximum number of connections for clients not specified in a policy
You can specify a default maximum number of connections for all clients that are not specified in
any max connection group by entering a command such as the following.