ASA connection limit recommendations

Answered Question
Sep 16th, 2010
User Badges:

I am looking to set appropriate per-client-max and per-client-max-embryonic connections limit.  I have the service policy in place, and can see what gets dropped, but would like better detail, simliar to how you can get it from a router inspect stats:




router#show ip inspect statistics


Maxever session counts (estab/half-open/terminating) [48:12:5]



Any way?


Thanks,


Jason

Correct Answer by praprama about 6 years 9 months ago

Hi Jason,


The "show local-host" command should help you with this. If you need more detail, you can use this command with the detail keyword. Details of the command are available below:


http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s4.html#wp1447764


There are other opetions available in the command as well which might help you.


Let me know if this helps!!


Regards,

Prapanch

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
praprama Thu, 09/16/2010 - 08:56
User Badges:
  • Cisco Employee,

Hi Jason,


The "show local-host" command should help you with this. If you need more detail, you can use this command with the detail keyword. Details of the command are available below:


http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s4.html#wp1447764


There are other opetions available in the command as well which might help you.


Let me know if this helps!!


Regards,

Prapanch

jbeltrame Thu, 09/16/2010 - 10:46
User Badges:

The problem with the local-host command, is that it only shows current status.  It doesn't show the max embryonic connections encountered.  I can get the max connections, though not max encountered per host would be nice, though the sh conn or sh resource usages.  I'd like to be able to get a max embryonic encounted counter.  That would help better in determining what is a good per client embryonic limit.


Thanks,


Jason

Actions

This Discussion