Configuring a TCP Slow Data Flood Protection policy

A Slow Data attack occurs when legitimate application-layer requests are made, but responses are read at an extremely slow rate. This technique aims to exhaust the target's connection pool by advertising a small value for the TCP Receive Window size while gradually emptying the client's TCP receive buffers. The result is an exceptionally low data transfer rate, effectively stalling communication.

The primary goal of this attack is to slowly consume system resources, such as memory and CPU, without triggering immediate detection. To mitigate this, connections can be disabled if probe packets fail to be sent within the configured zero-window timer.

Before you begin:

• You must have Read-Write permission for Security settings.

After you have configured HTTP Request Flood policies, you can select them in DoS Protection Profile.

To configure a TCP Slow Data Flood Protection policy:

1. Navigate to Network Security> Networking.
   The configuration page displays the IP Fragmentation Protection tab.
2. Click the TCP Slow Data Flood Protection tab.
3. Click Create New to display the configuration editor.

4. Configure the following settings:

   Setting	Description
   Name	Configuration name. Valid characters are A-Z, a-z, 0-9, _, and -. No spaces.
   Status	Specifies whether the policy is active. Enable activates the policy, allowing it to enforce the configured protection logic. Disable deactivates the policy; no enforcement is applied even if traffic matches. The status is enabled by default.
   Probe Interval	Defines the interval time (in seconds) for the TCP zero window timer. After receiving a zero window packet, FortiADC periodically probes the peer side until it receives a non-zero window or the maximum probe count is reached. The default value is 30, with a valid range of 0 to 256 seconds.
   Probe Count	Specifies the maximum number of consecutive probes to be sent after receiving a zero window packet. Once this count is exceeded, the configured action will be triggered. The default value is 5, with a valid range of 0 to 256 probes.
   Action	Specifies the action taken when the probe count exceeds the limit and no response with a non-zero window is received. Options include: Pass — stop probing and allow all packets to pass in both directions. Deny — deny the connection by sending a RST packet. Period Block— deny the connection and block any new connections from the peer for a specified period. The default value is Deny.
   Period Block	The Period Block option is available if Action is Period Block. Defines the duration (in seconds) for which new connections from the peer will be blocked if the Block-period action is selected. The default value is 60, with a valid range of 1 to 3600 seconds.
   Severity	Specifies the log severity level for zero-window probe events. Options include: High — Log as high severity events. Medium — Log as a medium severity events. Low — Log as low severity events. The default value is High.
   Log	Enables or disables logging of the zero-window probe events. The default value is disabled.
   Exception Name	Specify the DoS Exception configuration object. See Configuring DoS Exceptions. When FortiADC detects TCP sessions exhibiting slow data transfer behavior, it triggers the TCP Slow Data Flood Protection mechanism to prevent resource exhaustion. However, connections from source IPs listed in the exception rule are exempt from this detection and are allowed to proceed uninterrupted.

5. Save the configuration.