Configuring Vpn Session Limits - Cisco PIX 500 Series Configuration Manual

Configuring VPN Session Limits

hostname(config)# interface GigabitEthernet 0/1
hostname(config-if)# ip address 209.165.202.159 255.255.255.0
hostname(config)# nameif test
hostname(config)# interface GigabitEthernet 0/2
hostname(config-if)# ip address 209.165.201.30 255.255.255.0
hostname(config)# nameif foo
hostname(config)# vpn load-balancing
hostname(config-load-balancing)# nat 192.168.10.10
hostname(config-load-balancing)# priority 9
hostname(config-load-balancing)# interface lbpublic test
hostname(config-load-balancing)# interface lbprivate foo
hostname(config-load-balancing)# cluster ip address 209.165.202.224
hostname(config-load-balancing)# cluster key 123456789
hostname(config-load-balancing)# cluster encryption
hostname(config-load-balancing)# cluster port 9023
hostname(config-load-balancing)# redirect-fqdn enable
hostname(config-load-balancing)# participate
Configuring VPN Session Limits
You can run as many IPSec and WebVPN sessions as your platform and license for the security appliance
supports. To view the licensing information for your security appliance, enter the show version
command in global configuration mode. The following example shows the command and the licensing
information excerpted from the output of this command:
hostname(config)# show version
Cisco Adaptive Security Appliance Software Version 7.1(0)182
Device Manager Version 5.1(0)128
Licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs
Inside Hosts
Failover
VPN-DES
VPN-3DES-AES
Security Contexts
GTP/GPRS
VPN Peers
WebVPN Peers
This platform has an ASA 5520 VPN Plus license.
To limit the maximum number of active IPSec VPN sessions to a lower value than the security appliance
allows, enter the vpn-sessiondb max-session-limit command in global configuration mode. This limit
affects the calculated load percentage for VPN Load Balancing.
hostname(config)# vpn-sessiondb max-session-limit number_of_sessions
hostname(config)#
For example, if the security appliance license allows 750 IPSec sessions, and you want to limit the
number of IPSec sessions to 500, enter the following command:
hostname(config)# vpn-sessiondb max-session-limit 500
hostname(config)#
Cisco Security Appliance Command Line Configuration Guide
29-12
: 100
: Unlimited
: Active/Active
: Enabled
: Enabled
: 10
: Enabled
: 750
: 500
Chapter 29 Setting General IPSec VPN Parameters
OL-12172-03