VirtualServer connection rate limiting overview¶

F5 BIG-IP Local Traffic Manager (LTM) on Cloud-Native Network Functions (CNF) supports connection rate limiting on VirtualServer custom resources. Rate limiting controls how many new connections a virtual server accepts within a given time period. This helps you protect backend applications from traffic spikes and limit requests from specific sources.

You configure rate limiting inline within the VirtualServer Custom Resource Definition (CRD). No separate custom resource is required.

How rate limiting works¶

When you enable rate limiting on a VirtualServer, the system tracks incoming connections and compares them against the limit you set. If traffic exceeds the configured rate, the system drops the connection and logs an error message.

You can apply rate limits using seven different modes. Each mode changes how the system groups and counts connections.

Rate limiting modes¶

Mode	Description
Per virtual server	Applies the rate limit to all connections on this virtual server as a single counter
Per virtual server and source address	Groups connections by source IP subnet. Uses the source mask to determine the subnet size
Per virtual server and destination address	Groups connections by destination IP subnet. Uses the destination mask to determine the subnet size
Per virtual server, destination and source address	Groups connections by both source and destination IP subnets
Per source address (all rate-limiting virtual servers)	Applies a shared rate limit based on source address across all virtual servers with rate limiting enabled
Per destination address (all rate-limiting virtual servers)	Applies a shared rate limit based on destination address across all virtual servers with rate limiting enabled
Per source and destination address (all rate-limiting virtual servers)	Applies a shared rate limit based on both source and destination addresses across all virtual servers with rate limiting enabled

Rate limiting mode values¶

Mode value	Behavior
`object`	Rate limit applies to the virtual server as a whole
`object-source`	Rate limit grouped by source IP subnet
`object-destination`	Rate limit grouped by destination IP subnet
`object-source-destination`	Rate limit grouped by both source and destination subnets
`source`	Rate limit by source address, shared across all rate-limiting virtual servers
`destination`	Rate limit by destination address, shared across all rate-limiting virtual servers
`source-destination`	Rate limit by source and destination, shared across all rate-limiting virtual servers

Monitoring and notifications¶

When the system hits a configured rate limit, it:

Increments tmstat counters that you can view with tmctl -dblade -w140 rst_cause_stat
Logs an error message:
- "Virtual <name> exceeded configured rate limit." for virtual server limits
- "Node <address> exceeded configured rate limit." for node-level limits

Configure connection rate limiting for a VirtualServer¶

You can limit the rate of new connections to a virtual server to protect your backend applications from traffic spikes. Rate limiting settings are defined inline in the F5VirtualServer custom resource using the connectionRateLimit section.

Before you begin¶

You have a working F5 BIG-IP LTM on CNF deployment.
You have an existing VirtualServer custom resource, or you are ready to create one.

Configure basic rate limiting¶

To limit the total number of new connections per second on a virtual server, add the connectionRateLimit section to your VirtualServer spec.

Create or edit your VirtualServer custom resource YAML file.

Add the connectionRateLimit section under spec:

apiVersion: k8s.f5net.com/v1
kind: F5VirtualServer
metadata:
  name: http-vs
  namespace: default
spec:
  destinationAddress: 11.11.11.111
  destinationPort: 8083
  protocol: tcp
  protocolProfile:
    clientside: http-tcp
    serverside: http-tcp
  http:
    clientside: http
    serverside: http
  snat:
    type: automap
  connectionRateLimit:
    rateLimit: 1000
    rateLimitMode: object-source-destination
    rateLimitSourceMask: 16
    rateLimitDestinationMask: 24

Apply the configuration.
```
oc apply -f your-virtualserver.yaml
```

Verify the resource was created.

oc get f5virtualserver http-vs -n default

Configure rate limiting by source and destination address¶

To apply rate limits based on source IP, destination IP, or both, set the rateLimitMode and the corresponding subnet masks.

Edit your VirtualServer custom resource YAML file.

Configure the connectionRateLimit section with mode and masks:

connectionRateLimit:
  rateLimit: 1000
  rateLimitMode: object-source-destination
  rateLimitSourceMask: 16
  rateLimitDestinationMask: 24

In this example:

- The rate limit is 1,000 connections per second.

- Connections are grouped by both source /16 subnet and destination /24 subnet.

Apply the configuration:
```
oc apply -f your-virtualserver.yaml
```

Verify rate limiting is active¶

When the rate limit is exceeded, the system logs error messages.

To check for rate limit log entries, look for messages as shown below:

Virtual <name> exceeded configured rate limit.

Multi pods and connection rate limit¶

Rate limits are divided across pods.
Division is skipped for all rate limit mode source (source, source-destination, object-source, or object-source-destination) and the source mask is a full host mask (/32 for IPv4, /128 for IPv6).
Connection rate limits per pod are recalculated during each TMM scaling event based on the total number of active TMM pods. Each pod independently monitors its current traffic rate; however, active connection rate data is not shared between pods. This lack of inter-pod communication limits the ability to enforce connection rate limits at the cluster level.

Note

Connection rate limit is not supported when httpRouter is set to true. This is as per design and is consistent with TMOS.