Handbook

• Introduction
  • Product features
  • Deployment topology
  • Document Scope
• What’s New
  • What's New in FortiDDoS 6.x
• Key Concepts
  • DDoS attack overview
  • DDoS attack mitigation mechanisms
  • DDoS mitigation techniques overview
  • Understanding FortiDDoS rate limiting thresholds
  • Using FortiDDoS ACLs
  • Understanding FortiDDoS protocol anomaly protection
  • Understanding FortiDDoS Detection Mode
  • Understanding FortiDDoS Prevention Mode
  • Understanding FortiDDoS Asymmetric Mode
  • Understanding FortiDDoS DNS attack mitigation
  • Using FortiDDoS SPPs
  • Working with the FortiDDoS Monitor graphs
  • Working with the FortiDDoS attack log
  • A typical workflow for investigating FortiDDoS attack events
• Getting Started
  • Step 1: Install the appliance
  • Step 2: Configure the management interface
  • Step 3: Configure basic network settings
  • Step 4: Test connectivity
  • Step 5: Complete product registration, licensing, and upgrades
  • Step 6: Define SPPs and subnets
  • Step 7: Deploy the system in Detection Mode
  • Step 8: Generate traffic statistics and set the configured minimum thresholds
  • Step 9: Monitor the system and become familiar with logs and reports
  • Step 10: Deploy the system in Prevention Mode
  • Step 11: Back up the configuration
• Dashboard
  • Status
  • Top Attacks
  • CLI Console
  • Configuring the hostname
  • Rebooting, shutting down, and resetting the system
• FortiView
  • Threat Map
  • SPP
• System Management
  • High Availability Deployments
    • HA feature overview
    • HA system requirements
    • Deploying an active-passive cluster
    • HA synchronization
    • Configuring HA settings
    • Operational tasks
      • Monitoring an HA cluster
      • Updating firmware on an HA cluster
      • Modifying system or report settings on HA Secondary
  • Managing administrator users
  • Configuring RADIUS authentication
  • Configuring LDAP authentication
  • Configuring TACACS+ authentication
  • Configuring SNMP for remote alarm event trap reporting and MIB queries
  • Configuring SNMP system information
  • Managing local certificates
  • Generating system reports for offline analysis
  • Updating firmware
  • Backing up and restoring the configuration
  • Configuring system time
  • Setting configuration auto-backup
  • FortiGuard
  • Address and Service
  • Debug
• Network
  • Configuring network interfaces
  • Configuring static routes
  • Configuring DNS
  • Packet Capture
• Global Settings
  • Deployment
  • Proxy IP
  • Cloud Signaling
  • Configuring blocklisted IPv4 addresses
  • Configuring blocklisted domains
  • Configuring Do Not Track / Track and Allow policies
  • Configuring GRE tunnel endpoint addresses
• Service Protection
  • Service Protection Policy Overview
    • Configuring Service Protection Policies
  • Service Protection Policy Feature Settings
    • Source tracking
    • Blocking settings
    • Service port settings
    • Protection profile settings
    • Protection subnets
    • ACLs
  • Thresholds
    • Thresholds Overview
    • Thresholds View
    • Threshold Settings
      • Generate Traffic Statistics
      • System Recommendations
      • Manual Threshold Setting
      • Emergency Setup
      • Factory Default
  • Protection subnets list
  • SPP Profiles Overview
    • IP Profile
    • ICMP Profile
    • TCP Profile
    • HTTP Profile
    • SSL/TLS Profile
    • NTP Profile
    • DNS Profile
    • DTLS Profile
• Monitor Graphs
  • Monitor graphs overview
  • Reading Monitor graphs
  • Using Interface graphs
  • Using the SPP Traffic graphs
  • Using Subnets graphs
  • Using Drops Monitor graphs
    • Global Monitor Graphs
      • Using the Global > Aggregate Drops graph
      • Using the Global > ACL Drops graphs
    • SPP Monitor Graphs
      • Using the Aggregate Drops graph
      • Using the Flood Drops graphs
      • Using the ACL Drops graphs
      • Using the Anomaly Drops graphs
      • Using the Out of Memory Drops graphs
  • Using Traffic Monitor Layer 3/4/7 graphs
    • Using the Layer 3 graphs
    • Using the Layer 4 graphs
    • Using the Layer 7 graphs
• Logs and Reports
  • Log Configuration
    • Logs and reports overview
    • Configuring local log settings
    • Configuring remote log settings
      • Configuring remote log server settings for event logs
      • Configuring remote log server settings for DDoS attack log
        • Using FortiAnalyzer to collect DDoS attack logs
        • Using FortiSIEM to collect DDoS attack and event logs
      • Configuring alert email settings
      • Configuring Attack Log purge settings
      • Configuring SNMP trap receivers for remote DDoS attack reporting
  • Log Access
    • Using the DDoS attack log table
    • Using the event log table
    • Attack Log Backup
    • Login Events
  • Reports
    • Reports Overview
    • Configuring reports
    • Configuring report purge settings
    • Using Report Browse
  • Configuring Flowspec
• Deployment Topologies
  • Basic Inline deployment
  • Built-in fail-open bypass
  • External bypass
  • Tap Mode deployments
• Troubleshooting
  • Logs
  • Tools
  • Solutions by issue type
  • Resetting profile data or the system configuration
  • Restoring firmware ('clean install')
  • Additional resources
• Appendix
  • Appendix A: DDoS Attack Log Reference
  • Appendix B: Remote Syslog Reference
  • Appendix C: Management Information Base (MIB)
  • Appendix D: Port Numbers
  • Appendix E: Capturing Packets
  • Appendix F: Deleting Service Protection Policies (SPPs)
• Change Log