• Detection—Logs events and builds traffic statistics for the profile but does not limit or block traffic.

• Prevention—Limits and blocks traffic that exceeds thresholds.

• Detection—Logs events and builds traffic statistics for the profile but does not limit or block traffic.

• Prevention—Limits and blocks traffic that exceeds thresholds.

• Inbound

• Outbound

• ACK cookie—Sends the client two ACK packets: one with a correct ACK number and another with a wrong number. The system determines whether the source is spoofed based on the client’s response. If the client’s response indicates that the source is not spoofed, FortiDDoS allows the connection and adds the source to the legitimate IP address table. Fortinet recommends this option if you have enough bandwidth in the reverse direction of the attack.

• SYN cookie—Sends a SYN/ACK with a cookie value in the TCP sequence field. If it receives an ACK back with the right cookie, an RST/ACK packet is sent and the IP address is added to the legitimate IP address table. If the client then retries, it succeeds in making a TCP connection. Fortinet recommends this option if you cannot use ACK Cookie and you anticipate high volume attacks. Fortinet recommends this option if you cannot use ACK Cookie and you anticipate high volume attacks.

• SYN retransmission—Drops the initial SYNs to force the client to send a SYN again. If the expected number of retransmitted SYNs arrive within the predetermined time period, the system considers the source to be legitimate. FortiDDoS then allows the connection to go through and adds the source to the legitimate IP address table. Fortinet recommends this option if you cannot use ACK Cookie and you anticipate low volume attacks.

• Fixed—Does not use the adaptive limit. The configured minimum thresholds are the maximum limits.

• Adaptive—Uses the adaptive limit. The configured minimum thresholds multiplied by the adaptive limit are the maximum limits.

• seq-validation—The FortiDDoS TCP state machine ensures that TCP sequence numbers for the packets within a session are valid.

• syn-validation—Required to support SYN Flood Mitigation. During a SYN flood, the TCP state machine allows only TCP SYNs from IP addresses in the legitimate IP address (LIP) table (sources that have done a three-way handshake in the past). SYNs from source IP addresses that do not have an entry in the LIP table must pass a SYN Flood Mitigation challenge to be added to the LIP table. If syn-validation is enabled and SYN Flood Mitigation is not enabled, then during a flood, packets from sources not in the legitimate IP address table are not given the opportunity to complete the antispoofing challenge. The packets will be dropped.

• state-transition-anomalies-validation—The TCP state machine ensures that TCP state transitions follow the rules. For example, if an ACK packet is received when FortiDDoS has not observed a SYN/ACK packet, it is a state transition anomaly.

• foreign-packet-validation—The TCP state machine drops TCP packets without an existing TCP connection and reports them as a foreign packet. In most cases, the foreign packet validation is useful for filtering out junk, but enabling it is not important. The number of foreign packets can be high, so the system does not store the source and destination of each packet. Therefore, you might not be able to determine the origin of a foreign packet. Foreign packet drops are logged in the DDoS Attack Log (State Anomalies event).

• allow-tuple-reuse—Allow this exception to seq-validation (if enabled). Otherwise, seq-validation detects the anomaly and drops the packets. It logs the anomaly as a “State Anomalies: Outside window” event. When the “allow” option is enabled, the FortiDDoS TCP state machine updates the TCP entry when a tuple is reused. This update occurs only during the closed or close-wait, fin-wait, time-wait states, when the connection is just about to retire. Useful in testing environments where test equipment reuses tuples in rapid succession. Enabled by default. Recommended.

• allow-duplicate-syn-in-syn-sent—Allow this exception to seq-validation (if enabled). Otherwise, seq-validation detects the anomaly and drops the packets. It logs the anomaly as a “State Anomalies: Outside window” event. When the “allow” option is enabled, the TCP state machine allows duplicate TCP SYN packets during the SYN-SENT state. It allows this type of packet even if the sequence numbers are different. Disabled by default. We suggest you enable this in Detection Mode.

• allow-duplicate-syn-in-syn-recv—Allow this exception to seq-validation (if enabled). Otherwise, seq-validation detects the anomaly and drops the packets. It logs the anomaly as a “State Anomalies: Outside window” event. When the “allow” option is enabled, the TCP state machine allows duplicate TCP SYN packets during the SYN-RECV state. It allows this type of packet even if the sequence numbers are different. Disabled by default. Normally these violations are not expected in real-world traffic but might be seen in test environments.

• allow-syn-anomaly, allow-syn-ack-anomaly, allow-ack-anomaly, allow-rst-anomaly, allow-fin-anomaly—Allow these exceptions to state-transition-anomalies-validation (if enabled). Otherwise, state-transition-anomalies-validation detects the anomaly and drops the packets. It logs the anomaly as a “State Anomalies: State transition error” event. When the “allow” options are enabled, the TCP state machine allows duplicate TCP packets during any other state even if the sequence numbers are different from the existing connection entry. This is equivalent to allowing the packet without updating an existing connection entry with the new information from the allowed packet. Disabled by default. Normally these violations are not expected in real-world traffic but might be seen in test environments. In most cases, these options should remain disabled to enforce TCP compliance.

• high-concurrent-connection-per-source—Sends a TCP RST to the server to reset idle connections from the identified source when the maximum is reached for the concurrent-connection-per-source threshold.

• high-concurrent-connection-per-destination—Sends a TCP RST to the server to reset idle connections when the maximum is reached for the concurrent-connection-per-destination threshold. Enabled by default.

• layer7-flood—Sends a TCP RST to the server to rest idle connections when a Layer 7 flood is detected.

• track-slow-tcp-connections—Sends a TCP RST to the server to reset idle connections from the identified source when the slow connection attack thresholds set on the Global Settings > Settings page are reached.