Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Fortinet / Fortigate ICMP 3/3 Blacknurse vulnerable?




"Blacknurse is a low bandwidth ICMP attack that is capable of doing denial of service to well known firewalls.


Most ICMP attacks that we see are based on ICMP Type 8 Code 0 also called a ping flood attack.


BlackNurse is based on ICMP with Type 3 Code 3 packets. We know that when a user has allowed ICMP Type 3 Code 3 to outside interfaces, the BlackNurse attack becomes highly effective even at low bandwidth.


Low bandwidth is in this case around 15-18 Mbit/s. This is to achieve the volume of packets needed which is around 40 to 50K packets per second. It does not matter if you have a 1 Gbit/s Internet connection."


Anyone care to comment this? Any comments on how to mitigate correctly?






New Contributor

Here's a custom IPS signature to mitigate the issue on FortiGate.


I have seen this article, but since the IPS functionality is located very late in the packet flow ingress, I have a hard time believing that this will actually protect the firewall's CPU from getting overloaded?


Can you confirm that this also protects the firewall and not only devices behind the firewall?



The IPS defends the systems behind the FW. The DoS policy (ICMP flood) should be set to protect the firewall. The only limitation on FortiGate is that DOS Policy applies to all ICMP traffic, not just Blacknurse.

For a more sophisticated solution you'll need the FortiDDOS.

Esteemed Contributor III

If your trying to defend against a low volume icmp-flood on the firewall  with a dos/ips sensor , you've  already lost in a small way.



The best way to mitigate this issues,  is with a upstream policer  that prevents less say   no more than 5-10% of the link speed with any ICMP packet.


yes apply a   policer-shaper with a set peak for imp at  5% of a 1gige link. We've been doing this type approach for years if not  decades. Also why on earth with anybody let 15-100mbps or icmp traffic into a network or to a single host for example.


just my 2cts 






PCNSE NSE StrongSwan
New Contributor



I agree with you on the upstream policer but it can't be set everywhere. E.g. think of a basic internet access; the provider won't set it for you, yet your FW is still exposed.


This is the order of packet processing on FortiGate:

  • Receiving the packet on the ingress interface
  • DOS Policy
  • IP integrity checking
  • IPSec decapsulation
  • DNAT
  • Unicast RPF check
  • ALG (session helper)
  • Self (handling packets destined to the FW)
  • Identity policy
  • Traffic shaping
  • Session management
  • FW policy lookup (within this: IPS checks)
  • Routing (i.e. finding the outgoing interface)
  • IPSec encapsulation
  • Putting the packet on the egress interface[/ol]


    As you can see, setting the DOS Policy is useful because that's the first thing that gets evaluated when a packet hits the FW, hence it protects the device. (Of course it requires CPU cycles but at least it's way before the complex checks.)

  • emnoc
    Esteemed Contributor III

    Of course it requires CPU cycles but at least it's way before the complex checks.)


    Your last line states why it's not effective. Not only  are you  wasting  CPU you wasted inbound BW that's not recovered. if you filter this upstream or at least at the  egress interface of the edge-router facing the security lan devices, you at least drop the traffic from hitting the security appliance



    Look at this way, if I flood your WAN link with 50mbps or icmp just to hit a sensor to be drop, that 50mbps  of traffic still consumed bandwidth of your link.


    Most modern edge routers have some ways to rate limit icmp messages  and specially destination  unreachable it so easily to apply and should be BCPs for now. Agin we've  been doing this in  the ISP/SP and DDoS arena for years if not decades and any half witted ISP/SP could easily deploy this on a  cisco device 


    e.g  (  control what your router sends )


    (cisco iOS )

    config t

    ip icmp rate-limit unreachable 100 1000

    do copy run start




    (cisco IOS-XR)


    icmp ipv4 rate-limit unreachable 2000





    ( junos)

    you use a filter with drop as the action


    A  simple egress policy with a drop on imp would drop anything that's being forward to the FW, hence protecting the firewall from a flood event w/icmp unreach


    Also a NGFW is smart enough to session track or drop these type3 to a inside host if it tracks    sessions details  


    just my 2cts  input 







    PCNSE NSE StrongSwan

    Select Forum Responses to become Knowledge Articles!

    Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

    Top Kudoed Authors