Fortinet 100 user manual 227

Network Intrusion Detection System (NIDS) Setting signature threshold values

For example, setting the icmpflood signature threshold to 500 will allow 500 echo requests from a source address, to which the system sends echo replies. If the number of requests is 501 or higher, the FortiGate unit will block the attacker to eliminate disruption of system operations.

If you enter a threshold value of 0 or a number out of the allowable range, the

FortiGate unit uses the default value.

Table 6: NIDS Prevention signatures with threshold values

Signature	Threshold value units	Default	Minimum	Maximum
abbreviation		threshold	threshold	threshold
		value	value	value
synflood	Maximum number of SYN segments	200	30	3000
	received per second
portscan	Maximum number of SYN segments	128	10	256
	received per second
srcsession	Total number of TCP sessions initiated	2048	128	10240
	from the same source
ftpovfl	Maximum buffer size for an FTP	256	128	1024
	command (bytes)
smtpovfl	Maximum buffer size for an SMTP	512	128	1024
	command (bytes)
pop3ovfl	Maximum buffer size for a POP3	512	128	1024
	command (bytes)
udpflood	Maximum number of UDP packets	2048	512	102400
	received from the same source or sent
	to the same destination per second
udpsrcsession	Total number of UDP sessions initiated	1024	512	102400
	from the same source
icmpflood	Maximum number of UDP packets	256	128	102400
	received from the same source or sent
	to the same destination per second
icmpsrcsession	Total number of ICMP sessions	128	64	2048
	initiated from the same source
icmpsweep	Maximum number of ICMP packets	32	16	2048
	received from the same source per
	second
icmplarge	Maximum ICMP packet size (bytes)	32000	1024	64000

To set Prevention signature threshold values:

1Go to NIDS > Prevention.

2Select Modify beside the signature for which you want to set the Threshold value.

Signatures that do not have threshold values do not have Modify icons.

3Type the Threshold value.

4Select the Enable check box.

5Select OK.

FortiGate-100 Installation and Configuration Guide 227