11-5
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 11 Connection Settings
Configure Connection Settings
Note
Ensure that you set the embryonic connection limit lower than the TCP SYN backlog queue on the server
that you want to protect. Otherwise, valid clients can no longer access the server during a SYN attack.
To determine reasonable values for embryonic limits, carefully analyze the capacity of the server, the
network, and server usage.
The end-to-end process for protecting a server from a SYN flood attack involves setting connection
limits, enabling TCP Intercept statistics, and then monitoring the results.
Before You Begin
•
Ensure that you set the embryonic connection limit lower than the TCP SYN backlog queue on the
server that you want to protect. Otherwise, valid clients can no longer access the server during a
SYN attack. To determine reasonable values for embryonic limits, carefully analyze the capacity of
the server, the network, and server usage.
•
Depending on the number of CPU cores on your ASA model, the maximum concurrent and
embryonic connections can exceed the configured numbers due to the way each core manages
connections. In the worst case scenario, the ASA allows up to
n
-1 extra connections and embryonic
connections, where
n
is the number of cores. For example, if your model has 4 cores, if you
configure 6 concurrent connections and 4 embryonic connections, you could have an additional 3 of
each type. To determine the number of cores for your model, enter the
show cpu core
command.
Procedure
Step 1
Create an L3/L4 class map to identify the servers you are protecting. Use an access-list match.
class-map
name
match
parameter
Example:
hostname(config)#
access-list servers extended permit tcp any host 10.1.1.5 eq http
hostname(config)#
access-list servers extended permit tcp any host 10.1.1.6 eq http
hostname(config)#
class-map protected-servers
hostname(config-cmap)#
match access-list servers
Step 2
Add or edit a policy map that sets the actions to take with the class map traffic, and identify the class
map.
policy-map
name
class
name
Example:
hostname(config)# policy-map global_policy
hostname(config-pmap)# class protected-servers
In the default configuration, the global_policy policy map is assigned globally to all interfaces. If you
want to edit the global_policy, enter global_policy as the policy name. For the class map, specify the
class you created earlier in this procedure.
Step 3
Set the embryonic connection limits.
•
set connection embryonic-conn-max
n—The maximum number of simultaneous embryonic
connections allowed, between 0 and 2000000. The default is 0, which allows unlimited connections.
Содержание ASA 5512-X
Страница 5: ...P A R T 1 Service Policies and Access Control ...
Страница 6: ......
Страница 50: ...3 14 Cisco ASA Series Firewall CLI Configuration Guide Chapter 3 Access Rules History for Access Rules ...
Страница 51: ...P A R T 2 Network Address Translation ...
Страница 52: ......
Страница 126: ...5 28 Cisco ASA Series Firewall CLI Configuration Guide Chapter 5 NAT Examples and Reference DNS and NAT ...
Страница 127: ...P A R T 3 Application Inspection ...
Страница 128: ......
Страница 255: ...P A R T 4 Connection Settings and Quality of Service ...
Страница 256: ......
Страница 288: ...12 14 Cisco ASA Series Firewall CLI Configuration Guide Chapter 12 Quality of Service History for QoS ...
Страница 303: ...P A R T 5 Advanced Network Protection ...
Страница 304: ......
Страница 339: ...P A R T 6 ASA Modules ...
Страница 340: ......
Страница 398: ...17 28 Cisco ASA Series Firewall CLI Configuration Guide Chapter 17 ASA CX Module History for the ASA CX Module ...