HP VPN Firewall Appliances Access Control Command Reference

98
• ip: Specifies the IP protocol.
• tcp: Specifies the TCP protocol.
• udp: Specifies the UDP protocol.
max-connections max-num: Maximum number of the connections.
The following matrix shows the value range for the max-num argument on different firewalls and firewall
modules:
Hardware Value ran
g
e
F1000-A-EI/F1000-S-EI 1 to 1200000
F1000-E 1 to 500000
F5000 1 to 4000000
F5000-S/F5000-C 1 to 2200000
VPN firewall modules 1 to 2200000
20-Gbps VPN firewall modules 1 to 2200000
per-destination: Limits connections by destination IP address.
per-source: Limits connections by source IP address.
per-source-destination: Limits connections by source-destination IP address pair.
Usage guidelines
The connection limit rules become invalid when the VPN with which the rules are associated are
removed.
The connection limit rules in a policy are matched in ascending order of rule ID. Take the match order into
consideration when assigning the rules IDs. HP recommends you arrange the rule by limit granularity
and limit range in ascending order.
Examples
# Configure connection limit rule 1 for policy 1 to limit the maximum number of TCP connections sourced
f ro m 1.1.1.1.
<Sysname> system-view
[Sysname] connection-limit policy 0
[Sysname-connection-limit-policy-0] limit 1 source ip 1.1.1.1 32 protocol tcp
max-connections 200
# Configure connection limit rule 2 to limit the maximum number of UDP connections destined to 2.2.2.2.
[Sysname-connection-limit-policy-0] limit 2 destination ip 2.2.2.2 32 protocol udp
max-connections 200
# Configure connection limit rule 3 to limit the maximum number of IP connections sourced from each
h o s t o n t h e s e g m e n t 1.1.1.0 / 24 .
[Sysname-connection-limit-policy-0] limit 3 source ip 1.1.1.0 24 protocol ip
max-connections 200 per-source
# Configure connection limit rule 4 to limit the maximum number of IP connections destined to each host
on the segment 2.2.2.0/24.
[Sysname-connection-limit-policy-0] limit 4 destination ip 2.2.2.0 24 protocol ip
max-connections 200 per-destination