Session Limits (Capping)

[#1]

Using FG620B.... I haven' t seen this in documentation or KB, but is anyone aware of method to set and enforce hard/max limit on tcp/udp sessions establishment per node; hoping to mitigate state generation and inspection footprint from " less than healthy" hosts... Thanks in advance for any help/suggestions!

[abelio]

Hello and welcome, i' m not sure if that is your searching for, but wit the new fortiOS 4.x you have resource allocation per VDOM; you can configure global rsource limit to control perfomance impact of something specific and then distribute the resources per vdom. Search admin guide (fortiOS 4.x) for ' system resource-limits' and ' system vdom-property' regards.

[FortiRack_Eric]

Isn' t that were IPS was designed for to deliver? sounds to me that you need to define a DoS rule on the interface to define max udp/tcp/icmp limits per IP. Cheers, Eric

[beaven67]

Yes create a dos policy specific to each address you need to limit. As long as you are running a 4.x.x release should should be able to. Make sure you select the enable check box.