Can I do rate limiting (X requests per second per IP)?

Short answer

Yes. The most direct way is the Quarantine action: Tracking Key = IP, Tracking Time = 1 second and Quarantine Condition = HTTP requests > X are selected; an IP that exceeds the threshold is met with the Quarantine Action for the Quarantine Time (default 10 minutes). If the block is wanted to last only while the threshold is exceeded, Advanced Traffic Inspection, Tracking Condition and Block are used together. If Bot/DDoS protection is on, L7 DDoS Protection → Source IP Request Protection does the same job, and if AGS is on, Bot Protection Policies (Trigger Type = Requests) does.

Problem: A Single Client Sends Too Many Requests

Brute force attempts, content collection software (scraper) or faulty clients wear out the servers by sending a large number of requests in a short time. Limiting the number of requests that each client can send within a certain period is wanted. In TR7, the limit is defined by the number of requests within the selected window: for "X requests per second", the window is made 1 second.

Solution: Five Methods

The methods are alternatives to one another; more than one of them does not need to be applied to the same traffic.

Your situation	Suitable method
The client that exceeds the threshold should be blocked for a certain period (HTTP or L7 TCP)	Method 1: Quarantine
The block should last only while the threshold is exceeded	Method 2: Advanced Traffic Inspection + Tracking Condition + Block
Bot/DDoS protection is on for the HTTP vService	Method 3: L7 DDoS Protection → Source IP Request Protection
AGS is on for the vService	Method 4: AGS → Bot Protection Policies (Requests)
Setting Source IP Request Protection from the command line	Method 5: WEB-CLI

Method 1: Quarantine Recommended

• How it works The requests of the client are counted in the Tracking Time window; when the Quarantine Condition is met, the client is written to the quarantine table and the Quarantine Action is applied for the Quarantine Time (how it works). Details: How does the Quarantine Action work; how long is a client that exceeds the threshold blocked?
• Where it is openedLoad Balancer → Actions → Quarantine · vService → Details → Actions
• Requirement There is no change on the Backend Service side
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the action form

On the Load Balancer → Actions screen, Add is clicked (how to add).

2

Adım 2 Define the tracking

Action Name is entered; Action Type = Quarantine and Execution Level = On Request are selected. Tracking Key = IP (default) is left as it is; Tracking Time is made 1 second (default 10 minutes; range 1 second – 360 hours). For an L7 TCP vService, Rule protocol = TCP is selected under Details; in this case, the key can only be IP or Manual.

3

Adım 3 Create the threshold condition

The + next to the Quarantine Condition field is clicked; in the condition form that opens, Criteria = Quarantine condition, Tracking Criteria = HTTP requests and the threshold (e.g. > 20) with Tracking Operator are entered, and Add is clicked. In L7 TCP, connection and data criteria are used instead of the HTTP-specific criteria.

4

Adım 4 Define the quarantine

Quarantine Time (default 10 minutes) and Quarantine Action (default Silent Drop; in HTTP, Redirect or Show content can also be selected) are set. For the tracking to be done only on specific paths (e.g. /login), a condition is selected in the Conditions field; if it is left empty, all traffic is tracked.

5

Adım 5 Save the action

Add is clicked; the action is added to the list.

6

Adım 6 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

7

Adım 7 Add the action to the vService

The action is selected in the Actions field under Details (HTTP, L7 TCP).

8

Adım 8 Save

Save is clicked; the rule is applied without a separate deployment step. In a cluster setup, the change is also sent to the peer device automatically with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually. The quarantine records, on the other hand, are kept separately on each device.

Verification

1Quarantine tableTR7 side

On the Logs & Tracking tab of the vService, the action name (QUARANTINE, duration) table is selected from the Logs Type list (quarantine logs).

ExpectedThe client that exceeds the threshold is listed

2LimitClient side

More requests than the threshold are sent from the same client in one second.

Command: for i in $(seq 1 50); do curl -s -o /dev/null -w '%{http_code}\n' --max-time 3 https://www.example.com/; done

ExpectedThe first requests 200, then 000 (Silent Drop)

Method 2: Advanced Traffic Inspection + Tracking Condition + Block

• How it worksAdvanced Traffic Inspection keeps a counter per client; Tracking Condition compares the counter with the threshold, and Block blocks the request that exceeds the threshold. When the counter drops below the threshold, the block is lifted on its own.
• Where it is openedLoad Balancer → Actions · Load Balancer → Conditions
• Requirement There is no change on the Backend Service side
• vService type HTTP (in L7 TCP, TCP Connection Management is used instead of Block)

Step-by-Step Configuration

1

Adım 1 Open the counter action form

On the Load Balancer → Actions screen, Add is clicked.

2

Adım 2 Define the counter

Action Name is entered; Action Type = Advanced Traffic Inspection is selected. Fields to Track = Client IP Address, Traffic Tag (3–20 characters; letters, digits, -, _; e.g. ip-hiz) and Tracking Period = 1 second are entered.

3

Adım 3 Save the counter action

Add is clicked.

4

Adım 4 Open the condition form

On the Load Balancer → Conditions screen, Add is clicked (how to add).

5

Adım 5 Define the threshold

Criteria = Tracking Condition; Tracked Table = the Traffic tag from step 2, Tracking Criteria = HTTP requests and the threshold (e.g. > 20) with Tracking Operator are entered.

6

Adım 6 Save the condition

Add is clicked.

7

Adım 7 Define the Block action

Load Balancer → Actions → Add; Action Name is entered, and Action Type = Block, Execution Level = On Request, Deny Type = Standard and Status Code = 429 are selected; in the Conditions field, the condition from step 6 is selected.

8

Adım 8 Save the Block action

Add is clicked.

9

Adım 9 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

10

Adım 10 Add the two actions in order

In the Actions field under Details, first the Advanced Traffic Inspection action and then the Block action are selected; the actions are processed in their order in the list.

11

Adım 11 Save

Save is clicked.

Verification

1Tracking tableTR7 side

On the Logs & Tracking tab, the action name (TRACKING, 1s) table is selected from the Logs Type list (tracking logs).

ExpectedHTTP request counters per client

2LimitClient side

More requests than the threshold are sent from the same client in one second.

Command: for i in $(seq 1 50); do curl -s -o /dev/null -w '%{http_code}\n' https://www.example.com/; done

Expected429 once the threshold is exceeded; 200 again one second later

Method 3: L7 DDoS Protection → Source IP Request Protection

• How it worksSource IP Request Protection applies the Limit Action when the number of requests of a single source address within the Time Window exceeds the Request Limit; each address carries its own counter. The optional Hard Ceiling (Quarantine) adds a second tier.
• Where it is opened Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management → L7 DDoS Protection → Source IP Request Protection
• Requirement Bot/DDoS license; L7 DDoS & Threat Protection on for the vService; L7 DDoS Protection Active for blocking
• vService type HTTP (requests are not counted on an L7 TCP vService)

Step-by-Step Configuration

1

Adım 1 Turn on Bot/DDoS protection (if needed)

In the edit form of the vService, the L7 DDoS & Threat Protection box under Details is checked and Save is clicked (two ways). When the protection is turned on, L7 DDoS Protection starts in Monitor mode and IP Reputation Protection in Active mode (starting modes).

2

Adım 2 Open the L7 DDoS Protection edit window

On the Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management tab, the Edit link of the L7 DDoS Protection card is clicked.

3

Adım 3 Set the protection to Active and save

DDoS Protection = Active is selected and Edit is clicked. In Monitor mode, a limit violation is only recorded as an event.

4

Adım 4 Open the Source IP Request Protection window

The pencil icon of the Source IP Request Protection block on the L7 DDoS Protection card is clicked (Edit screen).

5

Adım 5 Set the limit

Time Window = 1 seconds (default 10 seconds), Request Limit = X (default 1000) and Limit Action (default Show captcha; e.g. Block) are selected. The sentence at the bottom of the form shows the setting that will appear on the card.

6

Adım 6 Save

Edit is clicked; the setting is applied without a separate deployment step.

Verification

1Event recordTR7 side

On the Bot/DDoS Event Logs screen, a record is selected; the L7 DDoS tab of the preview is checked.

ExpectedSource IP Request Protection record, the measured value and the limit

Method 4: AGS → Bot Protection Policies (Requests)

• How it works The Bot Protection Policies policy counts the number of requests of the client in scope within the Trigger Window Duration; when the Request Threshold is exceeded, the action is applied.
• Where it is openedAGS → Protection Policies → Bot Protection Policies · vService → AGS Management → Protection
• Requirement AGS license; AGS on for the vService
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Enable AGS (if needed)

If AGS is not on for the vService, it is turned on (two ways); details: How do I attach WAF, L7 DDoS & Threat Protection and AGS to a vService?

2

Adım 2 Open the policy form

On the AGS → Protection Policies → Bot Protection Policies screen, Add is clicked (how to add).

3

Adım 3 Define the policy

Trigger Type = Requests; Request Threshold, Trigger Window Duration, Policy Scope = IP Address and Action are entered. Built-in profiles can also be selected (built-in profiles).

4

Adım 4 Save the policy

Add is clicked.

5

Adım 5 Assign the policy to the vService

On the AGS Management tab of the vService, the Edit link of the Protection section is clicked; the policy is selected in the Bot Protection Policies field.

6

Adım 6 Save

Accept is clicked in the Edit / Protection window.

Verification

1Bot Protection tabTR7 side

On the Bot Protection tab of the AGS vService, the policy is selected.

ExpectedThe clients that exceed the threshold

Method 5: WEB-CLI

• How it works The Source IP Request Protection settings in Method 3 are written with the lb threat-protection update command (number of requests per source address).
• Where it is openedWEB-CLI → lb threat-protection
• Requirement WEB-CLI access; Bot/DDoS license; L7 DDoS & Threat Protection on for the vService
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Turn on the protection (if needed)

lb service update id <vService> --threatProtection true

2

Adım 2 Write the limit

The ID of the protection record is the vService; it is listed with Tab in the id field. --ddosProtection true makes L7 DDoS Protection Active (monitor for Monitor). Example: 20 requests per second per source address, blocking with 429 when exceeded:

lb threat-protection update id <vService> --ddosProtection true --ddosSrcIpRequestProtection true --ddosSrcIpRequestWindow.val 1 --ddosSrcIpRequestWindow.unit s --ddosSrcIpRequestLimit 20 --ddosSrcIpRequestAction block --ddosSrcIpRequestBlockStatusCode 429

Verification

1RecordTR7 side

The protection record is displayed.

Command: lb threat-protection show <vService>

ExpectedddosSrcIpRequestLimit 20 · ddosSrcIpRequestAction block

In the interface, the same setting appears in the Source IP Request Protection sentence on the L7 DDoS Protection card.

Common Mistakes

• Keeping the window long and assuming "X per second". The threshold is per window: Tracking Time in Quarantine, Tracking Period in Advanced Traffic Inspection and Time Window in Source IP Request Protection are made 1 second.
• Ordering Advanced traffic inspection after Block. The counter action must come before Block in the Actions list of the vService.
• Forgetting the users behind NAT or a proxy. Users who share the same IP are gathered in a single counter; if TR7 is behind a CDN or a proxy, the real client IP is first resolved with Trusted Proxy on the HTTP vService.
• Leaving Bot/DDoS in Monitor mode. In Monitor mode, a limit violation is only recorded as an event; for blocking, DDoS Protection = Active is set.
• Setting up the limit by IP for a key other than IP. For a limit per API key or token: Can I apply rate limiting based on a key such as an API key / token?

How it is done in the documentation

• Quarantine · Tracking Time
• Quarantine Condition · Tracking Criteria
• Advanced Traffic Inspection · Tracking Period
• Source IP Request Protection · Request Limit
• WEB-CLI · lb threat-protection

Related questions

• How does the Quarantine Action work; how long is a client that exceeds the threshold blocked?
• Can I apply rate limiting based on a key such as an API key / token?
• Can I take automatic action when the number of requests / connections suddenly increases?