Skip to main content
Myth
Myth
New Member
August 27, 2018
Question

UDP Flood Protection

  • August 27, 2018
  • 5 replies
  • 24968 views

Hi everyone, 

 

I have an issue with some UDP traffic. I am using Aspera Faspex for secure file transfers, this protocol uses UDP traffic. We are sending and receiving packages over 100GB. This is exactly what this platform is designed for and, in the most part, works well.

 

I have a network, sitting behind a FG-501E, where my downloads are randomly dropping from 100mbps to 20kbps and then basically stalls and never resumes until, with manual intervention, we resume the transfer. Then it picks back up to 100mbps no problem for a variable amount of time - until it invariably stalls back down to a trickle, 5-20kbps.

 

I have support ticket in with IBM and they have suggested it could be some level of UDP flood protection on the firewall.

 

I have, currently, next to no active security services running on this interface. Just basic policies for traffic.

 

If there was something like UDP protection configured, either by default or by user, where would it be? How can I check this and determine if it is the FG-501E?

 

many thanks!

Ollie

    5 replies

    darwin_FTNT
    Staff
    darwin_FTNT
    Staff
    August 27, 2018

    UDP Flood protect is configured in a DoS policy type.  In the CLI, you can check for any enabled policy:

     

    config firewall DoS-policy     edit 1         set status enable         set comments ''         set interface ''         config anomaly             edit "tcp_syn_flood"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 2000             next             edit "tcp_port_scan"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 1000             next             edit "tcp_src_session"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 5000             next             edit "tcp_dst_session"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 5000             next             edit "udp_flood"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 2000             next             edit "udp_scan"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 2000             next             edit "udp_src_session"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 5000             next             edit "udp_dst_session"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 5000             next             edit "icmp_flood"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 250             next             edit "icmp_sweep"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 100             next             edit "icmp_src_session"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 300             next             edit "icmp_dst_session"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 1000             next             edit "ip_src_session"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 5000             next             edit "ip_dst_session"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 5000             next             edit "sctp_flood"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 2000             next             edit "sctp_scan"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 1000             next             edit "sctp_src_session"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 5000             next             edit "sctp_dst_session"                 set status disable                 set log disable                 set action pass                 set quarantine none                 set threshold 5000             next         end     next  end

     

    In GUI, the above policy is configured in Policy & Objects -> IPv4 DoS Policy or IPv6 DoS Policy.

     

    If any of the DoS policy is configured and enabled, kernel will keep track of any denial of service (DoS) or Distributed Denial of Service (DDoS) attacks.

     

    DoS Policy violations can be checked in the CLI (the example below is generated by 'diagnose log test' command):

     

    execute log filter category   Available categories:  0: traffic  1: event  2: utm-virus  3: utm-webfilter  4: utm-ips  5: utm-emailfilter  7: anomaly  8: voip  9: utm-dlp  10: utm-app-ctrl  12: utm-waf  15: dns  FW60Exxxxxxxxxxx # execute log filter category 7  FW60Exxxxxxxxxxx # execute log display  

     

    1: date=2018-08-26 time=23:01:58 logid="0720018432" type="anomaly" subtype="anomaly" level="alert" vd="root" eventtime=1535349718 severity="critical" srcip=32.78.16.172 srccountry ="United States" dstip=32.1.1.1 srcintf="VPN" srcintfrole="undefined" dstintf="dmz" dstintfrole="dmz" sessionid=0 action="clear_session" proto=6 service="tcp/20480" count=1 123 attack="tcp_syn_flood" srcport=2560 dstport=20480 attackid=100663396 policyid=0 ref="http://www.fortinet.com/ids/VID100663396" msg="anomaly: tcp_syn_flood" crscore=50 crlevel= "critical"

     

    In GUI, in is 'Log & Report' -> Anomaly

     

    See the following link for more information on DoS policy:

     

    http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-firewall-52/Firewall%20Policies/IPv4%20DoS%20Policy.htm

     

    Myth
    MythAuthor
    New Member
    August 27, 2018

    Darwin, - thanks for that solid bit of info. Really helpful.

     

    I looked and as I suspected I have no IPv4 DoS Policy. (Something to add to-do list).

    I also do not have Anomaly under "Log&Report". I assume that is because I have no DoS Policy?

     

    I am running v5.6.5

     

    With this being the case is it impossible for my firewall to be clamping down on UDP traffic?

     

    Cheers.

    James_G
    James_G
    New Member
    August 27, 2018
    Look for any DoS policy http://help.fortinet.com/...gate-firewall/Concepts - Firewall/DoS Protection.htm
    Myth
    MythAuthor
    New Member
    August 28, 2018

    Thanks very much James, I just wonder if I have absolutely no DoS policy defined (at either end) if this could really be having an impact on UDP traffic?

     

    Can anyone way in on that fact? Is there a default value setting if NO DoS policy exists?

    darwin_FTNT
    Staff
    darwin_FTNT
    Staff
    August 28, 2018

    If DoS policy isn't enabled, it won't be activated or triggered.

     

    To help find where the bug is, can try disable hardware acceleration:

     

    http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-hardware-acceleration-52/acceleration-overview.htm

     

    Specifically:

     

    For IPv4 security policies.

    config firewall policy

    edit 1

    set auto-asic-offload disable

    end

    For IPv6 security policies.

    config firewall policy6

    edit 1

    set auto-asic-offload disable

    end

     

    Also:

     

    config ips global

    set np-accel-mode {none | basic}

    set cp-accel-mode {none | basic | advanced}

    end

     

    The UDP ports used by application and the download sessions can be checked in CLI by:

     

    diagnose sys session list

     

    This is to make sure the protocol connections aren't blocked by firewall.  Without a session, packets will be dropped.

     

    See following for more info:

     

    http://kb.fortinet.com/kb/viewContent.do?externalId=FD30042

     

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!