DOS Policy threshold behavior

Hi, the usual behavoir is that packets exceeding the threshold are dropped immediately and a log entry should be generated.

Maybe keep in mind that if your company is using MS Teams, there could be problems when UDP flood DOS is in place, see this:
 

Greetings

“From internal to public” ? Do you mean you protect Internet from hosts in LAN DOSing the hosts on the Internet? If so, it would be the 1st such usage in history of Fortigates. If you mean from Internet to the Fortigate, then be aware that all the thresholds in DDOS policy are absolute, Layer 4 based and has no understanding of the applications used. This means, for example,  if you open multiple video/audio streaming apps - Zoom/Teams and such, and they all use UDP, Fortigate will block such legit traffic if it reaches the pre-defined value.   

So if you are 100% sure you want to use this feature, first monitor your daily traffic patterns and usage to know what the regular UDP/TCP packets rate and set DDOS thresholds accordingly. There is no “best practices” here as each network has its own unique traffic patterns. My own best practice with DDoS policy on FOrtigate is never to use it. 

Additionally, you can go through below technical tip.