Skip to main content
lowprofile
lowprofile
New Member
July 13, 2015
Question

DoS attack FROM inside network

  • July 13, 2015
  • 1 reply
  • 2601 views

Hi

 

How can we protect when e.x a wordpress site get hacked and DoS booter script uploaded and used for DoS attacks against others, typically UDP flood. From internal (behind ftg) to internet

 

The thing is fortigate gets "jammed/freezed" or atleast we see packetloss all services behind fortigate. We tried to use traffic shaper, but somehow it passes the limitation.

 

e.x we set it to 200mbit (out pipeline is 1Gbit), in both direction but still the interface generate 1000mbit outgoing flood. We tried the flood DoS policy on LAN-WAN, it didnt work as well... It cant be truth that everything just get blocked due to 1 script which is making so much traffic.

 

how to protect against such kind of problem? 

    1 reply

    emnoc
    emnoc
    New Member
    July 13, 2015

    Just place a dos-sensor on the lan interface for traffic policy that allows udp. This along with controlling the exact services you allow outbound, should be enough. 

     

    ATS is not the correct way for mitigating and udp_flooding & remember all policies and DoS Sensor does NOT do anything with eliminating the flooding on the local wire when it comes to udp

     

    You really need to find and ID the source(s) and correct the host.

     

    Terms & ConditionsAccessibility statement