vService Limits

What Is the vService Limits Profile?

vService Limits is a configuration profile used to take under control the connection and session traffic coming to the vServices running on TR7.

In the TR7 architecture, limit management is designed as a profile-based structure. In this way the limit values are defined centrally and applied to the selected vServices. vService Limits Profiles work at the vService level and are valid for both HTTP and L7 TCP vService traffic.

Even when a vService Limits Profile is not assigned explicitly, all the vServices on TR7 are activated with the predefined default limit values. These defaults provide a balanced and safe basis for the total number of connections, the connection rates, the SSL connections and the buffer size.

TR7 applies limit management directly on the traffic flow. Every limit parameter is evaluated according to certain phases such as the connection establishment, the session management or the resource usage, and provides a controlled, predictable traffic behavior.

The benefits it provides

• Excessive connection loads can be taken under control.
• The unnecessary consumption of the system resources can be prevented.
• A consistent and predictable service behavior can be provided under load.
• Different limit policies can be applied easily according to the application requirements.

The Importance of the vService Limits Profile

In the load balancer and application delivery architectures, limit management is not only a configuration that determines when the connections will be rejected; it is a critical component that has a direct effect on the stability, the resource usage and the predictability of the system.

In the application traffic the clients do not always send requests within the expected limits. If the sudden traffic increases, the DDoS attacks or the incorrectly configured clients are not managed properly, they can cause the system to be overloaded. Especially in high traffic conditions, this situation can lead to excessive resource consumption and to chain performance problems.

The limit mechanisms make it possible for reasonable limits to be determined for the number of connections and the session rates. This guarantees that the excessive load is managed in a controlled way and that the system continues to allocate resources to the healthy services.

That the limits are defined as a profile at the vService level on TR7 makes it possible for different applications to be managed according to their own behaviors and requirements. The services that consume low resources and the applications that require a high number of connections can work together on the same system without affecting each other negatively.

Protection

Attack surface

The connection-based attacks and the sudden load are limited

Control

Connection/session rate

The connection and session rates per second are managed

SSL

Encrypted load balance

The heavy SSL/TLS processing load is kept under control

Foresight

Behavior under load

The resource and memory consumption remains predictable

For this reason, vService Limits Profiles are not only a technical setting; they are a basic building block for offering stable, reliable and manageable services on TR7.

The Default vService Limits Profile Behavior

When no vService Limits Profile is assigned to a vService (HTTP/L7 TCP) on TR7, the system works with the default limit profile. This profile offers safe and balanced limit values for the general use scenarios and makes the system remain stable under excessive load. It can be used without requiring an additional configuration, especially for the first installation and the low/medium traffic levels.

The limit values applied within the scope of the default vService Limits Profile:

Parameter	Default	Description
Max. Total Connections	20,000	It determines the maximum total number of active connections allowed on the system at the same time.
Max. Failed Connection Retries	3	It defines the maximum number of retries allowed for the failed connection attempts.
Max. New Connecions/s	5,000	It determines the maximum number of new connections that can be accepted per second.
Max. Connections/s	10,000	It limits the total number of connections that can be processed per second.
Max. Session Rate/s	10,000	It defines the maximum number of new sessions that can be created per second.
Max. Total SSL Connections	5,000	It determines the maximum total number of SSL/TLS connections that can be established at the same time.
Max. SSL Connections/s	2,000	It limits the maximum number of new SSL/TLS connections that can be accepted per second.
Buffer size	128 kB	It determines the size of the buffer memory to be used during the data processing per connection.

This table shows the values of the built-in Default profile. The new profile add form also opens preloaded with the same values. When one of the fields other than Buffer Size(kB) is emptied and saved, the related limit is not applied at all.

These default values offer a safe starting point for most of the standard web and API applications and are designed by taking the system security and stability into account; however, they do not guarantee the optimal values for every environment. When a high traffic volume, heavy SSL usage, environments that have an attack risk or special application requirements are in question, configuring the profiles specifically for the application is recommended.

Effects and Behavior

The limits defined within the scope of the vService Limits Profiles make it possible for the connections and the sessions to be managed in a controlled way during the traffic flow on TR7. When the limit values are reached, TR7 protects the system resources by limiting the new connection or session requests without interrupting the existing active connections, and prioritizes the service continuity.

The flow diagram below shows how an incoming connection request is evaluated according to the defined limits:

In the sections below the critical behaviors of the process are explained in detail.

INFO

The Connection and Session Limits

In the situation where the connection or session limits are exceeded, TR7 keeps the new connection and session requests within the defined limits and prevents the sudden load increases and resource exhaustion. This approach makes the existing active user traffic continue without being affected.

INFO

The SSL Connection Limits

In the situation where the SSL/TLS connection limits are exceeded, TR7 takes the encrypted connection requests under control and prevents the CPU and cryptographic processing load from increasing in an unbalanced way across the system. In this way the system stability is preserved even under heavy SSL traffic.

INFO

The Failed Connection Retries

By limiting the retries made for the unresponsive Backend Services, the unnecessary connection attempts consuming the system resources is prevented and the traffic is made to continue over the healthy services.

INFO

The Connection Rate Limiting

Thanks to the limits related to the rate of new connections, total connections or session creation per second, the sudden traffic spikes are managed in a controlled way. This mechanism makes the system resources be used in a balanced way, especially in the sudden connection increases originating from bots.

INFO

The Buffer and Resource Management

The buffer size and the connection limits work together and make it possible for the memory and processing resources allocated for every connection to be kept under control. This structure helps the memory consumption remain predictable in the high simultaneous connection scenarios.

Thanks to this behavior model, the vService Limits Profiles work as a protective control mechanism against the excessive load, the sudden traffic increases and the connection-based risks instead of creating a service interruption.

Recommended Values and Tuning Guide

The correct configuration of the limit values has critical importance for the performance, the stability and the predictability of the services running on TR7. The default values offer a balanced starting point for the general use scenarios; however, they may need to be adjusted depending on the application type, the traffic structure and the system capacity.

TIP

Microsoft Exchange (Outlook / OWA / ActiveSync)

The Microsoft Exchange services can create long-lived and simultaneous connections over the Outlook clients and the mobile devices. Especially in busy user environments, the number of connections and the SSL session intensity can increase considerably. On this type of service:

• The Max. total connections value must be increased so that it meets the number of simultaneous Outlook and mobile clients.
• The Max. connections/s and Max. new connecions/s values must be configured at a level that meets the sudden connection increases in the morning opening hours.
• The Max. total SSL connections and Max. SSL connections/s values must be optimized according to the heavy HTTPS and MAPI/ActiveSync traffic.
• The Max. failed connection retries value must be kept balanced according to the Backend Service behavior.

Insufficient limit values can lead to client connection delays, reconnection loops and performance problems on the user side.

TIP

The Web Applications (Standard HTTP/HTTPS)

In the classic web applications the requests are generally responded to in a short time and the client–server interaction has a synchronous structure. On this type of service:

• The Max. total connections value can be kept at the default levels.
• The Max. connections/s limits can be adjusted according to the expected traffic volume.
• The Buffer size can be optimized according to the typical request/response sizes.

This approach prevents the slow or unresponsive clients from consuming the system resources.

TIP

API Services

The API services generally work over short-lived connections that are expected to produce a fast response. In these scenarios:

• The Max. new connecions/s value can be adjusted according to the expected request intensity of the API.
• The Max. total connections value can be configured so that it meets the number of simultaneous clients.
• By keeping the Max. failed connection retries low, a fast error detection can be provided.

The aim is to prevent the slow or erroneous API calls from affecting the other requests.

TIP

Environments Under Load

In the environments that have a high traffic volume or a limited Backend Service capacity:

• The Max. total connections value must be adjusted carefully according to the system capacity.
• The Max. connections/s limits must be configured so that they take the sudden increases under control.
• The Max. total SSL connections and Max. SSL connections/s values must be optimized in order to balance the load of the encryption operations on the system.

This approach helps to protect the service continuity while preventing the chain performance problems.

TIP

The SSL/TLS Intensive Applications

In the environments where the HTTPS traffic is heavy:

• The Max. total SSL connections value must be adjusted according to the expected number of simultaneous SSL sessions.
• The Max. SSL connections/s value must control the number of new SSL handshakes that can be processed per second.

Since the SSL operations are CPU intensive, these limits provide a balanced use of the system resources.

Operational Best Practices

• Profile-based management is used. Common limit profiles are defined for the vServices that have a similar traffic volume and connection model; a separate profile is created for the API services that create a high connection intensity or for the SSL-heavy applications. This approach prevents an abnormal load that can occur on one service from affecting the other services.
• The default profile is not used blindly in live traffic. The default profile offers a safe start; however, it must be customized according to the application requirements in high traffic or special use scenarios.
• The limit values are adjusted gradually. Sudden and large increases or decreases are avoided; the changes are made gradually and unexpected service interruptions are prevented.
• No change is made without the "Used in" information being checked. A profile must not be updated without knowing on which vServices it is used in the live environment; the change instantly affects all the connected services.
• Think of the limits as a security layer. The Max. connections/s, Max. new connecions/s and SSL limits provide protection not only for the performance but also against the connection-based attacks; the system capacity and the threat model must be evaluated together.
• Continuous observation is made with the traffic and log data. After the configuration, the vService metrics and the log records are monitored regularly; the profiles are updated when necessary.

Supported vService Types

HTTP

L7 TCP

Network

How to Add?

A new vService Limits Profile is added through the TR7 web management interface with the steps below:

1. The Configuration Menu is opened by clicking the TR7 logo at the bottom left.
2. The Load Balancer → Profiles → vService Limits → Add steps are followed.
3. A unique and descriptive name is entered for the profile.
4. The values suitable for the application and service requirements are configured.
5. The profile is added by clicking the Add button.

TIP

Reaching the page via quick search

Instead of navigating the menu step by step, the related page is reached directly by using the search bar in the bottom left corner of the screen. The search bar opens with the Alt + T shortcut on Windows and Opt + T on macOS; typing the name of the feature being searched for is then sufficient.

The created profile can be used on one or more vServices. The moment the profile is assigned, the defined limit values become valid for the related vService traffic.

Profiles Listing Screen

By following the Load Balancer → Profiles → vService Limits path, the list of all the vService Limits Profiles added on the TR7 device is reached. Profile adding, editing and deleting operations are performed through this screen.

vService Limits Profiles Listing Form

The table opens with the following columns by default:

Column	Description
Name	The name of the profile.
Max. Total Connections	The total number of connections that can be open to the vService at the same time.
Max. Failed Connection Retries	How many times a failed connection attempt to the Backend Service will be repeated.
Max. New Connecions/s	The number of new sessions accepted per second.
Max. Connections/s	The number of connections accepted per second.
Max. Session Rate/s	The number of sessions that can be created per second.
Max. Total SSL Connections	The total number of SSL connections that can be open at the same time.
Max. SSL Connections/s	The number of SSL connections accepted per second.
Buffer Size(kB)	The buffer size per connection (kB).

The value columns show the number without a unit; when the cell is hovered over, the full value appears in the tooltip. There is no column hidden by default; these nine columns are in the column selector. The table is not sorted when it opens; when a column header is clicked, descending sorting is applied first, then ascending, and on the third click the sorting is removed.

The items in the toolbar are arranged from left to right in the following order; the last two items (Page Information and Page Size) are located in the information strip below the table.

Columns

Which columns are shown in the table is selected; all nine columns are on by default. In the same panel, columns are reordered by dragging and alignment is selected per column; the row height is fitted to the page with the Fit rows to the page button, and the column layout is reset to default with the Reset button. The layout is stored per user.

Filter

The Filter button is used to filter the profiles shown in the list according to certain criteria; the button shows the number of active filters with a badge. There is a single card in the strip: Used in. The card lists the names of the vServices on which the profile is used; for the profiles that are not used on any vService, the Unused Entries option is available. The selections are displayed as closable labels under the card strip, right above the table.

Export

The table is exported as Excel, CSV or PDF by clicking the Export button. In the window that opens, the Filename, Format and Data Source, together with the Columns to be exported, are determined; the remaining fields are displayed according to the format: CSV Separator for CSV, Excel Sheet Name for Excel, and Page Orientation and Page Size for PDF.

Add

By clicking the Add button, the form for creating a new profile opens in the Add tab.

Delete

When one or more profiles are selected and the Delete button is clicked, the related profiles are deleted.

WARNING

A profile that is in use can also be deleted and the confirmation window does not show the usage places. The vServices that use the deleted profile silently return to the values of the built-in Default profile; if this transition changes the fields written into the general configuration of the engine, the related vServices are restarted automatically. Before deleting, the Used in tab on the preview panel must be checked.

Edit

By clicking the Edit button, the edit form of the selected profile opens in the Edit tab. The button becomes enabled only when a single profile is selected.

Search

Used to search all information in the table.

RegExp Search

Used to search all information in the table with a regular expression (RegExp). This button is hidden while column-based search or the usage filter is active.

Column Based Search

Used to perform a column-based search on the information in the table.

Usage Filter

Used to filter which vServices the profiles are bound to; the profiles used on the selected vService are listed, and there is an Unused Entries option for those not used on any vService. While the filter is active, the selector takes the place of the search box; when the icon is clicked again, the search box returns.

Page Information

Contains information about the total number of defined profiles and the number of profiles displayed in the list: Showing N-M of T records and the number of selected profiles (N selected, or Nothing selected when there is no selection). If a selection has been made in the filter strip, the number of applied filters and the shown/total row information are added to the same line.

Page Size

The maximum number of profiles to be displayed on the page is selected. The default is 20; the options are 5, 10, 20, 50, 100, 200, 500 and All.

Right-Click Menu

When a row is right-clicked, a menu with the profile's name in its title opens. Both operations in the menu apply only to the right-clicked profile; a selection made in the list does not affect the menu.

Operation	What it does
Edit	Opens the editing form of the profile in the Edit tab; it is the same as the form opened by the Edit button in the toolbar.
Delete	Deletes the right-clicked profile; the same confirmation question as the deletion in the toolbar is displayed.

Preview of the Selected Profile

When a row in the list is clicked, the preview of the profile opens on the right of the screen; when the selected row is clicked again, the panel closes. In the title there are the profile icon, the name of the profile and the VService limits profile subtitle, and at the top right there is a single operation.

Preview of the Selected Profile

Operation	What it does
Edit	Opens the editing form of the profile in the Edit tab.

The panel has three tabs; the last one is displayed only if there is a vService that uses the profile:

Details

Lists the settings of the profile line by line (the table below).

Log

Lists the user operations on the profile (adding, editing, deleting) as a timeline.

Used in

Lists the vServices on which the profile is used. The badge next to the tab name shows the number of usages; if there is no vService that uses the profile, the tab is not displayed at all.

The rows in the Details tab are as follows, in order:

Row	Description	Visibility condition
Name	The name of the profile.	Always
Max. Total Connections	The defined limit value.	Always
Max. Failed Connection Retries	The defined limit value.	Always
Max. New Connecions/s	The defined limit value.	Always
Max. Connections/s	The defined limit value.	Always
Max. Session Rate/s	The defined limit value.	Always
Max. Total SSL Connections	The defined limit value.	Always
Max. SSL Connections/s	The defined limit value.	Always
Buffer Size(kB)	The defined limit value.	Always

The "Used in" tab must be checked

The Used in tab shows on which vServices the profile is active. Since updates to the profile settings in a live environment will immediately affect all bound services, evaluating the possible service impacts before a change is critically important.

Profile Add Form

A new vService Limits Profile is added on the TR7 device by following the Load Balancer → Profiles → vService Limits → Add steps.

vService Limits Profile Add Form

Some field changes restart the service

The Max. Connections/s, Max. Session Rate/s, Max. Total SSL Connections, Max. SSL Connections/s and Buffer Size(kB) fields are written into the general configuration of the vService engine; a change made in these fields cannot be applied with an uninterrupted refresh and the related load balancer service is restarted automatically at the save (a short interruption occurs). The Max. Total Connections, Max. Failed Connection Retries and Max. New Connecions/s changes, on the other hand, are applied uninterruptedly.

INFO

Name Required

A unique name is entered for the profile to be created. When a name that is in use is entered, the form gives a Name is used warning and the record is not completed.

INFO

Max. Total Connections Default: 20,000

The maximum number of simultaneous connections that the vService can accept at any moment is determined. When this limit is reached, the new connections are not rejected; they are held without being accepted until some of the existing connections close. It prevents the excessive consumption of the system resources and makes the vService work at a controlled capacity. An integer between 0 – 1,000,000,000 can be entered in the interface. In the records made through the API and the Web CLI the upper limit is 1,000,000; a record above this value is rejected with the "Number must be at most 1000000" error.

INFO

Max. Failed Connection Retries Default: 3

When a connection attempt to a Backend Service fails, how many times it will be retried to the same server is determined. When the retries are exhausted, the request is considered failed and a 503 response is returned to the client; this field does not disable the server or move the traffic to other servers (the server health is managed with the Health Checks profile). A value between 0 – 1,000 can be entered.

INFO

Max. New Connecions/s Default: 5,000

The maximum number of new connections that the vService listener will accept per second is determined (the field label is in the product with this spelling). This limit takes the sudden traffic increases and the potential connection-based attacks under control. When the limit is exceeded, the excess connections are not rejected; they are held without being accepted until the rate decreases. A value of 0 and above can be entered; the form comes preloaded with 5,000; when the field is emptied, no limit is applied.

INFO

Max. Connections/s Default: 10,000

The total number of connections that the vService engine will accept per second is limited. Its difference from Max. New Connecions/s is the scope: while that value is applied at the listener level, this value is valid for the whole vService engine. A value of 0 and above can be entered; the form comes preloaded with 10,000; when the field is emptied, no limit is applied.

INFO

Max. Session Rate/s Default: 10,000

The maximum number of sessions that the vService engine can create per second is determined. By controlling the session creation rate, it prevents the system from remaining under an excessive session load. A value of 0 and above can be entered; the form comes preloaded with 10,000; when the field is emptied, no limit is applied.

INFO

Max. Total SSL Connections Default: 5,000

The maximum number of simultaneous SSL/TLS connections that the vService can manage at any moment is determined. Since the SSL handshakes and the encryption operations are CPU intensive, this limit prevents the excessive consumption of the system resources. A value of 0 and above can be entered; the form comes preloaded with 5,000; when the field is emptied, no limit is applied.

INFO

Max. SSL Connections/s Default: 2,000

The maximum number of new SSL connections that can be processed per second is determined. Every new SSL connection requires a resource-intensive handshake operation; this limit keeps the load of the SSL operations on the system under control. A value of 0 and above can be entered; the form comes preloaded with 2,000; when the field is emptied, no limit is applied.

INFO

Buffer Size(kB) Required Default: 128

The size, in terms of kB, of the memory area that the vService uses per connection while processing the request and response data is determined. Larger values make it possible for large request/response headers to be processed; however, they increase the memory consumption per connection. A value between 16 – 262,144 kB can be entered; the form comes preloaded with 128.

The buffer applied at the save is the larger of this value and (if there is one) the body parsing limit in the WAF profile. This buffer also limits the servable size of the content pages that TR7 produces itself (blocking, CAPTCHA); if large custom pages are going to be used, the value must be increased accordingly.

INFO

Add

The profile adding process is completed by clicking the Add button.

How to Add to a vService?

A vService Limits Profile is assigned to a vService by following the steps below.

1

Step 1 Go to the vServices screen

The Load Balancer → Load Balancer vService List path is followed in the TR7 web interface.

2

Step 2 Open the editing screen of the vService

The vService to which the profile will be added is right-clicked and Edit is selected; or the vService is clicked and the Edit icon is clicked in the window that opens on the right.

3

Step 3 Enable the vService limits feature

On the Details panel on the right of the editing screen of the vService, the feature is put into effect by marking the vService limits option. When it is marked, the built-in Default profile comes selected; on a new vService this option starts off.

INFO

That the option is off does not mean that the limits are disabled; in this situation the vService works with the values of the built-in Default profile. The option only makes it possible for a different profile to be assigned.

The vService Limits Selection on the vService Editing Screen

4

Step 4 Select a profile or add a new one

In order to use a profile other than Default, the arrow sign next to the row is clicked and a selection is made from the list in the expanding section.

If desired, a new profile can also be added through the vService editing screen by clicking the Add button.

5

Step 5 Save

The changes are saved by clicking the Save button; while the configuration is being applied to the vService, the "vService is being edited" notification is displayed.