This article explains how to permit user access to an SRX device when the number of users attempting to log in reaches the configured connection limit.
The user connection limit is configured with the command set system services . It can be configured for each protocol, such as SSH, Telnet, or FTP. For example, if an administrator wants to limit access to a device to three users at a time, it is necessary to configure that limit using the command set system services :
set system services
set system services telnet connection-limit 3
This configuration will permit up to three users to log in to the device simultaneously, but an attempt to log a fourth user in to the device will fail. The fourth user will not be able to log in to the device and the attempt will remain in a waiting state.
When the connection limit is exceeded, the SRX device does not disconnect the exceeded user access connection, but keeps the exceeded user access connection in a waiting state until one of the current user access connections is disconnected. Since the exceeded user access connection stays in a waiting state, there will be no log entries to show the device has reached the connection limit. For example, if the fourth attempt is initiated from a remote Telnet user while three user connections are active ( see show system users output below), the fourth attempt at connection will not be dropped. The fourth attempt connection will be in a waiting state until one of the current connections is disconnected.
see show system users
<show system users> root@SRX240H-A> show system users node0: -------------------------------------------------------------------------- 12:00PM up 13 days, 16:41, 3 users, load averages: 0.28, 0.09, 0.07 USER TTY FROM LOGIN@ IDLE WHAT user1 p0 172.27.117.191 11:21AM - -cli (cli) user2 p1 127.54.191.23 11:28AM - -cli (cli) network-operator p2 93.21.131.159 12:00PM - -cli (cli)
If the fourth attempt user needs an immediate connection, it is necessary to manually disconnect one of the current user connections. This will delete the current user access connection, and the fourth attempt user access connection in waiting state will be able to log in. The command to disconnect a user access connection is as follows:
request system logout user <username>
There is another command to limit the maximum number of connections per minute: set system services telnet rate-limit. User connections that exceed the rate-limit will be closed immediately after the connection is initiated. They will not be in a waiting state.
set system services telnet rate-limit.