Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is rate limiting; at which layers is it applied in TR7?
Short answer
Rate limiting is putting a ceiling on the number of requests, connections or packets that a source, or the traffic as a whole, can send within a certain time window; traffic that exceeds the ceiling is rejected, delayed or challenged. In HTTP, the 429 Too Many Requests status code is defined for this situation (RFC 6585). In TR7 it is applied at four layers: in L7 DDoS Protection, Source IP Request Protection sets a request limit per source and Total Request Protection one for the vService total; in Load Balancer, the Quarantine action responds, for a set period, to the client that exceeds the Quarantine Condition threshold with a separate action; the vService Limits profile limits the vService's rate of new connections and sessions per second; and L4 DDoS Protection limits the number of new TCP and UDP packets, DNS requests and ICMP packets per second per source. In AGS, the Requests trigger of a Bot Protection Policies policy also works by the number of requests.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management → L7 DDoS Protection | Source IP Request Protection | Request limit per source; default 1,000 requests in 10 seconds, Show captcha when exceeded (HTTP vService) |
| L7 DDoS Protection card | Total Request Protection | Limit on the total requests coming to the vService; default 10,000 requests in 10 seconds, Show captcha when exceeded (HTTP vService) |
| L7 DDoS Protection card | Source IP Connection Protection, Total Connection Protection, Source IP Error Protection | Limit by the number of connections and errors (4xx) |
| L7 DDoS Protection card | Country Control, Network Type Group Control | Request and connection limit per country or network type |
| Configuration Menu → Load Balancer → Actions (Policy Actions) | Quarantine, Advanced Traffic Inspection | Condition-based request counter per IP or per another key |
| Configuration Menu → Load Balancer → vService Limits | Max. New Connecions/s, Max. Session Rate/s | The vService's rate of new connections and sessions per second |
| Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management | SYN Flood, UDP Flood, Smurf, Reflection & Amplification boxes | Packet rate per second per source; the default value of the rate rules in these boxes is Monitor (Smurf: TCP Reset Limit is Disabled by default) |
| Configuration Menu → AGS → Bot Protection Policies | Trigger Type = Requests | Triggering a policy by the number of requests on the AGS gateway |
- Configuration steps with Load Balancer: Can I do rate limiting (X requests per second per IP)?
- Limit per key: Can I apply rate limiting based on a key such as an API key / token?
Common Misconceptions
- "Rate limiting is done only per IP." L7 DDoS Protection keeps separate limits per source and for the vService total, and also sets limits per country and per network type; the Quarantine action can also count per key other than the IP.
- "Every request that exceeds the ceiling is blocked." The result depends on the selected action: in L7 DDoS Protection, Show captcha, Tarpit or Redirect can be selected depending on the block; in Source IP Request Protection and Source IP Connection Protection, if a Hard Ceiling is additionally defined, the source that exceeds it is put into Quarantine. In vService Limits, when Max. New Connecions/s is exceeded, the excess connections are not rejected; they are held until the rate drops.
- "A limit is applied as soon as it is set up." L7 DDoS Protection starts in Monitor mode when protection is turned on; the default value of the SYN Flood: New-TCP Rate, UDP Flood: New-UDP Rate, DNS Flood, ICMP Smurf: Pkt Limit and Reflected UDP rate rules in L4 DDoS Protection is also Monitor. In this mode the limits are measured but traffic is not blocked.
How it is done in the documentation
