config : waf http-connection-flood-check-rule
 
waf http-connection-flood-check-rule
Use this command to limit the number of TCP connections per HTTP session. This can prevent TCP connection floods from clients operating behind a shared IP with innocent clients.
Excessive numbers of TCP connections per session can occur if a web application or client is malfunctioning, or if an attacker is attempting to waste socket resources to produce a DoS.
This feature is similar to config waf layer4-connection-flood-check-rule. However, this feature counts TCP connections per session cookie, while TCP flood prevention counts only TCP connections per IP address. Because it uses session cookies at the application layer instead of only TCP/IP connections at the network layer, this feature can differentiate multiple clients that may be behind the same source IP address, such as when the source IP address hides a subnet that uses network address translation (NAT). However, in order to work, the client must support cookies.
To apply this rule, include it in an application-layer DoS-prevention policy. See “config waf application-layer-dos-prevention”.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see “Permissions”.
Syntax
config waf http-connection-flood-check-rule
edit <rule_name>
set action {alert | alert_deny | block-period}
set block-period <seconds_int>
set http-connection-threshold <limit_int>
set severity {High | Medium | Low}
set trigger-policy <trigger-policy_name>
next
end
Variable
Description
Default
<rule_name>
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type:
edit ?
No default.
action {alert | alert_deny | block-period}
Select one of the following actions that the FortiWeb appliance will perform when the count exceeds the rate limit:
• alert — Accept the connection and generate an alert email and/or log message.
• alert_deny — Block the connection and generate an alert email and/or log message.
• block-period — Block subsequent requests from the client for a number of seconds. Also configure block-period <seconds_int>.
Caution: This setting will be ignored if monitor-mode {enable | disable} is enabled.
Note: Logging and/or alert email will occur only if enabled and configured. See “config log disk” and “config log alertemail”.
Note: If an auto-learning profile will be selected in the policy with offline protection profiles that use this rule, you should select alert. If the action is alert_deny, the FortiWeb appliance will reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For more information on auto-learning requirements, see “config waf web-protection-profile autolearning-profile”.
alert
block-period <seconds_int>
Type the length of time for which the FortiWeb appliance will block additional requests after a client exceeds the rate threshold.
The valid range is from 1 to 3,600 seconds.
1
http-connection-threshold <limit_int>
Type the maximum number of TCP connections allowed from the same client. The valid range is from 1 to 1,024.
1
severity {High | Medium | Low}
Select the severity level to use in logs and reports generated when a violation of the rule occurs.
Medium
trigger-policy <trigger-policy_name>
Type the name of the trigger to apply when this rule is violated (see “config log trigger-policy”). The maximum length is 35 characters.
To display the list of existing trigger policies, type:
set trigger ?
No default.
Related topics
• config log trigger-policy
• config waf application-layer-dos-prevention