Technical Tip: Steps to consider on Initial Deployment FortiDDoS

Step1: Select a FortiDDoS whose interfaces (Configuring network interfaces) can match the:

• BW, the ISP Providers provide IPS BW = Portx BW.
• The native link rate. For example, an ISP may provide a capped 5 Gbps rate on a 10GE link. It is necessary to select a 10GE FortiDDoS (size the FortiDDoS to the 'native' link speed from the ISP, as FDD must work at the native rate).
• Consider fiber type. At 10GE, ISP can provide MM (multi-mode:1500F) or SM (single-mode fiber 1500F-LR).

Validate Datasheets:

• Serie-F p.9,.11 FortiDDoS Data sheets.
• Serie-B p.5 FortiDDoS-Series.
• More information link: Deployment topology - FortiDDOS Handbook.

Step 2. Set an SPP to protect the services provided. Example:

1. SPP-default (Default SPP-FortiDDOS Handbook): will be to monitor and regulate the packets that do not match any policy rule on a specific custom SPP.
2. Custom (Config SPP) for associate protected subnets under each SPP (all known traffic must be included in non-default SPPs).

• SPP-FWs: Will be for subnets under the Firewall.
• SPP-WEB Servers (HTTP, SSL Profile): These will be for subnets hosting the web servers or the DMZ zone.
• SPP-SMTP: This will be in case of hosting an internal email server.
• SPP-DNS (DNS SPP:( Will be for Internet-accessible local Authoritative DNS Servers, if present.
• SPP-FTP(FTP SPP:( This will be for FTP servers.
• SPP-NTP (see NTP Profile - FortiDDOS-F handbook:( This will be for internal NTP servers.
• SPP-VPN servers separate IP/subnet from the Firewall.

Note:

To associate the custom security profiles with each custom SPP (**): 

Service Protection -> Edit SPP-Name   <-- Then add (IP, ICMP, TCP, HTTP, SSL/TLS, NTP, DNS, DTLS) custom Profiles.

Step 3: In the maintenance window, set FortiDDoS on the network for the first time to learn traffic with SPPs in Detection/learning mode (the system is by default in Inline mode).

Step 4: Allow to learn traffic (Learning baseline - FortiDDOS Handbook) based on the topology:
Small Networks as a minimum: 5 - 7 days.
Big Networks or ISP Providers as a minimum: 15 days.

Step 5: After the learning mode time is met. Make the required adjustments to the FDD(**) and threshold(**) configuration and wait 3 days.

Step 6: Make any pending adjustments after 3 days and validate log reports to avoid false positives(**).

Step 7: After 3 days in a maintenance window, validating that legitimate traffic is not blocked, move from Detection to Prevention mode.

Step 8: Monitoring logs (Attack log Reference )and network services for a few days.

Important Note:

After FDD is in the production environment, if a manual entry is done, bypass and then return to inline mode (there will be about 5 seconds of traffic disruption when changed from bypass to inline). Be aware that there is about 5-6s of traffic outage when doing that. When removing the bypass, the system does not have TCP state information, and if the SPPs are in Prevention with Foreign Packet Validation enabled (it should be), all TCP connections will be dropped.

* During an FDD reboot (there will be about 5 seconds of traffic disruption).

Related documents:

• Introduction - FortiDDOS Handbook
• FortiDDoS

(**) If help is required with the implementation, consult Fortinet's professional services.