Troubleshooting Tip: How to protect an SSID against a DoS – Deauth / Disassoc attack

[rain]

Description	This article describes how to protect against a DoS Auth attack using the Broadcast Suppression features over the SSID configuration.
Scope	FortiGate, FortiAP.
Solution	There are scenarios where a bad actor wants to stop the service over an SSID or wireless service, and one of the attacks to do it is using a method of flooding the channel and attacking a direct BSSID with a flood of Auth/DeAuth packets in order to stop the service and/or take out the users over that SSID. In order to detect if the SSID is under an attack of this nature, go to Log and Report -> System Events -> Wifi Events. In the next example, the SSID 'grimreaper' will be shown as a target of the DoS attack with multiple packets being sent to it in order to stop the services with packets of 'Disassoc' and 'Deauth'. In order to stop this kind of attack, enable over the SSID the feature 'Broadcast Suppression' with the next options: ARP poison. ARPs for known clients. ARPs for unknown clients. All other broadcast. All other multicast. After enabling this, the attack should not result in the stop of the services.