waf layer4-connection-flood-check-rule
Use this command to limit the number of fully-formed TCP connections per source IP address. This effectively prevents TCP flood-style denial-of-service (DoS) attacks.
TCP flood attacks exploit the fact that servers must consume memory to maintain the state of the open connection until either the timeout, or the client or server closes the connection. This consumes some memory even if the client is not currently sending any HTTP requests.
Normally, a legitimate client forms a single TCP connection, through which they may make several HTTP requests. As a result, each client consumes a negligible amount of memory to track the state of the TCP connection. However, an attacker opens many connections with perhaps zero or one request each, until the server is exhausted and has no memory left to track the TCP states of new connections with legitimate clients.
This command is similar to waf http-connection-flood-check-rule. However, this feature counts TCP connections per IP, while the other command counts TCP connections per session cookie.
It is also similar to syncookie in server-policy policy. However, this feature counts fully-formed TCP connections, while the anti-SYN flood feature counts partially-formed TCP connections.
To apply this rule, include it in an application-layer DoS-prevention policy and include that policy in an inline protection profile. For details, see waf application-layer-dos-prevention.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.
Syntax
config waf layer4-connection-flood-check-rule
edit "<rule_name>"
set layer4-connection-threshold <limit_int>
set action {alert | alert_deny | block-period | deny_no_log}
set block-period <seconds_int>
set severity {High | Medium | Low | Info}
set trigger-policy "<trigger-policy_name>"
next
end
| Variable | Description | Default |
|
Enter the name of a new or existing rule. The maximum length is 63 characters. To display the list of existing rules, enter:
|
No default. | |
| Enter the maximum number of TCP connections allowed from the same IP address. The valid range is 0–65,536. | 0 | |
|
Select one of the following actions that the FortiWeb appliance will perform when the count exceeds the rate limit:
Caution: This setting will be ignored if monitor-mode {enable | disable} is enabled. Note: Logging and/or alert email will occur only if enabled and configured. For details, see log disk and log alertMail. Note: If an auto-learning profile will be selected in the policy with Offline Protection profiles that use this rule, you should select |
alert
|
|
|
Enter the length of time (in seconds) for which the FortiWeb appliance will block additional requests after a source IP address exceeds the rate threshold. The block period is shared by all clients whose traffic originates from the source IP address. The valid range is 1–3,600. |
1
|
|
| Select the severity level to use in logs and reports generated when a violation of the rule occurs. | Medium | |
|
Enter the name of the trigger to apply when this rule is violated. For details, see log trigger-policy. The maximum length is 63 characters. To display the list of existing trigger policies, enter:
|
No default. |
Example
This example illustrates a basic TCP flood check rule.
config waf layer4-connection-flood-check-rule
edit "Web Portal Network Connect Limit"
set action alert_deny
set layer4-connection-threshold 10
set severity Medium
set trigger-policy "Server_Policy_Trigger"
next
end