When using the Junos Space or Junos Space Security Director with Space versions 23.1 and up

• Client system / application / script: may report error like: Failed to establish a new connection: [Errno 111] Connection refused
• on Space server, check /var/log/fail2ban.log for a line like
  • 2025-03-13 17:37:38,965 fail2ban.actions        [1945]: NOTICE  [http-api-dos] Ban 10.10.10.1
    
    

The number of allowed connections per minute are now limited.

Modify your API operations to perform fewer requests per minute.

• Alternate Security Director APIs may be available 
  • Address and Services

The number of API calls is limited to 250 requests per minute per source IP address. (500 requests per minute total) When you exceed the limit, Junos Space Network Management Platform blocks the IP address for a timespan of two minutes before unblocking the IP again.

23.1

https://www.juniper.net/documentation/us/en/software/junos-space23.1/release-note/23.1/release-note/topics/concept/management-scalability.html

Note: limits changed in hotpatch to match 24.1, 250 requests per minute per IP

24.1

https://www.juniper.net/documentation/us/en/software/junos-space24.1/release-note/24.1/release-note/topics/concept/management-scalability.html

Whitelist an IP

Note: Whitelisting is supported.  Space system performance is not assured when going above the rate limit.  Take care to minimize the number of API request per minute where possible.  Depending on the API's used, quantity of a data requested, load on the system overall, poor system performance may be encountered if total requests go above the documented rate.

It is possible to whitelist specific IPs:

On All Space nodes edit the file:

/etc/fail2ban/jail.conf

Locate the line for

ignoreip

This line may be commented out with a "#" Remove the # if present, then add additional IPs you want to whitelist, so they can run API queries without being banned.

Then restart
systemctl restart fail2ban