SonicOS 7.0 Objects

Download PDF
Technical Documentation > SonicOS 7.0 Objects > DoS Action Profile > Adding DoS Action Profiles > Connection Limiting

Connection Limiting

The Connection Limiting feature is intended to offer an additional layer of security and control when coupled with features such as SYN Cookies and Intrusion Prevention Services (IPS). Connection Limiting provides a means of throttling connections through the firewall using Security Policies as a classifier and declaring the maximum percentage of the total available connection cache that can be allocated to that class of traffic.

Coupled with IPS, this can be used to mitigate the spread of a certain class of malware as exemplified by Sasser, Blaster, and Nimda. These worms propagate by initiating connections to random addresses at atypically high rates. For example, each host infected with Nimda attempted 300 to 400 connections per second, Blaster sent 850 packets per second, and Sasser was capable of 5120 attempts per second. Typical, non-malicious network traffic generally does not establish anywhere near these numbers, particularly when it is Trusted > Untrusted traffic (that is, LAN > WAN). Malicious activity of this sort can consume all available connection‐cache resources in a matter of seconds, particularly on smaller appliances.

In addition to mitigating the propagation of worms and viruses, Connection Limiting can be used to alleviate other types of connection‐cache resource consumption issues, such as those posed by uncompromised internal hosts running peer‐to‐peer software (assuming IPS is configured to allow these services), or internal or external hosts using packet generators or scanning tools.

Finally, Connection Limiting can be used to protect publicly available servers (such as, web servers) by limiting the number of legitimate inbound connections permitted to the server (that is, to protect the server against the Slashdot‐effect). This is different from SYN flood protection that attempts to detect and prevent partially‐open or spoofed TCP connection. This is most applicable for Untrusted traffic, but it can be applied to any zone traffic as needed.

Connection Limiting is applied by defining a percentage of the total maximum allowable connections that might be allocated to a particular type of traffic.

More specific rules can be constructed. For example, to limit the percentage of connections that can be consumed by a certain type of traffic (for example, FTP traffic to any destination on the WAN), or to prioritize important traffic (for example, HTTPS traffic to a critical server) by allowing 100% to that class of traffic, and limiting general traffic to a smaller percentage (minimum allowable value is 1%).

It is not possible to use IPS signatures as a Connection Limiting classifier; only Security Policies (for example, Address Objects and Service Objects) are permissible.

To configure the Connection Limiting of the DoS Action Profile

  1. Navigate to OBJECT | Action Profiles > DoS Action Profile.

  2. Do one of the following:

    • Add a new DoS Action Profile.

      1. Click the Add icon.
      2. Enter a friendly DoS Rule Action Name.

    • Edit an existing DoS Action Profile.

      Hover over an existing DoS Action Profile and click the Edit icon.

  3. Click the Connection Limiting tab.

  4. Enable Connection Limiting.
  5. Configure options and thresholds as necessary.
  6. Click Save.
  7. Click Cancel to go back to the DoS Action Profile page or proceed with other configurations.

Was This Article Helpful?

Help us to improve our support portal

Yes! Not Really

Techdocs Article Helpful form

  • Hidden
  • Hidden

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.
  • Hidden
  • Hidden