FortiOS 6.0.2- IPv4 DoS Policy

[andrewbailey]

Hi Everyone,

I'm running FortiOS 6.0.2 on a Fortigate 60E and having a few issues with IPv4 DOS Policies.

I've exposed an NTP server to the Internet and added into the NTP Pool.

However, as you might expect, I'm seeing a few issues from users/ systems who just wont play nice and are triggering my existing IPv4 WAN side DoS policy.

I'd like to fine tune the behaviour here a little so have a couple of specific questions:-

1. Can I run more than one DoS policy on an interface (eg one specifically for an NTP server/ service)?   (I presume the answer is yes, but my experiements here so far have been unsuccessful- the new NTP DoS policy never seems to get triggered and the main WAN policy is getting hit all the time. Again, my assumption is that the order of the policies is important, but even moving the new NTP policy to the top of the list it doesn't seem to get hit).

2. Under 6.0.2 I don't seem to be able to change the quarintine time for a source IP that triggers the DoS policy. I would like to increase it from the 1 hour setting, but despite applying the changes from CLI it doesn't appear to change or apply (I am the only admin on the system- so not a question of user rights....).

3. I'm set for email alerts on the Fortigate for Critical events. Every NTP DoS attack is currently triggering an email. Is there an easy way to prevent these alerts being genrated for a specific DoS policy or specific anomoly? (This would be even better if I could get a separte NTP server/ service DoS policy working and then ignore most alerts for that).

Thanks for any help or suggestions you are able to offer.

Kind Regards,

Andy.

[neonbit · Accepted solution]

1. Yes you can run multiple DOS policies, the order does matter. Do you mind sharing your NTP policy configuration?

2. You can change the quarantine timer via the CLI, the command is set quaratine-expiry #d#h#m, if you want to quarantine by days, hours or minutes.

3. If you have a FortiAnalyzer you can use it to generate alerts separately for the NTP DOS policy and your standard WAN one. I don't think you can separate these using the FortiGate by itself.

[andrewbailey]

Hi neonbit,

Thanks for the feedback.

For 1.) Here is the DoS policies relating to the WAN port (covering the "standard" DoS which does trigger and the NTP DoS which doesn't seem to be catching anything. For the NTP DoS I've only really tried to activate "ip_dst_session" and "udp_dst_session" as these have been the main ones triggered. Scans etc are caught by the main "WAN" DoS policy. I've omitted LAN side DoS polices):-

config firewall DoS-policy     edit 5         set comments "For External NTP"         set interface "WANIPv6"         set srcaddr "all"         set dstaddr "ntp.armournetworks.co.uk"         set service "NTP"         config anomaly             edit "tcp_syn_flood"                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 60             next             edit "tcp_port_scan"                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 10             next             edit "tcp_src_session"                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 100             next             edit "tcp_dst_session"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 300             next             edit "udp_flood"                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 100             next             edit "udp_scan"                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 100             next             edit "udp_src_session"                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 100             next             edit "udp_dst_session"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-expiry 1h                 set threshold 300             next             edit "icmp_flood"                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 50             next             edit "icmp_sweep"                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 10             next             edit "icmp_src_session"                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 30             next             edit "icmp_dst_session"                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 100             next             edit "ip_src_session"                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 100             next             edit "ip_dst_session"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-expiry 1h                 set threshold 300             next             edit "sctp_flood"                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 100             next             edit "sctp_scan"                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 100             next             edit "sctp_src_session"                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 100             next             edit "sctp_dst_session"                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 100             next         end     next

edit 1         set interface "WANIPv6"         set srcaddr "all"         set dstaddr "all"         set service "ALL"         config anomaly             edit "tcp_syn_flood"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 60             next             edit "tcp_port_scan"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 10             next             edit "tcp_src_session"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 1500             next             edit "tcp_dst_session"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 1500             next             edit "udp_flood"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 9000             next             edit "udp_scan"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 200             next             edit "udp_src_session"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 500             next             edit "udp_dst_session"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-expiry 1h                 set threshold 500             next             edit "icmp_flood"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 50             next             edit "icmp_sweep"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 10             next             edit "icmp_src_session"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 30             next             edit "icmp_dst_session"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 100             next             edit "ip_src_session"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 500             next             edit "ip_dst_session"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-expiry 1h                 set threshold 500             next             edit "sctp_flood"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 200             next             edit "sctp_scan"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 100             next             edit "sctp_src_session"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 500             next             edit "sctp_dst_session"                 set status enable                 set log enable                 set action block                 set quarantine attacker                 set quarantine-log disable                 set threshold 500             next         end     next end

Policy 5 (the "NTP Specifc") DoS policy has been ordered to the top of the DoS Policy list in the GUI (as I would expect it to need to be).

2.) That's exactly the command I have used to try and increase the quarantine times. However the change "accepts" (ie no CLI errors) but when you review the change it still shows 3600 seconds (1 hour) as shown in the policies above. Not quite sure why..... perhaps I need to run some diag while I try and make the changes in case it is something "quirky" in 6.0.2?

3.) OK. Thanks- that could be a good suggestion. I have a FAZ running on AWS so maybe that's a better place to handle the reporting overall. I'll take a look.

Thanks again, happy to hear any other thoughts you have.

Kind Regards,

Andy.