FortiDDoS opinions

[inayarens]

Hey there,

For those who are running and managing FortiDDoS in your corporate network, what do you think about it? I don't really care if you're running SoHo, DC or carrier-class devices, just looking for feedback about the full product.

I have several questions about stability and effectiveness of it, posting it just in case someone can reply his personal experience.

1. How stable is it as a hardware appliance ?

2. How effective is it stopping DDoS attacks ? When successful, what was the vector attack?

3. How often does it trigger false positives ?

Cheers!

[Anonymous]

Hello @inayarens ,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[ddsouza_FTNT · Accepted solution]

1. How stable is it as a hardware appliance ?
My answer: I am from the TAC department. As per my experience, the device is pretty stable hardware-wise. But I would leave it to the FDDoS customer's comment on this question.

2. How effective is it stopping DDoS attacks?When successful, what was the vector attack?
My answer: FDDoS keeps track of 230,000 parameters covering layer, Layer4 and Layer7 of the OSI layer model such as Most-Active-source, Protocols, TCP Ports, UDP Ports, HTTP-GET etc... So the answer is "it depends" on what attack was targeted towards your infrastructure. If the attack vector used was a UDP fragment, then FDDoS would drop the UDP fragmented packets exceeding the threshold. In the case of a Volumetric attack where an attacker can use many attack vectors, you would see FDDoS dropping packets matching various parameters.

3. How often does it trigger false positives ?
My answer: Again answer is "it depends". It depends on the traffic pattern, configuration of the FDDoS and the downstream device(firewall) or the protected server.

The amount of packets/sec changes depending on the time of the year, as the number of users grows and so on, so the thresholds are defined for various parameters (syn, syn per source, tcp port 80/443...) that need to be updated. The administrator needs to review the DDoS attack logs, and graphs at least once a month after the initial service protection profile was configured.

Some of the settings on the downstream devices or the protected server also has a say with the false positives drops. For example, in the TCP profile configuration on FDDoS, you can set the "TCP Session Idle Timeout Unit". By default, it is set to 1023 seconds. If the idle session timer on the server or firewall(server is connected behind the firewall) connected behind the FDDoS is higher than the FDDoS, then the subsequent packets sent by external IP(client) or Server after a pause of 1023 seconds would be considered as foreign packets by FDDoS and it would drop the packets if the operation mode is set to 'Prevention'