DOS vs DDOS

[ChampJomarC]

Dear Expert.

I just want to have a clear understanding with regard to the built-in feature of the FortiGate which is DoS. More often we are competing with other brands which offer both Dos and DDoS functionalities in a single NGFW device.

So it is safe to say that FortiGate works with DoS Policy only and it requires FortiDDoS to address the DDoS requirement?

[kaman]

Dear ChampJomarC,

A Denial of Service (DoS) policy examines network traffic arriving at a FortiGate interface for anomalous patterns, which usually indicate an attack.

A denial of service occurs when an attacking system starts an abnormally large number of sessions with a target system. The large number of sessions slows down or disables the target system, preventing legitimate users from using it.

Please find below the KB articles, I hope it would be helpful to you.

https://www.fortinet.com/resources/cyberglossary/dos-vs-ddos#:~:text=A%20denial%2Dof%2Dservice%20(,t....
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/771644/dos-policy
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-Denial-of-Service-DoS-protection...

Regards,
Aman

[ebilcari]

Basically modern forms of DoS attacks are usually Distributed DoS. FGT will offer protection for both types of attacks: https://docs.fortinet.com/document/fortigate/6.0.0/handbook/626319/inside-fortios-denial-of-service-...

[xsilver_FTNT]

Hi ChampJomarC,
I would safely say that FortiGate/FortiOS does handle DoS via DoS policies + has tools to detect botnets (DDoS sources) and C&C servers (those malicious actors who are masterminds behind enslaved devices know collectively as botnet). And so even base FortiGate/FortiOS can prevent traffic from both of those giving you solid basic DoS/DDoS protection.

However if you seek enterprise grade solution for bigger environments, then FortiDDoS is definitely better solution.

As that is not a firewall but purpose-built device specialized in one task only - prevent DoS/DDoS!

We at Fortinet tend to have a lot of features inside basic FortiOS and next level, enterprise grade, solutions which can scale and protect bigger customers with bigger needs (and so unfortunately bigger network presence = bigger surface = bigger risks).

FortiGate and FortiDDoS are not the only examples of those basic + enterprise grade solutions.

And that's basically all to your question on FortiOS and DDoS capabilities.

Should you need to handle/protect bigger network, then have a look also to other Forti family products. As complex protection is about cooperation and visibility. Check things like SIEM, FortiGuard services, Analyzer .. generally Fabric concept of connected devices and shared knowledge between those. Which can increase your visibility and reaction capabilities.