For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

rolf's avatar
rolf
Icon for Cirrus rankCirrus
May 28, 2014

Apply a connection rate limit on Virtual Server

regarding F5 support, the connection rate limit on a virtual server which has SSL profile configured, is applied after the defined number of successful connections (SSL) has reached. My customers ser...
application delivery
design
devops
iRules
performance
security
TMOS
Kevin_K_51432's avatar
Kevin_K_51432
Historic F5 Account
May 28, 2014

Hi Rolf, I wonder what "ssl related stuff"? Would be nice to know. One item to consider is the SSL cache. The cache size is 262,144 records and the cache timeout is set to one hour. These figures could be cut down significantly (say half) and the only impact would be; established clients renegotiating more frequently. Pretty painless compared to significant memory exhaustion which affects the device as a whole. Consider; is a 30 minute SSL session (without renegotiation) perhaps with only 130,000 entries too short / small?

 

Session Cache:

 

http://support.f5.com/kb/en-us/solutions/public/6000/700/sol6767.html

 

http://support.f5.com/kb/en-us/solutions/public/11000/100/sol11170.html

 

More info on SSL profile:

 

http://support.f5.com/kb/en-us/solutions/public/14000/700/sol14783.html

 

Kevin