API Gateway does not respect the Apply Rate Limit "blackout period" setting

Products

• STARTER PACK-7
• CA Rapid App Security
• CA API Gateway

Issue/Introduction

The CA API Gateway can apply rate limits to inbound requests based upon certain conditions such as requestor IP addresses, requested SOAP operations, or other custom conditions. There is an internal process that flushes rate limiters on a periodic basis. This rate limiter may flush some blacked out limits if a certain condition is met. Specifically: If the "Blackout" setting is configured with a value that would exceed 13613 milliseconds then the Gateway will need to be reconfigured to accommodate this setting and avoid preemptively flushing any applicable limits.

If there are policies with an Apply Rate Limit assertion then verify whether the "Blackout" checkbox is enabled and if the blackout time is a value exceeding 13 seconds. If any assertions have a value exceeding 13 seconds then please refer to the Resolution section of this article for subsequent configuration procedures

Environment

Release:
Component: APIGTW

Resolution

1. Log in to the Policy Manager as an administrative user
2. Open the Manage Cluster-Wide Properties task
3. Set the ratelimit.cleanerPeriod cluster-wide property to a value (in milliseconds) that exceeds any blackout times set in the Apply Rate Limit assertions
4. Allow up to a minute for the change to propagate
5. Restart the API Gateway if the change does not appear to resolve the issue