R3303-HP HSR6800 Routers Security Configuration Guide

369
• Each host on segment 192.168.0.0/24 can establish up to 100 connections to external network and
all the other hosts can establish as many connections as possible.
• Permit up to 10000 connections from the external network to the DNS server.
• Permit up to 10000 connections from the external network to the Web server.
Figure 121 Network diagram
Configuration procedure
The following describes only connection limit configuration. For more information about NAT
configuration and internal server configuration, see Layer 3
— IP Services Configuration Guide.
# Create a connection limit policy and enter its view.
<Router> system-view
[Router] connection-limit policy 0
# Configure connection limit rule 0 to limit connections from hosts on segment 192.168.0.0/24 to the
external network per source address, with the upper connection limit of 100.
[Router-connection-limit-policy-0] limit 0 source ip 192.168.0.0 24 destination ip any
protocol ip max-connections 100 per-source
# Configure connection limit rule 1 to limit connections from the external network to the DNS server
192.168.0.3/24, with the upper connection limit of 10000.
[Router-connection-limit-policy-0] limit 1 source ip any destination ip 192.168.0.3 32
protocol dns max-connections 10000
# Configure connection limit rule 2 to limit connections from the external network to the Web server
192.168.0.2/24, with the upper connection limit of 10000.
[Router-connection-limit-policy-0] limit 2 source ip any destination ip 192.168.0.2 32
protocol http max-connections 10000
[Router-connection-limit-policy-0] quit
# Apply the connection limit policy.
[Router] connection-limit apply policy 0
Verifying the configuration
# Use the display connection-limit policy command to display information about the connection limit
policy.
[Router] display connection-limit policy 0