Technical Tip: How to configure IP's that should not be dropped or blocked by the FortiDDoS

[Anonymous]

Description

This article explains how to add IP's on the FortiDDoS that should not be tracked.

Scope

FortiDDoS.

Solution

Packets for the IPs added to the 'Do not track' Policy are forwarded without inspection. Otherwise, packets are evaluated against sets of built-in rules and user-defined rules.

There are two types of Action:

• Configuring Do Not Track / Track and Allow policies, never drop or block packets to/from these IP addresses; do not include them in the statistics for continuous learning and threshold estimation.
• Track and Allow.   Never drop or block packets to/from these IP addresses; include them in the statistics for continuous learning and threshold estimation.

To configure with the CLI, use a command sequence similar to the following:

config ddos global {do-not-track-policy | do-not-trackpolicy-v6}

    edit <name>

        set do-not-track-IP-address <Ip_address_object>

        set do-not-track-action {track-and-allow | do-not-track}

    end

To configure with the CLI, use a command sequence similar to the following:

config ddos global local-address

edit
    set ip-netmask <address_ipv4netmask>
end