device sends ICMP port unreachable when connection limit is met

[#1]

I don't want this behavior! There does not seem to be any configuration option that relates to the behavior when a server connection limit is met.

I'm doing "server load balancing", from a TCP virtual server to three real servers in a pool. The real servers must have either connection limits or rate limits, due to the application nature. I have observed that when connection limits are reached, the action taken by the ADC device is to send back an ICMP "port unreachable" message to the client attempting to connect to the virtual server. Because of the volume of traffic that is exceeding these limits, a high volume of these ICMP messages are actually causing problems in the environment!

In TCP land, there are generally three actions to be taken by a server when it cannot take another new connection (a SYN packet):

[ul]

do nothing, just drop the new SYN packet

return a TCP RST packet, telling the client it failed

return an ICMP "port unreachable" packet, telling the client it failed[/ul]

The later two choices are considered "fast fail" approaches, because such reply packets are generated immediately, and the client very quickly knows it failed. The first approach will cause the client to stall, as it retries the initial SYN packet again, for some number of retries, and with a progressively longer time between attempts.

My application needs the first approach, and was working just fine before, using a Coyote Point load balancer. The Coyote allowed for some configuration details in this area, while our new ADC device apparently does not.

ANY clues/thoughts greatly appreciated!

Product: FortiADC 100F with 4.7.0 software.