Fortinet 5.0 Patch 6 Grouping DoS protection rules

Fortinet 355 FortiWeb 5.0 Patch 6 Administration Guide

To configure TCP SYN flood protection

1. Go to DoS Protection > Network > Syn Cookie.

To access this part of the web UI, your administrator’s account access profile must have

Read and Write permission to items in the Web Protection Configuration category. For

details, see “Permissions” on page 47.

2. Enable Syn Cookie.

3. In Half Open Threshold, enter the maximum number of TCP SYN packets, including

retransmission, that may be sent per second to a destination address. If this threshold is

exceeded, the FortiWeb appliance assumes a DoS attack is occurring and ignores additional

traffic from that source IP address.

4. From the Severity drop-down list, select the severity level to include in logs and/or alert email

when this type of attack is detected.

5. From the Trigger Action drop-down list, select the trigger, if any, that defines which log

and/or alert email servers the FortiWeb appliance will use contact when the threshold is

exceeded (see “Configuring triggers” on page 557).

6. Click Apply.

Unlike other DoS protection features, you do not need to include this setting in a DoS

protection policy to make it effective. Once configured, the FortiWeb appliance applies SYN

flood protection immediately to all connections attempting to through it.