Configuring synflood signature values | Network Intrusion Detection System (NIDS) |
|
|
Configuring synflood signature values
For synflood signatures, you can set the threshold, queue size, and keep alive values.
Value | Description | Minimum | Maximum | Default |
|
| value | value | value |
Threshold | Number of SYN requests sent to a | 30 | 3000 | 200 |
| destination host or server per second. If the |
|
|
|
| SYN requests are being sent to all ports on |
|
|
|
| the destination, as opposed to just one port, |
|
|
|
| the threshold quadruples (4 x). |
|
|
|
Queue Size | Maximum number of proxied connections | 10 | 10240 | 1024 |
| that the FortiGate unit handles. The |
|
|
|
| FortiGate unit discards additional proxy |
|
|
|
| requests. |
|
|
|
Timeout | Number of seconds for the SYN cookie to | 3 | 60 | 15 |
| keep a proxied connection alive. This value |
|
|
|
| limits the size of the proxy connection table. |
|
|
|
1Go to NIDS > Prevention.
2Select Modify 
for the synflood signature.
3Type the Threshold value.
4Type the Queue Size.
5Type the Timeout value.
6Select the Enable check box.
Alternatively, select the synflood Enable check box in the Prevention signature list.
7Select OK.
Logging attacks
Whenever the NIDS detects or prevents an attack, it generates an attack message.
You can configure the system to add the message to the attack log.
•Logging attack messages to the attack log
•Reducing the number of NIDS attack log and email messages
Logging attack messages to the attack log
Use the following procedure to log attack messages to the attack log.
1Go to Log&Report > Log Setting.
2Select Config Policy for the log locations you have set.
3Select Attack Log.
4Select Attack Detection and Attack Prevention.
5Select OK.
Note: For information about log message content and formats, and about log locations, see the
Logging Configuration and Reference Guide.
228 | Fortinet Inc. |
