Defining Connection Limits with NAT Rules

The ASA algorithm supports the definition of acceptable connection limits within address translation statements. One key usage of this feature is the contention of Denial of Service (DoS) attacks to specific hosts (typically servers). DoS mitigation for client side addresses is analyzed in Chapter 11, “Additional Protection Mechanisms.”

Example 8-27 demonstrates how a limit for the number of simultaneous UDP connections can be defined for a host whose IP is being published with the static command. The example emphasizes that, after the configured number of 25 connections is reached, ASA stops accepting new requests.