ASA: set connection embryonic-conn-max

Question

Hi
In order to mitigate syn-floods, syn-cookies are usefull tools, but I wonder how the count is.
F.ex if this security police from the configuration guide is applied to the outside interface:
hostname(config)# class-map CONNS
hostname(config-cmap)# match any
hostname(config-cmap)# policy-map CONNS
hostname(config-pmap)# class CONNS
hostname(config-pmap-c)# set connection conn-max 1000 embryonic-conn-max 3000
hostname(config-pmap-c)# set connection timeout idle 2:0:0 embryonic 0:40:0 half-closed
0:20:0 dcd
hostname(config-pmap-c)# service-policy CONNS interface outside
the syn-cookie/tcp-intercept will kick in when 3000 embryonic conns are seen from the outside, but is the count per ASA-box/module / per context og per IP-address   ?
Thanks :-)
Jesper Joensen

Answer 1

Hello Jesper,
Regarding your question. Since you are using the commands:
conn-max n argument  sets the maximum number of simultaneous TCP and/or UDP connections that  are allowed, between 0 and 65535. The default is 0, which allows  unlimited connections.
embryonic-conn-max
n argument  sets the maximum number of simultaneous embryonic connections allowed,  between 0 and 65535. The default is 0, which allows unlimited  connections.
The count applies to the box or ASA if it is running single-context or to the specific context with the class configuration if running Multiple Context. You can also limit the connection and embryonic limit per IP by using the following commands:
The per-client-embryonic-max n argument  sets the maximum number of simultaneous embryonic connections allowed  per client, between 0 and 65535. The default is 0, which allows  unlimited connections.
The per-client-max n argument  sets the maximum number of simultaneous connections allowed per client,  between 0 and 65535. The default is 0, which allows unlimited  connections.
Hope this helped you out, don't forget to rate helpful posts.
Best Regards.
Eddy Duran