NSE Training

Dear Admin ,

How to block Ddos dns amplification attack inbound with Fortinet 60F version 6.2.4 ?

Thanks You

Hi,

The capability is limited, recommend using the FortiDDOS appliance which has much greater DDOS mitigation.

KR

Justin
Original Message:
Sent: Jun 01, 2020 06:42 AM
From: nguyen viet
Subject: DDOS

Dear Admin ,

How to block Ddos dns amplification attack inbound with Fortinet 60F version 6.2.4 ?

Thanks You

ok thank have a great day
Original Message:
Sent: Jun 21, 2020 09:20 AM
From: Justin Gibbs
Subject: DDOS

Hi,

The capability is limited, recommend using the FortiDDOS appliance which has much greater DDOS mitigation.

KR

Justin
Original Message:
Sent: Jun 01, 2020 06:42 AM
From: nguyen viet
Subject: DDOS

Dear Admin ,

How to block Ddos dns amplification attack inbound with Fortinet 60F version 6.2.4 ?

Thanks You

that will be great but can you give more information ant link reference
Original Message:
Sent: Jun 01, 2020 06:42 AM
From: nguyen viet
Subject: DDOS

Dear Admin ,

How to block Ddos dns amplification attack inbound with Fortinet 60F version 6.2.4 ?

Thanks You

Thanks you for reply ,

I has been block DDOS via Splunk with command active response block source ip address
Original Message:
Sent: Jun 22, 2020 11:05 PM
From: ATAICO DIALLO
Subject: DDOS

that will be great but can you give more information ant link reference
Original Message:
Sent: Jun 01, 2020 06:42 AM
From: nguyen viet
Subject: DDOS

Dear Admin ,

How to block Ddos dns amplification attack inbound with Fortinet 60F version 6.2.4 ?

Thanks You

this is an older version but it still applies to v6.2
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-firewall-52/Firewall%20Policies/IPv4%20DoS%20Policy.htm
Original Message:
Sent: Jun 01, 2020 06:42 AM
From: nguyen viet
Subject: DDOS

Dear Admin ,

How to block Ddos dns amplification attack inbound with Fortinet 60F version 6.2.4 ?

Thanks You

Dear Jonathan ,
Thanks you for reply
 
I have test on DoS policy but it was not effective with DNS TXT records . I think use Splunk monitor with active response command base on TXT records it best solution for small company 

I think best solution  with large company use Cloud Akamai protection DDoS
Original Message:
Sent: Jun 23, 2020 09:04 AM
From: Jonathan Rennie
Subject: DDOS

this is an older version but it still applies to v6.2
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-firewall-52/Firewall%20Policies/IPv4%20DoS%20Policy.htm
Original Message:
Sent: Jun 01, 2020 06:42 AM
From: nguyen viet
Subject: DDOS

Dear Admin ,

How to block Ddos dns amplification attack inbound with Fortinet 60F version 6.2.4 ?

Thanks You

Hi Nguyen,
Did you try this with by adjusting the defaults on udp_dst_session as the defaults might be too big and let the attack pass??
Original Message:
Sent: Jun 23, 2020 07:09 PM
From: nguyen viet
Subject: DDOS

Dear Jonathan ,
Thanks you for reply
 
I have test on DoS policy but it was not effective with DNS TXT records . I think use Splunk monitor with active response command base on TXT records it best solution for small company 

I think best solution  with large company use Cloud Akamai protection DDoS
Original Message:
Sent: Jun 23, 2020 09:04 AM
From: Jonathan Rennie
Subject: DDOS

this is an older version but it still applies to v6.2
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-firewall-52/Firewall%20Policies/IPv4%20DoS%20Policy.htm
Original Message:
Sent: Jun 01, 2020 06:42 AM
From: nguyen viet
Subject: DDOS

Dear Admin ,

How to block Ddos dns amplification attack inbound with Fortinet 60F version 6.2.4 ?

Thanks You