Technical Tip: Using Microsoft Teams with DOS policy

This article describes how to use Microsoft Teams with IPv4 DOS Policy on FortiGate.

Meetings/conferences held on Teams involve the communication of a large number of UDP packets. Due to the large number of UDP Packets, this can be picked up as a UDP Flood attack. 

This can easily trigger the UDP Flood threshold on the default settings of FortiGate's IPv4 DOS Policy, causing FortiGate to drop the UDP sessions. When these sessions are dropped, Microsoft Teams will run into issues such as call freezing, drops, immense stutter, etc.

FortiGate v6.2.x, v6.4.x, v7.0.x, v7.2.x and above., For FortiOS versions that are End of Support, upgrade.

Microsoft Teams requires TCP ports 80,443, and UDP ports 3478-3481.

Refer to this document: Security and Microsoft Teams.

As the DOS Policy is seen dropping UDP sessions for Teams, it will be necessary to allow the UDP ports that Microsoft Teams uses through the DOS Policy without sacrificing DOS Protection:

1. Create a Service Object that covers UDP Ports 3478-3481. On the GUI, go to Policy & Objects -> Services and select 'Create New'.
2. Ensure the Service Object is created as such for UDP Ports 3478-3481. Here, the packet is coming from the Teams server to FortiGate, so the source port will be 3478-3481. For the destination port, it will define the range of ephemeral port which is used for establishing a session. If there is a particular range in the environment, it is possible to use that here. 

By default, it is 49152-65535. Here is an example of what it should look like:

CLI:

config firewall service custom
edit "Teams udp ports" 
set udp-portrange 49152-65535:3478-3481
next
end

3. On the DOS policy, create a DOS policy and put it above the existing default DOS policies. This DOS policy is for allowing UDP Flood on UDP ports 3478-3481. This will be created on the WAN interface, where the Teams traffic is coming to FortiGate from the Teams server. 

In this DOS policy, ensure UDP Flood is set to Disable or Monitor.

Put this policy above the general block policy:

CLI:

config firewall DoS-policy
edit 1
set name "teams-bypass" 
set interface "port1"
set srcaddr "all"
set dstaddr "all"
set service "Teams udp ports"
config anomaly
edit "tcp_syn_flood"
set status enable
set log enable
set action block
set threshold 2000
next
edit "tcp_port_scan"
set status enable
set log enable
set action block
set threshold 1000
next
edit "tcp_src_session"
set status enable
set log enable
set action block
set threshold 5000
next
edit "tcp_dst_session"
set status enable
set log enable
set action block
set threshold 5000
next
edit "udp_flood"
set status enable
set log enable
set threshold 2000
next
edit "udp_scan"
set status enable
set log enable
set action block
set threshold 2000
next
edit "udp_src_session"
set status enable
set log enable
set action block
set threshold 5000
next
edit "udp_dst_session"
set status enable
set log enable
set action block
set threshold 5000
next
edit "icmp_flood"
set status enable
set log enable
set action block
set threshold 250
next
edit "icmp_sweep"
set status enable
set log enable
set action block
set threshold 100
next
edit "icmp_src_session"
set status enable
set log enable
set action block
set threshold 300
next
edit "icmp_dst_session"
set status enable
set log enable
set action block
set threshold 1000
next
edit "ip_src_session"
set status enable
set log enable
set action block
set threshold 5000
next
edit "ip_dst_session"
set status enable
set log enable
set action block
set threshold 5000
next
edit "sctp_flood"
set status enable
set log enable
set action block
set threshold 2000
next
edit "sctp_scan"
set status enable
set log enable
set action block
set threshold 1000
next
edit "sctp_src_session"
set status enable
set log enable
set action block
set threshold 5000
next
edit "sctp_dst_session"
set status enable
set log enable
set action block
set threshold 5000
next
end
next
end

This means that only traffic that matches UDP Port 3478-3481 will hit this DOS Policy and get permitted. Other traffic that does not match these criteria will hit the DOS Policies below it.

Note:

DOS policies are not bidirectional; it will only take care of traffic coming into the FortiGate interface where the DOS policy is configured. Make sure to apply appropriate source/destination ports and IPs coming into the firewall.

Ensure that the DoS policy direction is set to 'Ingress' on the WAN interface, as Microsoft Teams traffic is inbound from the internet to the internal network.

Results:

• Teams traffic will hit the teams-bypass DOS policy created.
• As the udp_flood parameter is set to Monitor, the traffic will pass through but get logged in the logs and shown as Action: detected.
• If the DOS policy blocks the traffic, the Action will be clear_session.