config security dos dos-protection-profile

Specify an HTTP Access Limit policy. Limit the request number per second from an IP.

Specify an HTTP Connection Flood policy. Limit the number of connections from a client, which is marked by a cookie.

Specify an HTTP Request Flood policy. Limit the request number per second from a client, which is marked by a cookie.

Specify TCP Connection Access Flood Protection policy.

A TCP connection flood attempts to prevent legitimate requests from being established by flooding the server with requests for new connections. By setting a threshold limit for TCP requests, FortiADC can detect and take action to protect against a TCP connection flood.

Specify a TCP Slow Data Flood Protection policy.

After the TCP connection is established (the three-way handshake is completed), if FortiADC sends data to the client but the client returns a zero window (a zero window appears when, for example, the client does not take the data out of the TCP receive queue of the client OS when the data sent by the FortiADC fills up the queue), FortiADC will stop sending data. In this case, FortiADC can actively abort TCP connections and release related resources to avoid occupying its resources for a long time.

Specify a DNS Query Flood Protection policy. The DNS Query Flood Protection policy can limit the number of DNS request per second to mitigate against DNS query flood attacks that aim to overwhelm DNS servers with high volumes of illegitimate DNS queries.

Specify a DNS Reverse Flood Protection policy. The DNS Reverse Flood Protection policy can limit the number of ANY type DNS requests per second to mitigate against DNS reverse flood attacks that aim to overwhelm network resources with high volumes of DNS responses.