IPS anomaly thresholds

• All FortiGate units.

Some Anomaly attacks have a threshold associated with it. The administrator can fine-tune anomaly settings by giving different thresholds for different connections based on source subnet, destination subnet and service (destination port) of the connection. Multiple entries can be configured to one anomaly. For any new connection, the threshold of the best-match entry is applied.

To configure the anomaly threshold, use the following CLI command as an example:

config ips anomaly syn_flood
   config limit
     edit 1
        set dst_ip 10.1.1.0/24
        set service 80
        set threshold 500
     end
end

The table below includes the anomalies and their units for each threshold.