Troubleshooting Connection Limits Acls In The Connection Limit Rules With Overlapping Segments - HP VSR1000 Security Configuration Manual

Troubleshooting connection limits ACLs in the
connection limit rules with overlapping segments
Symptom
A connection limit policy has two rules. One rule sets the upper limit to 10 for the connections from each
host on segment 192.168.0.0/24, and the other sets the upper limit to 100 for the connections from
192.168.0.100/24.
<Router> system-view
[Router] acl number 2001
[Router-acl-basic-2001] rule permit source 192.168.0.0 0.0.0.255
[Router-acl-basic-2001] quit
[Router] acl number 2002
[Router-acl-basic-2002] rule permit source 192.168.0.100 0
[Router-acl-basic-2002] quit
[Router] connection-limit policy 1
[Router-connlmt-policy-1] limit 1 acl 2001 per-destination amount 10 5
[Router-connlmt-policy-1] limit 2 acl 2002 per-destination amount 100 10
As a result, the host at 192.168.0.100 can only initiate up to 10 connections to the external network.
Analysis
Both limit rules 1 and 2 contain IP address 192.168.0.100. Limit rule 1 is first matched and takes effect to
limit connections from 192.168.0.100.
Solution
Rearrange the two connection limit rules by exchanging their rule IDs.
312