Blocking DoS attack on dns-udp helper

[PMeyer]

Gurus, I have an 80C (MR3 Patch2) that is under a sustained DoS attack and need some advice on how to effectively block/drop the originating IP' s traffic. The originating IP (87.106.249.76) is pushing lots of dns-udp packets to which the fw helper responds. I have configured a DoS Policy with very low thresholds, but the fortigate still responds to the packets with ' msg=" run helper-dns-udp(dir=original)" ' in debug tracing. Seems like the fw responds to helpers before it processes DoS or firewall policies. I have removed the dns-udp helper definition from the global settings, have not restarted the fw yet though, not sure if I need to restart the fw before it will remove the dns-udp helper? Any advice on how to effectively block/drop any packets from the originating IP? Regards Paul Trace log extract : id=36871 trace_id=8441 msg=" vd-root received a packet(proto=17, 87.106.249.76:80->xxx.xxx.xxx.xxx:53) from internal1." id=36871 trace_id=8441 msg=" Find an existing session, id-01d6a1d3, original direction" id=36871 trace_id=8441 msg=" run helper-dns-udp(dir=original)" id=36871 trace_id=8471 msg=" vd-root received a packet(proto=17, xxx.xxx.xxx.xxx:53->87.106.249.76:80) from local." id=36871 trace_id=8471 msg=" Find an existing session, id-01d6a218, reply direction" id=36871 trace_id=8471 msg=" run helper-dns-udp(dir=reply)"

[ede_pfau]

Hi, so the source is requesting a DNS resolve from the DNS on the Fortigate (dest=local)? One should expect these kind of attacks from WAN but in your case it looks like it' s coming from the LAN. Anyway, you can try this: a DoS signature only blocks a running attack. A triggered IPS signature can additionally quarantine the source IP for a certain period of time. IPS consumes more ressources than DoS policy but in your case it would trigger instantly, and then block the source IP for say 20 minutes. So you' ll get at most 72 attacks logged per day. References: http://support.fortinet.com/forum/tm.asp?m=81338&p=1&tmode=1&smode=1 showing the rate signature in detailed screenshots. HTH.

[PMeyer]

ede_pfau, Thanx for the IPS pointer. I will look at the reference. I' m not running any DNS services on the firewall, nor do I have any DNS servers that are accessible from the internet. " internal1" is actually my WAN interface (100M port) and using the gigabit interfaces " wan1" & " wan2" for the LAN. It seems to me that the helper services on the fortigate itself responds before any DoS/IPS/firewall policies are evaluated and/or triggered, hence the " from local" replies in spite of a DoS policy and a firewall policy blocking all traffic from the originating IP. I' ve logged a call with Fortinet support, but yeah, getting them to even acknowledge the ticket within the SLA timeframe is proving to be another challenge. Regards Paul