Fortinet fortigate-50r Installationsanweisungen

For synflood signatures, you can set the threshold, queue size, and keep alive values.

Go to NIDS > Prevention.

Select Modify 

 for the synflood signature.

Type the Threshold value.

Type the Queue Size.

Type the Timeout value.

Select the Enable check box.
Alternatively, select the synflood Enable check box in the Prevention signature list.

Select OK.

Whenever the NIDS detects or prevents an attack, it generates an attack message. 
You can configure the system to add the message to the attack log. 

•

•

Use the following procedure to log attack messages to the attack log. 

Go to Log&Report > Log Setting.

Select Config Policy for the log locations you have set.

Select Attack Log.

Select Attack Detection and Attack Prevention. 

Select OK.

Threshold

Number of SYN requests sent to a 

destination host or server per second. If the 

SYN requests are being sent to all ports on 

the destination, as opposed to just one port, 

the threshold quadruples (4 x).

30

3000

200

Queue Size

Maximum number of proxied connections 

that the FortiGate unit handles. The 

FortiGate unit discards additional proxy 

requests.

10

10240

1024

Timeout

Number of seconds for the SYN cookie to 

keep a proxied connection alive. This value 

limits the size of the proxy connection table.

3

60

15

Note: For information about log message content and formats, and about log locations, see the 
Logging Configuration and Reference Guide.