ZPA Causing RDS MySQL "connect_max_errror"

We currently were a Palo Alto GlobalProtect VPN shop. Now we just rollout ZPA to replace it. One of the issue we are running into is when our remote user try to access our AWS RDS MySQL server, it is maxing out the threshold of allow “max_connect_error” from a given host/source (Zscaler Connector). We don’t have this issue while running on GPVPN. The default allowed “connect_max_error” within RDS is set to 100. for now we have increase it to 10,000; but our Cybersec does not like it do to a security risk.

For the time being, our database team would have to go an flush the connection via the command below to restore access back to our remote users on ZPA.

rds max_connect_errors

This parameter indicates how many connection errors are possible before the server blocks a host. If more than max_connect_errors successive connection requests from a host are interrupted without a successful connection, the server blocks that host from further connections. The default value is 100 and can be tuned to your security requirements and environment.

For example, if max_connect_errors=5000 , after 5,000 connection requests from Host X are interrupted you get an error like the following:

Host X is blocked because of many connection errors ().

Unblock the host using the following command:

mysql> flush hosts;

Is this max connections problem perhaps being caused by the Health Check?

@GordonWright Thank you. That’s a good point you brought up. Currently we have “Health Check” set to “default”.

Will set “Health Check” to “None” update this post later with the result.

Thank you.

We’ve had similar problems with other apps but Zscaler did reduce the number of Health Check probes with the v6.0 release.

1 Like

Chan Khen, this is most likely an artefact of Health Monitoring for that App. Are you seeing any difference with Health Checks disabled?

1 Like

Updates: It’s been over a week now that we have disabled Health Check for the AWS RDS MySQL application segment. I’m happy to report that we have not had any ticket or incident with the “max_connect_error” ever since on any RDS servers.

2 Likes

Thanks for the update! Glad the issue is resolved.