Technical Tip: IPS anomaly mode settings for DOS sensor behaviour when action is set to ‘block’
Description
There are two different modes to configure the DOS sensor behavior when action is set to 'block'. This configuration option is a global setting that is applied to all VDOMs, it is found in the global section 'config ips global'.
Scope
FortiGate.
Solution
The default mode is 'continuous' which means that when the threshold is reached then all traffic matching the attack is blocked. The mode 'periodical' can be configured which means that once the attack threshold is reached then IPS will still allow packets matching the attack to go through at the threshold-based rate. This calculation is done per second.
The default mode is 'continuous' which means that when the threshold is reached then all traffic matching the attack is blocked. The mode 'periodical' can be configured which means that once the attack threshold is reached then IPS will still allow packets matching the attack to go through at the threshold-based rate. This calculation is done per second.
config global <This command is applicable in global VDOM only, when there are multiple VDOMs>
config ips global
set anomaly-mode continuous (default setting)
or
set anomaly-mode periodical
end
config ips global
set anomaly-mode continuous (default setting)
or
set anomaly-mode periodical
end
Where continuous block packets once the attack starts periodical allows a configured number of packets every second.
