Troubleshooting Connection Limiting; Connection Limit Rules With Overlapping Segments; Connection Limit Rules With Overlapping Protocol Types - HP A6600 Configuration Manual

limit 1 source ip any destination ip 192.168.0.3 32 protocol dns max-connections 10000
limit 2 source ip any destination ip 192.168.0.2 32 protocol http max-connections 10000

Troubleshooting connection limiting

Connection limit rules with overlapping segments

Symptom
On the router, create a connection limit policy, and configure two rules for the policy. One limits
connections from each host on segment 192.168.0.0/24 with the upper connection limit 10, and
another limits connections from 192.168.0.100 with the upper connection limit 100.
[Router-connection-limit-policy-0] limit 0 source ip 192.168.0.0 24 destination ip any
protocol ip max-connections 10 per-source
[Router-connection-limit-policy-0] limit 1 source ip 192.168.0.100 32 destination ip any
protocol ip max-connections 100 per-source
With the configuration, the host 192.168.0.100 can only initiate up to 10 connections to the external
network.
Analysis
Both rules limit 0 and limit 1 contain the IP address 192.168.0.100, and the rule with a smaller ID is
matched first. Rule 0 is used for connections from 192.168.0.100.
Solution
Rearrange the two connection limit rules by exchanging their rule IDs so that the rule for the host is
matched first.

Connection limit rules with overlapping protocol types

Symptom
Internal server 192.168.0.100 provides both Web and FTP services for external users. On the router,
create a connection limit policy and configure two rules, one limiting TCP connections to the server with
the upper limit 100 and the second limiting HTTP connections to the server with the upper limit 10,000.
[Router-connection-limit-policy-0] limit 0 source ip any destination ip 192.168.0.100
protocol tcp max-connections 100
[Router-connection-limit-policy-0] limit 1 source ip any destination ip 192.168.0.100
protocol http max-connections 10000
With the configuration, 100 HTTP connections to the server can be established at most.
Analysis
Both rules limit 0 and limit 1 involve HTTP connections, and the rule with a smaller ID is matched first.
Rule 0 is used for HTTP connections.
Solution
Rearrange the two connection limit rules by exchanging their rule IDs so that the rule for HTTP
connections is matched first.
373