Handbook

• Introduction
  • Product features
  • Deployment topology
  • Document Scope
• Key Concepts
  • DDoS attack overview
  • DDoS attack mitigation mechanisms
  • DDoS mitigation techniques overview
  • Understanding FortiDDoS rate limiting thresholds
  • Using FortiDDoS ACLs
  • Understanding FortiDDoS protocol anomaly protection
  • Understanding FortiDDoS Detection Mode
  • Understanding FortiDDoS Prevention Mode
  • Understanding FortiDDoS Asymmetric Mode
  • Understanding FortiDDoS DNS attack mitigation
  • Using FortiDDoS SPPs
  • Working with the FortiDDoS Monitor graphs
  • Working with the FortiDDoS attack log
  • A typical workflow for investigating FortiDDoS attack events
  • What’s New
    • What's New in FortiDDoS 7.x
• Getting Started
  • Step 1: Install the appliance
  • Step 2: Configure the management interface
  • Step 3: Configure basic network settings
  • Step 4: Test connectivity
  • Step 5: Complete product registration, licensing, and upgrades
  • Step 6: Define SPPs and subnets
  • Step 7: Deploy the system in Detection Mode
  • Step 8: Generate traffic statistics and set the configured minimum thresholds
  • Step 9: Monitor the system and become familiar with logs and reports
  • Step 10: Deploy the system in Prevention Mode
  • Step 11: Back up the configuration
• Dashboard
  • Status
  • Top Attacks
  • CLI Console
  • Rebooting, shutting down, and resetting the system
• FortiView
• System Management
  • High Availability Deployments
    • HA feature overview
    • HA system and network requirements
    • Deploying an active-passive cluster
    • HA synchronization
    • Configuring HA settings
    • Operational Tasks
      • Monitoring an HA cluster
      • Updating firmware on an HA cluster
      • Modifying system or report settings on HA Secondary
  • Managing administrator users
  • Authentication
    • Configuring RADIUS authentication
    • Configuring LDAP authentication
    • Configuring TACACS+ authentication
    • Configuring the hostname
  • SNMP
    • Configuring SNMP system information
    • Configuring SNMP for remote alarm event trap reporting and MIB queries
  • Managing local certificates
  • Updating firmware
  • Maintenance
    • Backing up and restoring the configuration
    • Configuring system time
    • Setting configuration auto-backup (Daily Config Backup)
  • FortiGuard
  • Address and Service
  • Debug
• Network
  • Configuring network interfaces
  • Configuring static routes
  • Configuring DNS
  • Packet Capture
  • Diagnostics
• Global Protection Settings
  • Settings
  • Deployment
  • Proxy IP
  • Cloud Signaling
  • Access Control List
  • Configuring blocklisted IPv4 addresses
  • Configuring blocklisted domains
  • Configuring Do Not Track / Track and Allow policies
  • Configuring GRE tunnel endpoint addresses
  • LQ Populate
• Service Protection
  • Service Protection Policy Overview
    • Configuring Service Protection Policies
  • Service Protection Policy Feature Settings
    • Source tracking
    • Blocking settings
    • Service port settings
    • Protection profile settings
    • Protection subnets
    • ACLs
    • Thresholds
      • Thresholds Overview
      • Thresholds View
      • Threshold Settings
        • Generate Traffic Statistics
        • System Recommendations
        • Manual Threshold Setting
        • Emergency Setup
        • Factory Default
  • Protection subnets list
  • SPP Profiles Overview
    • IP Profile
    • ICMP Profile
    • TCP Profile
    • HTTP Profile
    • SSL/TLS Profile
    • NTP Profile
    • DNS Profile
    • DTLS Profile
    • QUIC Profile
    • Video Conference Profile
• Monitor Graphs
  • Monitor graphs overview
  • Reading Monitor graphs
  • Using Interface graphs
  • Using the SPP graphs
  • Using Subnets graphs
  • Using Drops Monitor graphs
    • Global Drops Monitor Graphs
      • Using the Global > ACL Drops graphs
        • Using the Global > Aggregate Drops graph
    • SPP Drops Monitor Graphs
      • Using the Aggregate Drops graph
      • Using the Flood Drops graphs
      • Using the ACL Drops graphs
      • Using the Anomaly Drops graphs
      • Using the Out of Memory Drops graphs
  • Using Traffic Monitor Layer 3/4/7 graphs
    • Using the Layer 3 graphs
    • Using the Layer 4 graphs
    • Using the Layer 7 graphs
• Logs and Reports
  • Log Configuration
    • Logs and reports overview
    • Configuring remote log settings
      • Configuring remote log server settings for event logs
      • Configuring remote log server settings for DDoS attack log
        • Using FortiAnalyzer to collect DDoS attack logs
        • To set up log collection:
      • Configuring alert email settings
      • Configuring Attack Log purge settings
      • Configuring SNMP trap receivers for remote DDoS attack reporting
      • Configuring local log settings
  • Log Access
    • Using the DDoS attack log table
    • Using the event log table
    • Attack Log Backup
    • Login Events
  • Configuring Flowspec
    • Reports
      • Reports Overview
      • Configuring reports
      • Configuring report purge settings
      • Using Report Browse
• Troubleshooting
  • Logs
  • Tools
  • Solutions by issue type
  • Resetting profile data or the system configuration
  • Restoring firmware ('clean install')
  • Additional resources
• Deployment Topologies
  • Basic Inline deployment
  • Built-in fail-open bypass
  • External bypass
  • Tap Mode deployments
• Appendix
  • Appendix A: DDoS Attack Log Reference
  • Appendix B: Remote Syslog Reference
  • Appendix C: Management Information Base (MIB)
  • Appendix D: Port Numbers
  • Appendix E: Deleting Service Protection Policies (SPPs)
  • Appendix F: Security Fabric Integration
  • Appendix G: FortiManager / FortiAnalyzer syslog integration
  • Appendix H: Troubleshooting HA connectivity
  • Appendix I: System Recommended Thresholds Table
• Change Log