Skip to main content
ShaileshMdr
ShaileshMdr
Explorer II
July 24, 2023
Question

IPv4 DoS Policy

  • July 24, 2023
  • 1 reply
  • 2404 views

Hi Community,

 

Is it possible to achieve the following case regarding DoS policy on FortiGate.

 

If a DoS attack is attempted by an attacker then FortiGate Quarantines the Attacker for 1 day.

If the same attacker tries to attempt another DoS attack after being removed from the Quarantine List after 1 day then block the attacker permanently. Is this possible?

 

Regards

Shailesh

 

1 reply

srajeswaran
Staff
srajeswaran
Staff
July 24, 2023

I think we can use the DOS policy action and automation stitch together to achieve this. I haven't tested it, but i believe its may work.

Step1.
Create a DOS policy with action as quarantine as explained in below document.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-DoS-protection-s-quarantine/ta-p/192590

Step2.
Create an automation stitch to execute action IP BAN based on the event log triggered for DOS attack and if we specify minimum 2 logs before executing the action, we can meet the condition of 2nd attempt after quarantine.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creating-the-automation-stitches/ta-p/195745


    ShaileshMdr
    ShaileshMdrAuthor
    Explorer II
    July 24, 2023

    Hello Srajeswaran,

     

    Yes I was thinking the same but the FortiOS version I am currently using does not include the automation and stitch feature. However I will try and upgrade my FortiGate and try using it.

     

    Regards,

    Shailesh

    Terms & ConditionsAccessibility statement