Connection limit commands -- connection-limit

Use connection-limit to create a connection limit policy and enter its view, or enter the view of an existing connection limit policy.

Use undo connection-limit to delete a connection limit policy.

Syntax

connection-limit { ipv6-policy | policy } policy-id

undo connection-limit { ipv6-policy | policy } policy-id

Default

No connection limit policies exist.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

ipv6-policy: Specifies an IPv6 connection limit policy.

policy: Specifies an IPv4 connection limit policy.

policy-id: Specifies the ID of a connection limit policy. An IPv4 or IPv6 connection limit policy has its own number. The value for this argument varies by device model.

Examples

# Create IPv4 connection limit policy 1 and enter its view.

<Sysname> system-view

[Sysname] connection-limit policy 1

[Sysname-connlmt-policy-1]

# Create IPv6 connection limit policy 12 and enter its view.

<Sysname> system-view

[Sysname] connection-limit ipv6-policy 12

[Sysname-connlmt-ipv6-policy-12]

Related commands

connection-limit apply

connection-limit apply global

display connection-limit

limit

Connection limit commands -- connection-limit amount

Use connection-limit amount to configure the maximum number of user connections.

Use undo connection-limit amount to restore the default.

Syntax

connection-limit amount amount

undo connection-limit amount

Default

The number of user connections is not limited.

Views

User profile view

Predefined user roles

network-admin

mdc-admin

Parameters

amount: Specifies the maximum number of user connections, in the range of 1 to 10000. New connections are not allowed when the maximum number is reached.

Usage guidelines

If you execute this command multiple times, the most recent configuration takes effect. After you execute this command, the configuration takes effect immediately.

When a user profile on the device is deleted, the associated users will be no longer restricted by the settings in the user profile.

Examples

# Create a user profile named abc and enter its view.

<Sysname> system-view

[Sysname] user-profile abc

# Set the maximum number of user connections to 5.

[Sysname-user-profile-abc] connection-limit amount 5

Related commands

display user-profile

Connection limit commands -- connection-limit apply

| NOTE: Support for this command depends on the device model.

Use connection-limit apply to apply a connection limit policy to an interface.

Use undo connection-limit apply to remove a connection limit policy from an interface.

Syntax

connection-limit apply { ipv6-policy | policy } policy-id

undo connection-limit apply { ipv6-policy | policy }

Default

No connection limit policy is applied to an interface.

Views

Interface view

Predefined user roles

network-admin

mdc-admin

Parameters

ipv6-policy: Specifies an IPv6 connection limit policy.

policy: Specifies an IPv4 connection limit policy.

policy-id: Specifies the ID of a connection limit policy. The value range for this argument varies by device model.

Usage guidelines

Only one IPv4 connection limit policy and one IPv6 connection limit policy can be applied to an interface. A new IPv4 or IPv6 connection limit policy overwrites the old one.

Examples

# Apply IPv4 connection limit policy 1 to GigabitEthernet 1/0/1. (Applicable to routers.)

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] connection-limit apply policy 1

# Apply IPv6 connection limit policy 12 to GigabitEthernet 1/0/1. (Applicable to routers.)

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] connection-limit apply ipv6-policy 12

# Apply IPv4 connection limit policy 1 to VLAN-interface 2. (Applicable to switches.)

<Sysname> system-view

[Sysname] interface vlan-interface 2

[Sysname-Vlan-interface2] connection-limit apply policy 1

# Apply IPv6 connection limit policy 12 to VLAN-interface 2. (Applicable to switches.)

<Sysname> system-view

[Sysname] interface vlan-interface 2

[Sysname-Vlan-interface2] connection-limit apply ipv6-policy 12

Related commands

connection-limit

limit

Connection limit commands -- connection-limit apply global

Use connection-limit apply global to apply a connection limit policy globally.

Use undo connection-limit apply global to remove the application.

Syntax

connection-limit apply global { ipv6-policy | policy } policy-id

undo connection-limit apply global { ipv6-policy | policy }

Default

No connection limit policy is applied globally.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

ipv6-policy: Specifies an IPv6 connection limit policy.

policy: Specifies an IPv4 connection limit policy.

policy-id: Specifies the ID of a connection limit policy. The value range for this argument varies by device model.

Usage guidelines

Only one IPv4 connection limit policy and one IPv6 connection limit policy can be applied globally. A new IPv4 or IPv6 connection limit policy overwrites the old one.

Examples

# Apply IPv4 connection limit policy 1 globally.

<Sysname> system-view

[Sysname] connection-limit apply global policy 1

# Apply IPv6 connection limit policy 12 globally.

<Sysname> system-view

[Sysname] connection-limit apply global ipv6-policy 12

Related commands

connection-limit

limit

Connection limit commands -- connection-limit rate

Use connection-limit rate to configure the maximum connection establishment rate.

Use undo connection-limit rate to restore the default.

Syntax

connection-limit rate rate

undo connection-limit rate

Default

The connection establishment rate is not limited.

Views

User profile view

Predefined user roles

network-admin

mdc-admin

Parameters

rate: Specifies the maximum connection establishment rate per second, in the range of 5 to 1000. New connections are not allowed when the maximum rate is reached.

Usage guidelines

If you execute this command multiple times, the most recent configuration takes effect. After you execute this command, the configuration takes effect immediately.

When a user profile on the device is deleted, the associated users will be no longer restricted by the settings in the user profile.

Examples

# Create a user profile named abc and enter its view.

<Sysname> system-view

[Sysname] user-profile abc

# Set the maximum connection establishment rate to 100 per second.

[Sysname-user-profile-abc] connection-limit rate 100

Related commands

display user-profile

Connection limit commands -- description

| NOTE: Support for this command depends on the device model.

Use description to configure a description for a connection limit policy.

Use undo description to restore the default.

Syntax

description text

undo description

Default

A connection limit policy does not have a description.

Views

IPv4 connection limit policy view

IPv6 connection limit policy view

Predefined user roles

network-admin

mdc-admin

Parameters

text: Specifies a description, a case-sensitive string of 1 to 127 characters.

Usage guidelines

If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Configure the description as CenterToA for IPv4 connection limit policy 1.

<Sysname> system-view

[Sysname] connection-limit policy 1

[Sysname-connlmt-policy-1] description CenterToA

Related commands

display connection-limit

Connection limit commands -- display connection-limit

| NOTE: Support for this command depends on the device model.

Use display connection-limit to display information about connection limit policies.

Syntax

display connection-limit { ipv6-policy | policy } { policy-id | all }

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

ipv6-policy: Specifies an IPv6 connection limit policy.

policy: Specifies an IPv4 connection limit policy.

policy-id: Specifies a connection limit policy by its ID. The value range for this argument varies by device model.

all: Specifies all connection limit policies.

Examples

# Display information about all IPv4 connection limit policies.

<Sysname> display connection-limit policy all

3 policies in total:

Policy Rule Stat Type HiThres LoThres ACL

--------------------------------------------------------------------------------

0 1 Src-Dst-Port 2000 1800 3000

12 Src-Dst 500 45 3001

255 -- 1000000 980000 2001

1 2 Dst-Port 800 70 3010

3 Src-Dst 100 90 3000

10 Src-Dst-Port 50 45 3003

11 Src 200 200 3004

200 -- 500000 498000 2002

28 4 Port 1500 1400 3100

5 Dst 3000 280 3101

21 Src-Dst 200 180 3102

25 Src-Port 50 35 3200

Description list:

Policy Description

--------------------------------------------------------------------------------

1 IPv4Description1

28 Description for IPv4 28

# Display information about IPv4 connection limit policy 1.

<Sysname> display connection-limit policy 1

IPv4 connection limit policy 1 has been applied 5 times, and has 5 limit rules.

Description: IPv4Description1

Limit rule list:

Policy Rule Stat Type HiThres LoThres ACL

--------------------------------------------------------------------------------

1 2 Dst-Port 800 700 3010

3 Src-Dst 100 90 3000

10 Src-Dst-Port 50 45 3003

11 Src 200 200 3004

200 -- 500000 498000 2002

Application list:

GigabitEthernet1/0/1

GigabitEthernet1/0/2

Vlan-interface1

Tunnel0

Global

# Display information about all IPv6 connection limit policies.

<Sysname> display connection-limit ipv6-policy all

2 policies in total:

Policy Rule Stat Type HiThres LoThres ACL

--------------------------------------------------------------------------------

3 1 Src-Dst 1000 800 3010

2 Dst 500 450 3001

4 2 Src-Dst-Port 800 700 3010

3 Src 100 90 3020

200 -- 100000 89000 2005

Description list:

Policy Description

--------------------------------------------------------------------------------

3 IPv6Description3

4 Description for IPv6 4

# Display information about IPv6 connection limit policy 3.

<Sysname> display connection-limit ipv6-policy 3

IPv6 connection limit policy 3 has been applied 3 times, and has 2 limit rules.

Description: IPv6Description3

Limit rule list:

Policy Rule Stat Type HiThres LoThres ACL

--------------------------------------------------------------------------------

3 1 Src-Dst 1000 800 3010

2 Dst 500 450 3001

Application list:

GigabitEthernet1/0/1

Vlan-interface1

Tunnel0

Table 1 Command output

Field | Description
Limit rule list | Connection limit policy information.
Policy | Number of the connection limit policy.
Rule | Number of the connection limit rule.
Stat Type | Statistics types: · Src-Dst-Port—Limits connections by source IP, destination IP, and service combination. · Src-Dst—Limits connections by source IP address and destination IP address combination. · Src-Port—Limits connections by source IP and service combination. · Dst-Port—Limits connections by destination IP and service combination. · Src—Limits connections by source IP address. · Dst—Limits connections by destination IP address. · Port—Limits connections by service. · Dslite—Limits connections by B4 device of a DS-Lite tunnel. · --—Limits connections not by a specific IP address or service. All connections that match the ACL used by the rule are limited.
HiThres | Upper limit of the connections.
LoThres | Lower limit of the connections.
ACL | Number or name of the ACL used by the rule.
Application list | Application list of the connection limit policy, including interface name and Global. Global indicates that the connection limit policy is applied globally.
Description | Connection limit policy description.
Description list | List of connection limit policy descriptions.

Related commands

connection-limit

connection-limit apply

connection-limit apply global

limit

Connection limit commands -- display connection-limit ipv6-stat-nodes

| NOTE: Support for this command depends on the device model.

Use display connection-limit ipv6-stat-nodes to display statistics about IPv6 connections that match connection limit rules globally or on an interface.

Syntax

Centralized devices:

display connection-limit ipv6-stat-nodes { global | interface interface-type interface-number } [ destination destination-ip | service-port port-number | source source-ip ] * [ count ]

Distributed devices in standalone mode:Centralized IRF devices:

display connection-limit ipv6-stat-nodes { global | interface interface-type interface-number } [ slot slot-number [ cpu cpu-number ] ] [ destination destination-ip | service-port port-number | source source-ip ] * [ count ]

Distributed devices in IRF mode:

display connection-limit ipv6-stat-nodes { global | interface interface-type interface-number } [ chassis chassis-number slot slot-number [ cpu cpu-number ] ] [ destination destination-ip | service-port port-number | source source-ip ] * [ count ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

global: Displays statistics about IPv6 connections that match connection limit rules globally.

interface interface-type interface-number: Specifies an interface by its type and number.

slot slot-number: Specifies a card by its slot number. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN interface or tunnel interface. (Distributed devices in standalone mode.)

slot slot-number: Specifies an IRF member device by its member ID. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN-interface and tunnel interface. (Centralized IRF devices.) (IRF 3 incapable.)

slot slot-number: Specifies an IRF member device by its member ID or specifies a PEX by its virtual slot number. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN-interface and tunnel interface. (Centralized IRF devices.) (IRF 3 capable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN interface or tunnel interface. (Distributed devices in IRF mode.) (IRF 3 incapable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device or specifies a PEX. The chassis-number argument represents the member ID of the IRF member device or the virtual chassis number of the PEX. The slot-number argument represents the slot number of the card or PEX. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN interface or tunnel interface. (Distributed devices in IRF mode.) (IRF 3 capable.)

cpu cpu-number: Specifies a CPU by its number. This option is available only if multiple CPUs are available on the specified slot. Support for this option depends on the device model.

destination destination-ip: Specifies a destination by its IP address.

service-port port-number: Specifies a service port by its port number.

source source-ip: Specifies a source by its IP address.

count: Displays only the number of limit rule-based statistics sets. Detailed information about the specified IPv6 connections is not displayed. If you do not specify this keyword, the command displays detailed information about the specified IPv6 connections that match connection limit rules.

Usage guidelines

The statistics for this command include the following information:

· Connection information, including the source/destination IP address, service port, and transport layer protocol of connections.

· Matching connection limit rules.

· Number of current connections.

· Whether or not new connections can be created.

To further filter the output statistics, specify the following options in the command:

· source source-ip.

· destination destination-ip.

· service-port port-number.

For example, if you specify the source source-ip and destination destination-ip combination, this command displays statistics about IPv6 connections that match connection limit rules by source IP address and destination IP address.

If you specify none of the source source-ip, destination destination-ip, and service-port port-number options, this command displays statistics about all IPv6 connections that match connection limit rules.

Deleting or modifying an IPv6 connection limit policy will not delete the effective IPv6 connection limit rule-based statistics sets. An IPv6 connection limit rule-based statistics set will be automatically deleted after all the IPv6 connections for the set are disconnected.

Examples

# Display the number of global limit rule-based statistics sets that match the source IP address 2::1.

<Sysname> display connection-limit ipv6-stat-nodes global source 2::1 count

Current limit statistic nodes count is 16.

# (Distributed devices in standalone mode.) (Centralized IRF devices.) Display statistics about IPv6 connections that match the global connection limit rule on the specified slot.

<Sysname> display connection-limit ipv6-stat-nodes global slot 1

Slot 1:

Src IP address : Any

VPN instance : --

Dst IP address : Any

VPN instance : --

DS-Lite tunnel peer : --

Service : icmp/0

Limit rule ID : 22(ACL: 3666)

Sessions threshold Hi/Lo: 3500/3000

Sessions count : 3100

New session flag : Permit

# (Centralized devices.) Display statistics about IPv6 connections that match the connection limit rule on the specified interface. (Applicable to routers.)

<Sysname> display connection-limit ipv6-stat-nodes interface gigabitethernet 1/0/1

Src IP address : Any

VPN instance : vpn5

Dst IP address : fe80::5ed9:98ff:feb1:69b6

VPN instance : abcdefghijklmnopqrstuvwxyzabcde

DS-Lite tunnel peer : 9876543210

Service : tcp/12345

Limit rule ID : 12345(ACL: 3184)

Sessions threshold Hi/Lo: 1000000/90000

Sessions count : 150000

New session flag : Permit

# (Centralized devices.) Display statistics about IPv6 connections that match the connection limit rule on the specified interface. (Applicable to switches.)

<Sysname> display connection-limit ipv6-stat-nodes interface vlan-interface 2

Src IP address : Any

VPN instance : vpn5

Dst IP address : fe80::5ed9:98ff:feb1:69b6

VPN instance : abcdefghijklmnopqrstuvwxyzabcde

DS-Lite tunnel peer : 9876543210

Service : tcp/12345

Limit rule ID : 12345(ACL: 3184)

Sessions threshold Hi/Lo: 1000000/90000

Sessions count : 150000

New session flag : Permit

# Display statistics about IPv6 connections that match the global connection limit rule on the specified slot. (Applicable to security devices.)

<Sysname> display connection-limit ipv6-stat-nodes global slot 1 cpu 0

CPU 0 on slot 1:

Src IP address : Any

VPN instance : --

Dst IP address : Any

VPN instance : --

DS-Lite tunnel peer : --

Service : icmp/0

Limit rule ID : 22(ACL: 3666)

Sessions threshold Hi/Lo: 3500/3000

Sessions count : 3100

New session flag : Permit

# Display the number of global limit rule-based statistics sets on the specified slot.

<Sysname> display connection-limit ipv6-stat-nodes global slot 1 cpu 0 count

CPU 0 on slot 1:

Current limit statistic nodes count is 0.

Table 2 Command output

Field | Description
Src IP address | Source IP address.
Dst IP address | Destination IP address.
VPN instance | MPLS L3VPN instance to which the IP address belongs. Two hyphens (--) indicates that the IP address is on the public network.
DS-Lite tunnel peer | ID of the DS-Lite tunnel. Two hyphens (--) indicates that the connection does not belong to a DS-Lite tunnel.
Service | Protocol name and service port number. For an unwell-known protocol, this field displays unknown(xx).The cross signs (xx) indicates the protocol number. For the ICMP protocol, the protocol number is the decimal digits that are converted from the hexadecimal contents of the type and code fields.
Limit rule ID | ID of the matched rule. The ACL number of the rule is enclosed in parentheses.
Sessions threshold Hi/Lo | Upper and lower connection limits.
Sessions count | Number of current connections.
New session flag | Whether or not new connections can be created: · Permit—New connections can be created. · Deny—New connections cannot be created. NOTE: When the number of connections reaches the upper limit, this field displays Permit although new connections are not allowed. This field displays Deny only when the number of connections exceeds the upper limit.

Related commands

connection-limit apply global ipv6-policy

connection-limit apply ipv6-policy

connection-limit ipv6-policy

limit

Connection limit commands -- display connection-limit statistics

| NOTE: Support for this command depends on the device model.

Use display connection-limit statistics to display the connection limit statistics globally or on an interface.

Syntax

Centralized devices:

display connection-limit statistics { global | interface interface-type interface-number }

Distributed devices in standalone mode:Centralized IRF devices:

display connection-limit statistics { global | interface interface-type interface-number } [ slot slot-number [ cpu cpu-number ] ]

Distributed devices in IRF mode:

display connection-limit statistics { global | interface interface-type interface-number } [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

global: Displays the global connection limit statistics.

interface interface-type interface-number: Specifies an interface by its type and number.

slot slot-number: Specifies a card by its slot number. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN interface or tunnel interface. (Distributed devices in standalone mode.)

slot slot-number: Specifies an IRF member device by its member ID. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN interface or tunnel interface. (Centralized IRF devices.) (IRF 3 incapable.)

slot slot-number: Specifies an IRF member device by its member ID or specifies a PEX by its virtual slot number. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN-interface and tunnel interface. (Centralized IRF devices.) (IRF 3 capable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN interface or tunnel interface. (Distributed devices in IRF mode.) (IRF 3 incapable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device or specifies a PEX. The chassis-number argument represents the member ID of the IRF member device or the virtual chassis number of the PEX. The slot-number argument represents the slot number of the card or PEX. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN interface or tunnel interface. (Distributed devices in IRF mode.) (IRF 3 capable.)

cpu cpu-number: Specifies a CPU by its number. This option is available only if multiple CPUs are available on the specified slot. Support for this option depends on the device model.

Examples

# (Centralized devices.) Display the global connection limit statistics.

<Sysname> display connection-limit statistics global

Connection limit statistics (Global, slot 1):

Dropped IPv4 packets: 54781

Dropped IPv6 packets: 11457

# (Distributed devices in standalone mode.) (Centralized IRF devices.) Display the global connection limit statistics on the specified slot.

<Sysname> display connection-limit statistics global slot 1

Connection limit statistics (Global, slot 1):

Dropped IPv4 packets: 74213

Dropped IPv6 packets: 58174

# Display the global connection limit statistics on the specified slot.

<Sysname> display connection-limit statistics global slot 1 cpu 0

Connection limit statistics (Global, CPU 0 on slot 1):

Dropped IPv4 packets: 74213

Dropped IPv6 packets: 58174

Table 3 Command output

Field | Description
Dropped IPv4 packet | Number of IPv4 packets that are dropped because the upper connection limit is exceeded for the IPv4 connection limit policy that is configured globally or on an interface.
Dropped IPv6 packet | Number of IPv6 packets that are dropped because the upper connection limit is exceeded for the IPv6 connection limit policy that is configured globally or on an interface.

Related commands

connection-limit

connection-limit apply

connection-limit apply global

limit

Connection limit commands -- display connection-limit stat-nodes

| NOTE: Support for this command depends on the device model.

Use display connection-limit stat-nodes to display statistics about IPv4 connections that match connection limit rules globally or on an interface.

Syntax

Centralized devices:

display connection-limit stat-nodes { global | interface interface-type interface-number } [ destination destination-ip | service-port port-number | source source-ip ] * [ count ]

display connection-limit stat-nodes { global | interface interface-type interface-number } dslite-peer b4-address [ count ]

Distributed devices in standalone mode:Centralized IRF devices:

display connection-limit stat-nodes { global | interface interface-type interface-number } [ slot slot-number [ cpu cpu-number ] ] [ destination destination-ip | service-port port-number | source source-ip ] * [ count ]

display connection-limit stat-nodes { global | interface interface-type interface-number } [ slot slot-number [ cpu cpu-number ] ] dslite-peer b4-address [ count ]

Distributed devices in IRF mode:

display connection-limit stat-nodes { global | interface interface-type interface-number } [ chassis chassis-number slot slot-number [ cpu cpu-number ] ] [ destination destination-ip | service-port port-number | source source-ip ] * [ count ]

display connection-limit stat-nodes { global | interface interface-type interface-number } [ chassis chassis-number slot slot-number [ cpu cpu-number ] ] dslite-peer b4-address [ count ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

global: Displays statistics about IPv4 connections that match connection limit rules globally.

interface interface-type interface-number: Specifies an interface by its type and number.

slot slot-number: Specifies a card by its slot number. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN interface or tunnel interface. (Distributed devices in standalone mode.)

slot slot-number: Specifies an IRF member device by its member ID. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN-interface and tunnel interface. (Centralized IRF devices.) (IRF 3 incapable.)

slot slot-number: Specifies an IRF member device by its member ID or specifies a PEX by its virtual slot number. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN-interface and tunnel interface. (Centralized IRF devices.) (IRF 3 capable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN interface or tunnel interface. (Distributed devices in IRF mode.) (IRF 3 incapable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device or specifies a PEX. The chassis-number argument represents the member ID of the IRF member device or the virtual chassis number of the PEX. The slot-number argument represents the slot number of the card or PEX. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN interface or tunnel interface. (Distributed devices in IRF mode.) (IRF 3 capable.)

cpu cpu-number: Specifies a CPU by its number. This option is available only if multiple CPUs are available on the specified slot. Support for this option depends on the device model.

destination destination-ip: Specifies a destination by its IP address.

service-port port-number: Specifies a service port by its port number.

source source-ip: Specifies a source by its IP address.

dslite-peer b4-address: Specifies a B4 device on a DS-Lite tunnel. The b4-address argument specifies the IPv6 address of the B4 device.

count: Displays only the number of limit rule-based statistics sets. Detailed information about the specified IPv4 connections is not displayed. If you do not specify this keyword, the command displays detailed information about the specified IPv4 connections that match connection limit rules.

Usage guidelines

The statistics for this command include the following information:

· Connection information, including the source/destination IP address, service port, and transport layer protocol of connections.

· Matching connection limit rules.

· Number of current connections.

· Whether or not new connections can be created.

To further filter the output statistics, specify the following options in the command:

· source source-ip.

· destination destination-ip.

· service-port port-number.

For example, if you specify the source source-ip and destination destination-ip combination, this command displays statistics about IPv4 connections that match connection limit rules by source IP address and destination IP address.

If you do not specify any of the source source-ip, destination destination-ip, and service-port port-number options, this command displays statistics about all IPv4 connections that match connection limit rules.

Deleting or modifying an IPv4 connection limit policy will not delete the effective IPv6 connection limit rule-based statistics sets. An IPv4 connection limit rule-based statistics set will be automatically deleted after all the IPv6 connections for the set are disconnected.

Examples

# Display the number of global limit rule-based statistics sets.

<Sysname> display connection-limit stat-nodes global count

Current limit statistic nodes count is 5.

# (Distributed devices in standalone mode.) (Centralized IRF devices.) Display statistics about IPv4 connections that match the global connection limit rule on the specified slot.

<Sysname> display connection-limit stat-nodes global slot 1

Slot 1:

Src IP address : Any

VPN instance : Vpn1

Dst IP address : 202.113.16.117

VPN instance : Vpn2

DS-Lite tunnel peer : --

Service : icmp/0

Limit rule ID : 7(ACL: 3102)

Sessions threshold Hi/Lo: 4000/3800

Sessions count : 1001

New session flag : Permit

# (Centralized devices.) Display statistics about all IPv4 connections that match the connection limit rule on the specified interface. (Applicable to routers.)

<Sysname> display connection-limit stat-nodes interface gigabitethernet 1/0/1

Src IP address : 100.100.100.100

VPN instance : 0123456789012345678901234567890

Dst IP address : 200.200.200.200

VPN instance : abcdefghijklmnopqrstuvwxyzabcde

DS-Lite tunnel peer : 1234567890

Service : tcp/12345

Limit rule ID : 12345(ACL: 3001)

Sessions threshold Hi/Lo: 1100000/980000

Sessions count : 1050000

New session flag : Permit

# (Centralized devices.) Display statistics about all IPv4 connections that match the connection limit rule on the specified interface. (Applicable to switches.)

<Sysname> display connection-limit stat-nodes interface vlan-interface 2

Src IP address : 100.100.100.100

VPN instance : 0123456789012345678901234567890

Dst IP address : 200.200.200.200

VPN instance : abcdefghijklmnopqrstuvwxyzabcde

DS-Lite tunnel peer : 1234567890

Service : tcp/12345

Limit rule ID : 12345(ACL: 3001)

Sessions threshold Hi/Lo: 1100000/980000

Sessions count : 1050000

New session flag : Permit

# Display statistics about all IPv4 connections that match the global connection limit rule on the specified slot. (Applicable to security devices.)

<Sysname> display connection-limit stat-nodes global slot 1 cpu 0

CPU 0 on slot 1:

Src IP address : Any

VPN instance : Vpn1

Dst IP address : Any

VPN instance : --

DS-Lite tunnel peer : --

Service : All

Limit rule ID : 21(ACL: 2002)

Sessions threshold Hi/Lo: 2000/1500

Sessions count : 1988

New session flag : Deny

# Display the number of global limit rule-based statistics sets that match the source IP address 1.1.1.1 for the specified slot.

<Sysname> display connection-limit stat-nodes global slot 1 cpu 0 source 1.1.1.1 count

CPU 0 on slot 1:

Current limit statistic nodes count is 0.

Table 4 Command output

Field | Description
Src IP address | Source IP address.
Dst IP address | Destination IP address.
VPN instance | MPLS L3VPN instance to which the IP address belongs. Two hyphens (--) indicates that the IP address is on the public network.
DS-Lite tunnel peer | ID of the DS-Lite tunnel. Two hyphens (--) indicates that the connection does not belong to a DS-Lite tunnel.
Service | Protocol name and service port number. For an unwell-known protocol, this field displays unknown(xx). The cross signs (xx) represents the protocol number. For the ICMP protocol, the protocol number is the decimal digits that are converted from the hexadecimal contents of the type and code fields.
Sessions threshold Hi/Lo | Upper and lower connection limits.
Sessions count | Number of current connections.
New session flag | Whether or not new connections can be created: · Permit—New connections can be created. · Deny—New connections cannot be created. NOTE: When the number of connections reaches the upper limit, this field displays Permit although new connections are not allowed. This field displays Deny only when the number of connections exceeds the upper limit.

Related commands

connection-limit apply global policy

connection-limit apply policy

connection-limit policy

limit

Connection limit commands -- limit

Use limit to configure a connection limit rule.

Use undo limit to delete a connection limit rule.

Syntax

In IPv4 connection limit policy view:

limit limit-id acl { acl-number | name acl-name } [ per-destination | per-service | per-source ] * amount max-amount min-amount

limit limit-id acl ipv6 { acl-number | name acl-name } per-ds-lite-b4 amount max-amount min-amount

undo limit limit-id

In IPv6 connection limit policy view:

limit limit-id acl ipv6 { acl-number | name acl-name } [ per-destination | per-service | per-source ] * amount max-amount min-amount

undo limit limit-id

Default

No connection limit rules exist.

Views

IPv4 connection limit policy view

IPv6 connection limit policy view

Predefined user roles

network-admin

mdc-admin

Parameters

limit-id: Specifies a connection limit rule by its ID. The value range for this argument varies by device model.

acl: Specifies the ACL that matches the user range. Only the user connections that match the ACL are limited.

ipv6: Specifies an IPv6 ACL. If you do not specify this keyword, an IPv4 ACL is used.

acl-number: Specifies an ACL by its number in the range of 2000 to 3999.

name acl-name: Specifies an ACL by its name.

per-destination: Limits connections by destination IP address.

per-service: Limits connections by service depending on transport layer protocol and service port.

per-source: Limits connections by source IP address.

per-ds-lite-b4: Limits connections by IPv6 address of a B4 device on a DS-Lite tunnel. This keyword is available only in IPv4 connection limit policy view.

amount: Specifies the upper and lower connection limits.

max-amount: Specifies the upper connection limit in the range of 1 to 4294967295. When user connections in a range or of a type exceed the upper connection limit, new connections cannot be created.

min-amount: Specifies the lower connection limit in the range of 1 to 4294967295. The lower connection limit cannot be greater than the upper connection limit. New connections cannot be created until the connection number goes below the lower connection limit.

Usage guidelines

Each connection limit policy can define multiple rules, and each rule must specify the used ACL, rule type, and upper/lower connection limit. In one rule, you can specify one or multiple of the keywords per-destination, per-source, and per-service, but you cannot specify the per-ds-lite-b4 keyword together with other keywords. For example, if the per-destination and per-source combination is specified, connections are limited by the source IP address and destination IP address. Connections with the same source IP address and destination IP address are the same type.

When you configure a connection limit rule, follow these guidelines:

· Different rules in the same connection limit policy must use different ACLs.

· If you specify none of the per-destination, per-source, and per-service keywords, all connections that match the specified ACL are limited by the specified value.

· When the connections established on a device are matched against a connection limit policy, the limit rules in the policy are matched in ascending order of rule ID.

· When the specified ACL changes, the connections that have been established are limited by the new connection limit policy.

· A rule that has the per-ds-lite-b4 keyword limits IPv4 connections of the DS-Lite tunnel B4 device that matches the specified IPv6 ACL in the rule. On a DS-Lite tunnel network, if the AFTR device uses the Endpoint-Independent Mapping-based NAT configuration, you must limit connections from external IPv4 networks to access the internal IPv4 network. To implement B4 device-based connection limits, perform the following tasks:

?span style='font:7.0pt "Times New Roman"'> Add a rule that has the per-ds-lite-b4 keyword to a connection limit policy.

?span style='font:7.0pt "Times New Roman"'> Apply the policy globally or on the DS-Lite tunnel interface.

Examples

# Configure connection limit rule 1 for IPv4 connection limit policy 1:

1. Configure ACL 3000.

<Sysname> system-view

[Sysname] acl advanced 3000

[Sysname-acl-ipv4-adv-3000] rule permit ip source 192.168.0.0 0.0.0.255

[Sysname-acl-ipv4-adv-3000] quit

2. Limit connections that match ACL 3000 by the source and destination IP addresses, with the upper limit 2000 and lower limit 1800.

[Sysname] connection-limit policy 1

[Sysname-connlmt-policy-1] limit 1 acl 3000 per-destination per-source amount 2000 1800

3. Verify that when the connection number exceeds 2000, new connections cannot be established until the connection number goes below 1800. (Details not shown.)

# Configure connection limit rule 2 for IPv6 connection limit policy 12:

1. Configure ACL 2001.

<Sysname> system-view

[Sysname] acl ipv6 basic 2001

[Sysname-acl-ipv6-basic-2001] rule permit source 2:1::/96

[Sysname-acl-ipv6-basic-2001] quit

2. Limit connections that match ACL 2001 by the source and destination IP addresses, with the upper limit 200 and lower limit 100.

[Sysname] connection-limit ipv6-policy 12

[Sysname-connlmt-ipv6-policy-12] limit 2 acl ipv6 2001 per-destination amount 200 100

3. Verify that when the connection number exceeds 200, new connections cannot be established until the connection number goes below 100. (Details not shown.)

Related commands

connection-limit

display connection-limit

Connection limit commands -- reset connection-limit statistics

Use reset connection-limit statistics to clear the connection limit statistics globally or on an interface.

Syntax

Centralized devices:

reset connection-limit statistics { global | interface interface-type interface-number }

Distributed devices in standalone mode:Centralized IRF devices:

reset connection-limit statistics { global | interface interface-type interface-number } [ slot slot-number [ cpu cpu-number ] ]

Distributed devices in IRF mode:

reset connection-limit statistics { global | interface interface-type interface-number } [ chassis chassis-number slot slot-number [ cpu cpu-number ] ]

Views

User view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

global: Clears the global connection limit statistics.

interface interface-type interface-number: Specifies an interface by its type and number.

slot slot-number: Specifies a card by its slot number. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN interface or tunnel interface. (Distributed devices in standalone mode.)

slot slot-number: Specifies an IRF member device by its member ID. The slot-number argument represents the ID of the IRF member device. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN interface or tunnel interface. (Centralized IRF devices.) (IRF 3 incapable.)

slot slot-number: Specifies an IRF member device by its member ID or specifies a PEX by its virtual slot number. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN-interface and tunnel interface. (Centralized IRF devices.) (IRF 3 capable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN interface or tunnel interface. (Distributed devices in IRF mode.) (IRF 3 incapable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device or specifies a PEX. The chassis-number argument represents the member ID of the IRF member device or the virtual chassis number of the PEX. The slot-number argument represents the slot number of the card or PEX. This option is available only when you specify the global keyword or specify a virtual interface, such as a VLAN interface or tunnel interface. (Distributed devices in IRF mode.) (IRF 3 capable.)

cpu cpu-number: Specifies a CPU by its number. This option is available only if multiple CPUs are available on the specified slot. Support for this option depends on the device model.

Examples

# (Centralized devices.) Clear the connection limit statistics on the specified interface.

<Sysname> reset connection-limit statistics interface gigabitethernet 1/0/1

# (Centralized devices.) Clear the connection limit statistics on the specified interface.

<Sysname> reset connection-limit statistics interface vlan-interface 2

# (Distributed devices in standalone mode.) (Centralized IRF devices.) Clear the global connection limit statistics on the specified slot.

<Sysname> reset connection-limit statistics global slot 1

Related commands

display connection-limit statistics