How effective is the DDoS feature in FortiGates?

[horus66]

I understand the point of a NGFW is to consolidat a stack of security appliances into one. But isn't the fiewall itself subject to DDoS attacks - esp since it doesn't act in stealth mode? Wouldn't it be best practice to have either a cloud based DDoS service or a dedicated and stealthed DDoS security appliance like FortiDDoS infront of the gateway firewall?

[AEK]

FortiGate/FortiOS is not immunized against DDoS (Distributed DoS). It can however block DoS attacks.

DDoS are by definition not detectable by a simple equipment like FGT, FWB or any other server.

As per my knowledge DDoS need some cooperation between ISPs. So I think the correct way to prevent DDoS attacks is to purchase the service from your ISP (if it is not already included in your package).