This article demonstrates how to limit concurrent sessions based on source or destination IP address on SRX series devices. 

In order to mitigate IP address-based attacks targeting SRX devices, restrictions can be applied to the source or destination IP addresses.

You can limit concurrent sessions based on source and destination IP addresses using screen options. The following configuration is used to limit sessions based on source and destination IP addresses:

[edit security screen ids-option DMZ_SCREEN]

root@R003# show 

limit-session {

  source-ip-based 3000; -----> Here, the value 3000 indicates the maximum number of concurrent sessions a host can initiate at a particular time.

  destination-ip-based 3000; -----> Similarly, the value 3000 indicates the maximum number of concurrent sessions a host can initiate to a destination at a particular time.

}

Make sure to review your specific environment needs before applying any changes on these values. Setting a threshold too low may cause unwanted drops; for example, if several users use a single DNS server, or need to reach a specific server, this valid traffic may trigger the screen and the user may perceive disconnections due to this. 

Similarly, when scans are run on an interface that has any of these values applied, the scan itself may trigger the screen. 

2023-09-01 : Initial Release

2025-01-24 : Added note regarding threshold values

https://www.juniper.net/documentation/us/en/software/junos/denial-of-service/topics/ref/statement/security-edit-destination-ip-based.html

https://www.juniper.net/documentation/us/en/software/junos/denial-of-service/topics/ref/statement/security-edit-source-ip-based.html