UDP Flood Protection

Myth · ‎08-26-2018

Hi everyone,

I have an issue with some UDP traffic. I am using Aspera Faspex for secure file transfers, this protocol uses UDP traffic. We are sending and receiving packages over 100GB. This is exactly what this platform is designed for and, in the most part, works well.

I have a network, sitting behind a FG-501E, where my downloads are randomly dropping from 100mbps to 20kbps and then basically stalls and never resumes until, with manual intervention, we resume the transfer. Then it picks back up to 100mbps no problem for a variable amount of time - until it invariably stalls back down to a trickle, 5-20kbps.

I have support ticket in with IBM and they have suggested it could be some level of UDP flood protection on the firewall.

I have, currently, next to no active security services running on this interface. Just basic policies for traffic.

If there was something like UDP protection configured, either by default or by user, where would it be? How can I check this and determine if it is the FG-501E?

many thanks!

Ollie

darwin_FTNT · ‎08-26-2018

UDP Flood protect is configured in a DoS policy type. In the CLI, you can check for any enabled policy:

config firewall DoS-policy edit 1 set status enable set comments '' set interface '' config anomaly edit "tcp_syn_flood" set status disable set log disable set action pass set quarantine none set threshold 2000 next edit "tcp_port_scan" set status disable set log disable set action pass set quarantine none set threshold 1000 next edit "tcp_src_session" set status disable set log disable set action pass set quarantine none set threshold 5000 next edit "tcp_dst_session" set status disable set log disable set action pass set quarantine none set threshold 5000 next edit "udp_flood" set status disable set log disable set action pass set quarantine none set threshold 2000 next edit "udp_scan" set status disable set log disable set action pass set quarantine none set threshold 2000 next edit "udp_src_session" set status disable set log disable set action pass set quarantine none set threshold 5000 next edit "udp_dst_session" set status disable set log disable set action pass set quarantine none set threshold 5000 next edit "icmp_flood" set status disable set log disable set action pass set quarantine none set threshold 250 next edit "icmp_sweep" set status disable set log disable set action pass set quarantine none set threshold 100 next edit "icmp_src_session" set status disable set log disable set action pass set quarantine none set threshold 300 next edit "icmp_dst_session" set status disable set log disable set action pass set quarantine none set threshold 1000 next edit "ip_src_session" set status disable set log disable set action pass set quarantine none set threshold 5000 next edit "ip_dst_session" set status disable set log disable set action pass set quarantine none set threshold 5000 next edit "sctp_flood" set status disable set log disable set action pass set quarantine none set threshold 2000 next edit "sctp_scan" set status disable set log disable set action pass set quarantine none set threshold 1000 next edit "sctp_src_session" set status disable set log disable set action pass set quarantine none set threshold 5000 next edit "sctp_dst_session" set status disable set log disable set action pass set quarantine none set threshold 5000 next end next end

In GUI, the above policy is configured in Policy & Objects -> IPv4 DoS Policy or IPv6 DoS Policy.

If any of the DoS policy is configured and enabled, kernel will keep track of any denial of service (DoS) or Distributed Denial of Service (DDoS) attacks.

DoS Policy violations can be checked in the CLI (the example below is generated by 'diagnose log test' command):

execute log filter category Available categories: 0: traffic 1: event 2: utm-virus 3: utm-webfilter 4: utm-ips 5: utm-emailfilter 7: anomaly 8: voip 9: utm-dlp 10: utm-app-ctrl 12: utm-waf 15: dns FW60Exxxxxxxxxxx # execute log filter category 7 FW60Exxxxxxxxxxx # execute log display

1: date=2018-08-26 time=23:01:58 logid="0720018432" type="anomaly" subtype="anomaly" level="alert" vd="root" eventtime=1535349718 severity="critical" srcip=32.78.16.172 srccountry ="United States" dstip=32.1.1.1 srcintf="VPN" srcintfrole="undefined" dstintf="dmz" dstintfrole="dmz" sessionid=0 action="clear_session" proto=6 service="tcp/20480" count=1 123 attack="tcp_syn_flood" srcport=2560 dstport=20480 attackid=100663396 policyid=0 ref="http://www.fortinet.com/ids/VID100663396" msg="anomaly: tcp_syn_flood" crscore=50 crlevel= "critical"

In GUI, in is 'Log & Report' -> Anomaly

See the following link for more information on DoS policy:

http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-firewall-52/Firewall%20Policies/IPv4%...

Myth · ‎08-27-2018

Darwin, - thanks for that solid bit of info. Really helpful.

I looked and as I suspected I have no IPv4 DoS Policy. (Something to add to-do list).

I also do not have Anomaly under "Log&Report". I assume that is because I have no DoS Policy?

I am running v5.6.5

With this being the case is it impossible for my firewall to be clamping down on UDP traffic?

Cheers.

James_G · ‎08-27-2018

Look for any DoS policy http://help.fortinet.com/...gate-firewall/Concepts - Firewall/DoS Protection.htm

Myth · ‎08-27-2018

Thanks very much James, I just wonder if I have absolutely no DoS policy defined (at either end) if this could really be having an impact on UDP traffic?

Can anyone way in on that fact? Is there a default value setting if NO DoS policy exists?

darwin_FTNT · ‎08-27-2018

If DoS policy isn't enabled, it won't be activated or triggered.

To help find where the bug is, can try disable hardware acceleration:

http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-hardware-acceleration-52/acceleration...

Specifically:

For IPv4 security policies.

config firewall policy

edit 1

set auto-asic-offload disable

end

For IPv6 security policies.

config firewall policy6

edit 1

set auto-asic-offload disable

end

Also:

config ips global

set np-accel-mode {none | basic}

set cp-accel-mode {none | basic | advanced}

end

The UDP ports used by application and the download sessions can be checked in CLI by:

diagnose sys session list

This is to make sure the protocol connections aren't blocked by firewall. Without a session, packets will be dropped.

See following for more info:

http://kb.fortinet.com/kb/viewContent.do?externalId=FD30042