protecting a server with ASA

josephium · ‎07-09-2009

Hi,

i am trying to limit the number of tcp connections to a server to 5000 for example, but when i am setting this with a policy map on the ASA , it is working until the connections are more than 5000, then the drop starts wich is normal, but what is not normal that the already 5000 established connections begin to drop on the server till there is no one connected.

should i set only the embryonic limit without the connection limit to protect the server and let it handle only 5000 simultaneous connections ?

thank you

srue · ‎07-10-2009

in your static nat command (assuming you have one), set the max number of connections to the host.

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s8.html#wp1414075

srue · ‎07-10-2009

btw, you can also set the embryonic limit with that command.

josephium · ‎07-11-2009

thank you for your response, but with this method or with the one i was using , when the limit is reached , the server is loosing his already connected sessions quickly, shouldnt the limit keep new sessions from happening but keep the already established ??