Example — three flood threshold levels with different actions for each threshold
You can set up to three threshold levels to take different actions at different levels of activity.
The first example threshold records log messages when a subscriber’s handset displays erratic behavior by sending multiple messages using MM1 at a relatively low threshold. The erratic behavior could indicate a problem with the subscriber’s handset. For example, you may have determined for your network that if a subscriber sends more the 45 messages in 30 minutes that you want to record log messages as a possible indication or erratic behavior.
From the web‑based manager in an MMS profile set message Flood Threshold 1 to:
Enable | Selected |
Message Flood Window | 30 minutes |
Message Flood Limit | 45 |
Message Flood Action | Log |
From the CLI:
config firewall mms-profile
edit profile_name
config flood mm1
set status1 enable
set window1 30
set limit1 45
set action1 log
end
end
Set a second higher threshold to take additional actions when a subscriber sends more that 100 messages in 30 minutes. Set the actions for this threshold to log the flood, archive the message that triggered the second threshold, and block the sender for 15 minutes.
From the web‑based manager in an MMS profile set message Flood Threshold 2 to:
Enable | Selected |
Message Flood Window | 30 minutes |
Message Flood Limit | 100 |
Message Block Time | 15 minutes |
Message Flood Action | Log, DLP archive First message only, Block |
From the CLI:
config firewall mms-profile
edit profile_name
config flood mm1
set status2 enable
set window2 30
set limit2 100
set action2 block log archive-first
set block-time2 15
end
end
Set the third and highest threshold to block the subscriber for an extended period and sand an administrator alert if the subscriber sends more than 200 messages in 30 minutes. Set the actions for this threshold to block the sender for four hours (240 minutes), log the flood, archive the message that triggered the third threshold, and send an alert to the administrator.
From the web‑based manager in an MMS profile set message Flood Threshold 3 to:
Enable | Selected |
Message Flood Window | 30 minutes |
Message Flood Limit | 200 |
Message Block Time | 240 minutes |
Message Flood Action | Log, Block, Alert Notification |
Because you have selected the Alert Notification action you must also configure alert notification settings. For this example, the source MSISDN is 5551234—telephone number 555-1234. When administrators receive MMS messages from this MSIDSN they can assume a message flood has been detected.
In this example, alert notifications are sent by the FortiOS Carrier unit to the MMSC using MM1. The host name of the MMSC is mmscexample, the MMSC URL is /, and the port used by the MMSC is 80. In this example, the alert notification window starts at 8:00am and extends for eight hours on weekdays (Monday-Friday) and the minimum interval between message flood notifications is two hours.
Source MSISDN | 5551234 |
Message Protocol | MM1 |
Hostname | mmscexample |
URL | / |
Port | 80 |
Notifications Per Second Limit | 0 |
Window Start Time | 8:00 |
Window Duration | 8:00 |
Day of Week | Mon, Tue, Wed, Thu, Fri, Sat |
Interval | 2 hours |
From the CLI:
config firewall mms-profile
edit profile_name
config notification alert-flood-1
set alert-src-msisdn 5551234
set set msg-protocol mm1
set mmsc-hostname mmscexample
set mmsc-url /
set mmsc-port 80
set rate-limit 0
set tod-window-start 8:00
set tod-window-duration 8:00
set days-allowed monday tuesday wednesday thursday friday
set alert-int 2
set alert-int-mode hours
end
end
You must also add the MSISDNs of the administrators to be notified of the message flood. In this example, the administrator flood threshold 3 alert notifications are sent to one administrator with MSISDN 5554321.
To add administrator’s MSISDNs for flood threshold 3 from the web‑based manager when configuring a protection profile, select MMS Bulk Email Filtering Detection > Recipient MSISDN > Create New.
MSISDN | 5554321 |
Flood Level 3 | Select |
From the CLI:
config firewall mms-profile
edit profile_name
config notif-msisdn
edit 5554321
set threshold flood-thresh-3
end
end