Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ChampJomarC
New Contributor II

DOS vs DDOS

Dear Expert.

 

I just want to have a clear understanding with regard to the built-in feature of the FortiGate which is DoS. More often we are competing with other brands which offer both Dos and DDoS functionalities in a single NGFW device.

So it is safe to say that FortiGate works with DoS Policy only and it requires FortiDDoS to address the DDoS requirement?

 

3 REPLIES 3
kaman
Staff
Staff

Dear ChampJomarC,

 

A Denial of Service (DoS) policy examines network traffic arriving at a FortiGate interface for anomalous patterns, which usually indicate an attack.

A denial of service occurs when an attacking system starts an abnormally large number of sessions with a target system. The large number of sessions slows down or disables the target system, preventing legitimate users from using it.

Please find below the KB articles, I hope it would be helpful to you.

 

https://www.fortinet.com/resources/cyberglossary/dos-vs-ddos#:~:text=A%20denial%2Dof%2Dservice%20(,t....
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/771644/dos-policy
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-Denial-of-Service-DoS-protection...

 

Regards,
Aman

ebilcari
Staff
Staff

Basically modern forms of DoS attacks are usually Distributed DoS. FGT will offer protection for both types of attacks: https://docs.fortinet.com/document/fortigate/6.0.0/handbook/626319/inside-fortios-denial-of-service-...

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
xsilver_FTNT
Staff
Staff

Hi ChampJomarC,
I would safely say that FortiGate/FortiOS does handle DoS via DoS policies + has tools to detect botnets (DDoS sources) and C&C servers (those malicious actors who are masterminds behind enslaved devices know collectively as botnet). And so even base FortiGate/FortiOS can prevent traffic from both of those giving you solid basic DoS/DDoS protection.

 

However if you seek enterprise grade solution for bigger environments, then FortiDDoS is definitely better solution.

As that is not a firewall but purpose-built device specialized in one task only - prevent DoS/DDoS!

 

We at Fortinet tend to have a lot of features inside basic FortiOS and next level, enterprise grade, solutions which can scale and protect bigger customers with bigger needs (and so unfortunately bigger network presence = bigger surface = bigger risks).

FortiGate and FortiDDoS are not the only examples of those basic + enterprise grade solutions.

 

And that's basically all to your question on FortiOS and DDoS capabilities.

 

Should you need to handle/protect bigger network, then have a look also to other Forti family products. As complex protection is about cooperation and visibility. Check things like SIEM, FortiGuard services, Analyzer .. generally Fabric concept of connected devices and shared knowledge between those. Which can increase your visibility and reaction capabilities.

 

Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors