Technical Tip: Configure Denial of Service (DoS) protection with specific source country or geolocation

akileshc · ‎07-04-2023

Description

This article describes that configuring Denial of Service (DoS) protection with a specific source country or geolocation allows blocking or restricting traffic originating from specific countries or geographical regions.

This can help mitigate DoS attacks by preventing malicious traffic from entering the network infrastructure, reducing the impact of attacks, improving overall network performance, enhancing security posture, and providing additional control over network traffic based on geographic criteria.

Scope

FortiGate.

Solution

To create an address object, follow these steps:

Navigate to Policy & Objects and select Addresses.
Select the 'Create New' button or the '+' icon to create a new address object.
Provide a name for the address object to identify it.
Select the appropriate Type for the address object; In this case, it will be GEO (Geolocation).
Specify the country or geographical region for the address object.
Select the 'OK' or 'Save' button to create the address object.

By creating an address object, it is possible to define a specific geolocation to be used in DoS policies for filtering and controlling traffic based on geographic criteria.

To configure a DoS policy in FortiGate, follow these steps:

Log in to the FortiGate web-based management interface.
Go to Policy & Objects and select IPv4 DoS Policy.
Select the 'Create New' button or the '+' icon to create a new DoS policy.
Provide a name for the policy to identify it.
Select the address object configured with the geographical region as the Source Address (example: UAE_Traffic).
Configure the DoS protection settings based on the requirements. Some common settings include:

Define the threshold values for various DoS attack types, such as SYN Flood, UDP Flood, ICMP Flood, etc.
Configure the action to be taken when an attack is detected, such as blocking the traffic or generating an alert.
Optionally, it is possible to specify additional settings, such as enabling the logging options for individual or all objects.

7. Once the DoS policy settings are configured, select the 'OK' or 'Save' button to create the policy.

To configure the DoS via the CLI, use the following example :

config firewall DoS-policy

edit 1

set name "DoS_For_UAE_Traffic"

set interface "port1"

set srcaddr "UAE_Traffic"

set dstaddr "all"

set service "ALL"

config anomaly

edit "tcp_syn_flood"

set threshold 2000

set threshold 1000

set threshold 5000

set threshold 2000

set threshold 5000

set threshold 250

set threshold 100

set threshold 300

set threshold 1000

set threshold 5000

set threshold 2000

set threshold 1000

set threshold 5000

By configuring a DoS policy in FortiGate, it is possible to enhance network security by protecting against various types of DoS attacks and taking appropriate actions to mitigate the impact of such attacks.

Note:

It is up to the FortiGate Administrator to monitor the traffic and determine the correct threshold to apply for each environment.
As of v7.6.1, it is possible to specify an SD-WAN zone as an interface in the DoS policy.

Related article:

Technical Tip: How to enable DoS logs in FortiGate

Technical Tip: Configure Denial of Service (DoS) protection with specific source country or geolocation

You are leaving our website