FortiDDoS config

Hello,

I would not recommend to generate high traffic.

During the initial learning period you need to have normal traffic wihtout any attacks. After this period you will generate the system recommended thresholds + manually create some thresholds like for TCP 20-23, 443 etc.

Next you will monitor the thresholds and do a fine tuning of these thersholds for some days. After that you can go and put the SPPs into the prevention mode.

Generating high amount of traffic will cause to generate wrong thresholds for FortiDDoS and it can happen that you will bypass the protection.

Hello,

In this case, ignore what your VAR told you. Your instincts were correct.

Normally you need to attach the system to your Internet link(s). Note Odd ports (1,3,5..) must face your firewall or "inside" network and even ports (2,4,6..) must face the Internet. FortiDDoS is completely transparent -- it has no MAC nor IP addresses in the data path so it has no impact on the network when cabled in.

BUT - before cabling, connect to Mgmt 1 port, set up credentials and set up NTP (critical) and time-zone. Each of NTP and Time Zone settings causes a system reboot which will impact traffic if the system is cabled. FDD-600B has no bypass/fail-open capability.

You need to configure the public IPs you use for different services into Service Protection Profiles. Normally we suggest the following:

- Firewall, proxies, Wifi gateways or any predominantly outbound service

- Web servers

- VPN or other authenticating inbound servers

- DNS if you have a publically-accessible DNS server

First you define the Service Protection Policies (SPPs) - the categories above that are relevant to you.  Then you define the SPP Policies (subnets or /32s) that fit into each SPP.

- Be sure to include your full public subnet in an SPP.  If you have a /24, for example, and the above services only use 15 or 20 IPs, enter the full /24 in an SPP called "Full_Subnet" or similar.  You do not need to worry about a /24 and multiple /32s in the same /24 - the system figures that out. Attackers will attack any IP address that is routed to your network link, even addresses that are not in use.

Once you have the SPPs and subnets defined, you need to leave the system for about a week of learning. It will be transparent to all traffic but if you look at some graphs you will see "drops". When the SPPs are in Detection Mode (default) the system reports on bad packets it sees (showing "drops") but it never drops a packet.

The next step is setting System Thresholds.  There are 230,000 of these per SPP in each direction, so you cannot do that manually.  The system has a process.  If you get that far, either return to the forum for help or:

If the system is registered and you have any warranty available you can create a TAC ticket asking for implementation help.

Regards,

Steve Robinson

thank you very much