Per ip connection limit on virtual server

Hi awan_m​,

since you didn't specify if you want to limit to 50 connections per virtual server or overall connections to the BIG-IP, I assume per virtual.
Here are two different solutions to achieve a connection rate limit per virtual server:

• K45530602: Limiting the number of connections to a Virtual Server
• K000150453: Limiting the Number of Maximum Connections to a Virtual Server, as per "Source-IP"

If you specify more details, like "I have AFM or AWAF" or "I want to limit overall connections to the BIG-IP" there might be different solutions.

Cheers
Daniel

awan_m​ 

AFM is for filtering traffic. It's not for counting the number of connections to a virtual server.  

I would first try using LTM's rate limiting with the "Per Virtual Server and Source Address" mode. With a source mask of 32 for IPv4 and 128 for IPv6. The "Using the Configuration utility to configure the connection rate limit" in article K44660650 provides a procedure to configure the rate limiting.  

K44660650: Mitigating UDP flood using the virtual server connection rate limit

In the event that the rate limiting on the virtual does not meet your needs. You could create an iRule for the behavoir you require. 

All the Best,

Matthew Wolf

Thankyou both for your replies - and my mistake for NOT clarifying my requirements .

here is my scenario 

i have a application virtual server 

i want to apply per ip connection limit on it . meaning ip address 20.20.20.20 - can have a max of 50 connection , and should never exceed that number.

as i understand - connection limit is total connection on a virtual server - so it is NOT pet source ip .

and rate limit is counted per second - meaning is i apply rate limit of 30 per second - it NOT allow more than 30 sessions in a second but it does not stop sessions slowly increasing to 500.

Hope this clarifies

Thanks 

awan_m​ 

One of the example iRules in the article TheWolf referenced, K000150453, will limit the maximum total number of connections for a source IP address. 

K000150453: Limiting the Number of Maximum Connections to a Virtual Server, as per "Source-IP"

I assume the iRules are supported by F5 support since they are published in KB article.

1. Pick one of the example iRules.
2. Copy and past into your BIG-IP. 
3. Change the threshold value from 10 to 50.  
4. Apply the iRule to the virtual server.

Hope this helps,

Matt

50 L4 connections per client to a vserver is actually a lot.

if your vserver is still in tcp lb mode, change it to http/s mode to make the client to reuse L4 connection for many transactions.