Forum Discussion

Khoa_Le_50892's avatar
Khoa_Le_50892
Icon for Nimbostratus rankNimbostratus
Feb 22, 2011

LTM/ASM DDoS prevention - help

Hi all,

 

 

As I'm newbie with F5 LTM with ASM module, would you please help to guide me on some of issues below:

 

 

 

1. Our setup is some Virtua Servers running on HTTP and HTTPS. Within normal conditions, it's working fine without any problem. When we used a special tool to generate HTTP traffic ( only GET cmd) (around 15000 HTTP_REQUEST) within 10 minutes, it ran for around 1000 requests, after that timeout for 10 request and returned to normal. I'm wondering if LTM has any default configuation for prevention such many requests in short time? We tested by generated the traffic directly to Tomcat server (a member of VS's pool) and no timeout with same test. Any idea on this and how to know which caused the timeout?

 

2. As browsed thru the documentation, I only found how to limit the connections (TCP, UDP) to a VS but not limit the maximum connection from each client to the VS (ex: each clients can only have 100 TCP connections as a time, if the connection exceed, it should be rejected)?

 

 

 

Thank you very much.

 

 

 

Regards,

 

Khoa Le

 

APM
app sec
security

2 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Feb 22, 2011
    Hi Khoa Le,

     

     

    There isn't a hardset limit of connections per client IP address in ASM or LTM.

     

     

    It would be quickest to open a case with F5 Support to get help troubleshooting this issue. They'll be able to review your full configuration and logs to see what is happening.

     

     

    Aaron
  • Ido_Breger_3805's avatar
    Ido_Breger_3805
    Historic F5 Account
    Mar 03, 2011

    Hi,

     

    ASM includes a very unique DOS protection, I encourage you to read th emanual and online help for detailed explanation.

     

    Try to do the test you did with DOS potection enabled and see the results.