R3166-R3206-HP High-End Firewalls Access Control Configuration Guide-6PW101

Connection limit configuration example

Network requirements

As shown in Figure 66, a company has five public IP addresses: 202.38.1.1/24 to 202.38.1.5/24. The

internal network address is 192.168.0.0/16 and there are two servers on the internal network. Perform

NAT configuration so that the internal users can access the Internet and external users can access the

internal servers, and configure connection limiting so that:

• Each host on segment 192.168.0.0/24 can establish up to 100 connections to external network and

all the other hosts can establish as many connections as possible.

• Permit up to 10000 connections from the external network to the DNS server.

• Permit up to 10000 connections from the external network to the web server.

Figure 66 Network diagram for connection limiting

Configuration procedure

NOTE:

The following describes only connection limit configuraiton steps. For instructions about NAT

configuration and internal server configuration, see

NAT and ALG Configuration Guide

# Create a connection limit policy and enter its view.

<Firewall> system-view

[Firewall] connection-limit policy 0

# Configure connection limit rule 0 to limit connections from hosts on segment 192.168.0.0/24 to the

external network per source address, with the upper connection limit of 100.

[Firewall-connection-limit-policy-0] limit 0 source ip 192.168.0.0 24 destination ip any

protocol ip max-connections 100 per-source

# Configure connection limit rule 1 to limit connections from the external network to the DNS server

192.168.0.3/24, with the upper connection limit of 10000.

[Firewall-connection-limit-policy-0] limit 1 source ip any destination ip 192.168.0.3 32

protocol dns max-connections 10000

# Configure connection limit rule 2 to limit connections from the external network to the web server

192.168.0.2/24, with the upper connection limit of 10000.

[Firewall-connection-limit-policy-0] limit 2 source ip any destination ip 192.168.0.2 32

protocol http max-connections 10000

[Firewall-connection-limit-policy-0] quit

# Apply the connection limit policy.