conf/protection
The conf/protection directory contains configuration files for service protection classes. The name of a file is the name of the protection class it defines. Service protection classes can be configured under the Catalogs > Protection section of the Admin Server UI or by using functions under the Catalog.Protection section of the SOAP API and CLI.
Key | Description |
|---|---|
allowed | Always allow access to these IP addresses. This overrides the connection limits for these machines, but does not stop other restrictions such as HTTP validity checks. Value type: list Default value: <none> |
banned | Disallow access to these IP addresses. Value type: list Default value: <none> |
debug | Whether or not to output verbose logging. Value type: Yes / No Default value: "No" |
enabled | Enable or disable this service protection class. Value type: Yes / No Default value: "Yes" |
http!check_rfc2396 | Whether or not requests with poorly-formed URLs be should be rejected. This tests URL compliance as defined in RFC2396. Note that enabling this may block some older, non-conforming web browsers. Value type: Yes / No Default value: "No" |
http!max_body_length | Maximum permitted length of HTTP request body data, set to 0 to disable the limit. Value type: bytes Default value: "0" |
http!max_header_length | Maximum permitted length of a single HTTP request header (key and value), set to 0 to disable the limit. Value type: bytes Default value: "0" |
http!max_request_length | Maximum permitted size of all the HTTP request headers, set to 0 to disable the limit. Value type: bytes Default value: "0" |
http!max_url_length | Maximum permitted URL length, set to 0 to disable the limit. Value type: bytes Default value: "0" |
http!reject_binary | Whether or not URLs and HTTP request headers that contain binary data (after decoding) should be rejected. Value type: Yes / No Default value: "No" |
http!send_error_page | This setting tells the traffic manager to send an HTTP error message if a connection fails the service protection tests, instead of just dropping it. Details of which HTTP response will be sent when particular tests fail can be found in the Help section for this page. Value type: Yes / No Default value: "Yes" |
log_time | Log service protection messages at these intervals. If set to 0 no messages will be logged and no alerts will be sent. Value type: seconds Default value: "60" |
max_10_connections | Additional limit on maximum concurrent connections from the top 10 busiest connecting IP addresses combined. The value should be between 1 and 10 times the max_1_connections limit. (This limit is disabled if per_process_connection_count is No, or max_1_connections is 0, or min_connections is 0.) Value type: unsigned integer Default value: "200" |
max_1_connections | Maximum concurrent connections each connecting IP address is allowed. Set to 0 to disable this limit. Value type: unsigned integer Default value: "30" |
max_connection_rate | Maximum number of new connections each connecting IP address is allowed to make in the rate_timer interval. Set to 0 to disable this limit. If applied to an HTTP Virtual Server each request sent on a connection that is kept alive counts as a new connection. The rate limit is per process: each process within a Traffic Manager accepts new connections from the connecting IP address at this rate. (Each Traffic Manager typically has several processes: one process per available CPU core). Value type: unsigned integer Default value: "0" |
min_connections | Entry threshold for the max_10_connections limit: the max_10_connections limit is not applied to connecting IP addresses with this many or fewer concurrent connections. Setting to 0 disables both the max_1_connections and max_10_connections limits, if per_process_connection_count is Yes. (If per_process_connection_count is No, this setting is ignored.) Value type: unsigned integer Default value: "4" |
note | A description of the service protection class. Value type: string Default value: <none> |
per_process_connection_count | Whether concurrent connection counting and limits are per-process. (Each Traffic Manager typically has several processes: one process per available CPU core.) If Yes, a connecting IP address may make that many connections to each process within a Traffic Manager. If No, a connecting IP address may make that many connections to each Traffic Manager as a whole. Value type: Yes / No Default value: "Yes" |
rate_timer | How frequently the max_connection_rate is assessed. For example, a value of 1 (second) will impose a limit of max_connection_rate connections per second; a value of 60 will impose a limit of max_connection_rate connections per minute. The valid range is 1-99999 seconds. Value type: seconds Default value: "60" |
rule | A TrafficScript rule that will be run on the connection after the service protection criteria have been evaluated. This rule will be executed prior to normal rules configured for the virtual server. Value type: string Default value: <none> |
testing | Place the service protection class into testing mode. (Log when this class would have dropped a connection, but allow all connections through). Value type: Yes / No Default value: "No" |