config security dos ip-fragmentation-protection
IP packet fragmentation ensures that IP datagrams can traverse various types of networks by splitting large packets into smaller ones for transmission, which are then reassembled by the receiving host. However, during a DDoS attack, malicious actors can exploit IP fragmentation by creating large fragmented datagrams designed to overwhelm router buffers. The objective of this attack is to rapidly consume system memory and network bandwidth.
To mitigate this, FortiADC allows administrators to limit the maximum memory usage per socket, control the maximum allowable distance between fragmented packets from the same source IP, and set a timeout for the reassembly of the entire fragmented packet. These measures help reduce the impact of fragmentation-based DDoS attacks.
Syntax
config security dos ip-fragmentation-protection
set max-memory-size <integer>
set min-memory-size <integer>
set time <integer>
set exception <datasource>
end
|
max-memory-size |
Defines the maximum memory size (in KB) allocated for IP fragmentation reassembly within the VDOM. When this limit is reached, FortiADC will stop reassembling fragmented packets. The default value is 4096 KB, with a valid range from 0 to 4096 KB. |
|
min-memory-size |
Specifies the minimum memory size (in KB) for IP fragmentation reassembly. When the total memory size falls below this threshold, reassembly will resume. The default value is 3072 KB, with a valid range from 0 to 4096 KB. |
|
time |
Sets the maximum lifetime (in seconds) for each fragmentation queue. If the queue exceeds this timeout, all fragmentation packets within the queue are discarded. The default value is 30 seconds, with a valid range from 0 to 256 seconds. |
|
exception |
Specify the DoS Exception configuration object. See config security dos exception. When the memory usage for fragmented packets reaches the configured Max Memory Size limit, FortiADC stops reassembling fragments and drops new fragmented traffic. However, if the source IP of a fragmented packet matches an exception rule, FortiADC continues to accept and forward the packet, bypassing the memory enforcement restriction. |
Example
configure security dos ip-fragmentation-protection
set max-memory-size 4096
set max-memory-size 3072
set time 30
set exception exception_1
end