FortiDDOS

[Chris_001]

I have recently installed a FortiDDOS in-line in detection/learning mode but we are unable to get to a specific website with the DDOS box in place. I was not aware that it would block any traffic when in learning mode rather than prevention. We see drops against State Anomalies: Foreign packet, I believe these are logical drops that would be dropped if the profile was set to prevention? Or are the drops detailed actual drops? Thanks

[danilody]

Hi Chris, Are you using A-Series or B-Series and what firmware version? If you are referring to the logs, FortiDDoS logs will show block traffic even in detection mode but its not actually blocking it. It was built that way, possibly to save resources for not having a separate logging for detection mode. I haven' t use A-series, but in B-Series the older firmware versions (4.0 Build0040 and older) have dos protection enabled by default. To disable it you have to access the CLI and execute " exe dos-control disable" and have to do it again if you reboot the device. HTH