config : waf layer4-connection-flood-check-rule
 
waf layer4-connection-flood-check-rule
Use this command to limit the number of fully-formed TCP connections per source IP address. This effectively prevents TCP flood-style denial-of-service (DoS) attacks.
TCP flood attacks exploit the fact that servers must consume memory to maintain the state of the open connection until either the timeout, or the client or server closes the connection. This consumes some memory even if the client is not currently sending any HTTP requests.
Normally, a legitimate client will form a single TCP connection, through which they may make several HTTP requests. As a result, each client consumes a negligible amount of memory to track the state of the TCP connection. However, an attacker will open many connections with perhaps zero or one request each, until the server is exhausted and has no memory left to track the TCP states of new connections with legitimate clients.
This feature is similar to config waf http-connection-flood-check-rule. However, this feature counts TCP connections per IP, while the other command counts TCP connections per session cookie.
It is also similar to config system dos-prevention. However, this feature counts fully-formed TCP connections, while the anti-SYN flood feature counts partially-formed TCP connections.
To apply this rule, include it in an application-layer DoS-prevention policy (see “waf application-layer-dos-prevention”) and include that policy in an inline protection profile.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For more information, see “Permissions”.
Syntax
config waf layer4-connection-flood-check-rule
edit <rule_name>
set layer4-connection-threshold <limit_int>
set action {alert | alert_deny | block-period}
set block-period <seconds_int>
set severity {High | Medium | Low}
set trigger-policy <trigger-policy_name>
next
end
Variable
Description
Default
<rule_name>
Type the name of a new or existing rule. The maximum length is 35 characters.
To display the list of existing rules, type:
edit ?
No default.
layer4-connection-threshold <limit_int>
Type enter the maximum number of TCP connections allowed from the same IP address. The valid range is from 0 to 65,536.
0
action {alert | alert_deny | block-period}
Select one of the following actions that the FortiWeb appliance will perform when the count exceeds the rate limit:
• alert — Accept the connection and generate an alert email and/or log message.
• alert_deny — Block the connection and generate an alert email and/or log message.
• block-period — Block subsequent requests from the client for a number of seconds. Also configure block-period <seconds_int>.
Caution: This setting will be ignored if monitor-mode {enable | disable} is enabled.
Note: Logging and/or alert email will occur only if enabled and configured. See “config log disk” and “config log alertemail”.
Note: If an auto-learning profile will be selected in the policy with offline protection profiles that use this rule, you should select alert. If the action is alert_deny, the FortiWeb appliance will reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For more information on auto-learning requirements, see “config waf web-protection-profile autolearning-profile”.
alert
block-period <seconds_int>
Type the length of time for which the FortiWeb appliance will block additional requests after a source IP address exceeds the rate threshold.
The block period is shared by all clients whose traffic originates from the source IP address. The valid range is from 1 to 3,600 seconds (1 hour).
1
severity {High | Medium | Low}
Select the severity level to use in logs and reports generated when a violation of the rule occurs.
Medium
trigger-policy <trigger-policy_name>
Type the name of the trigger to apply when this rule is violated (see “config log trigger-policy”). The maximum length is 35 characters.
To display the list of existing trigger policies, type:
set trigger ?
No default.
Example
This example illustrates a basic TCP flood check rule.
config waf layer4-connection-flood-check-rule
edit "Web Portal Network Connect Limit"
set action alert_deny
set layer4-connection-threshold 10
set severity Medium
set trigger-policy "Server_Policy_Trigger"
next
end
Related topics
• config log trigger-policy
• config waf application-layer-dos-prevention
• config waf layer4-access-limit-rule