Fortinet black logo

CLI Reference

waf layer4-connection-flood-check-rule

waf layer4-connection-flood-check-rule

Use this command to limit the number of fully-formed TCP connections per source IP address. This effectively prevents TCP flood-style denial-of-service (DoS) attacks.

TCP flood attacks exploit the fact that servers must consume memory to maintain the state of the open connection until either the timeout, or the client or server closes the connection. This consumes some memory even if the client is not currently sending any HTTP requests.

Normally, a legitimate client forms a single TCP connection, through which they may make several HTTP requests. As a result, each client consumes a negligible amount of memory to track the state of the TCP connection. However, an attacker opens many connections with perhaps zero or one request each, until the server is exhausted and has no memory left to track the TCP states of new connections with legitimate clients.

This command is similar to waf http-connection-flood-check-rule. However, this feature counts TCP connections per IP, while the other command counts TCP connections per session cookie.

It is also similar to syncookie in server-policy policy. However, this feature counts fully-formed TCP connections, while the anti-SYN flood feature counts partially-formed TCP connections.

To apply this rule, include it in an application-layer DoS-prevention policy and include that policy in an inline protection profile. For details, see waf application-layer-dos-prevention.

To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.

Syntax

config waf layer4-connection-flood-check-rule

edit "<rule_name>"

set layer4-connection-threshold <limit_int>

set action {alert | alert_deny | block-period | deny_no_log}

set block-period <seconds_int>

set severity {High | Medium | Low | Info}

set trigger-policy "<trigger-policy_name>"

next

end

Variable Description Default

"<rule_name>"

Enter the name of a new or existing rule. The maximum length is 63 characters.

To display the list of existing rules, enter:

edit ?

No default.

layer4-connection-threshold <limit_int>

Enter the maximum number of TCP connections allowed from the same IP address. The valid range is 0–65,536. 0

action {alert | alert_deny | block-period | deny_no_log}

Select one of the following actions that the FortiWeb appliance will perform when the count exceeds the rate limit:

  • alert—Accept the connection and generate an alert email and/or log message.
  • alert_deny—Block the connection and generate an alert email and/or log message.
  • block-period—Block subsequent requests from the client for a number of seconds. Also configure block-period <seconds_int>.
  • deny_no_log—Deny a request. Do not generate a log message.

Caution: This setting will be ignored if monitor-mode {enable | disable} is enabled.

Note: Logging and/or alert email will occur only if enabled and configured. For details, see log disk and log alertMail.

Note: If an auto-learning profile will be selected in the policy with Offline Protection profiles that use this rule, you should select alert. If the action is alert_deny, the FortiWeb appliance will reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For details about auto-learning requirements, see waf web-protection-profile autolearning-profile.

alert

block-period <seconds_int>

Enter the length of time (in seconds) for which the FortiWeb appliance will block additional requests after a source IP address exceeds the rate threshold.

The block period is shared by all clients whose traffic originates from the source IP address. The valid range is 1–3,600.

600

severity {High | Medium | Low | Info}

Select the severity level to use in logs and reports generated when a violation of the rule occurs. Medium

trigger-policy "<trigger-policy_name>"

Enter the name of the trigger to apply when this rule is violated. For details, see log trigger-policy. The maximum length is 63 characters.

To display the list of existing trigger policies, enter:

set trigger ?

No default.

Example

This example illustrates a basic TCP flood check rule.

config waf layer4-connection-flood-check-rule

edit "Web Portal Network Connect Limit"

set action alert_deny

set layer4-connection-threshold 10

set severity Medium

set trigger-policy "Server_Policy_Trigger"

next

end

Related topics

waf layer4-connection-flood-check-rule

Use this command to limit the number of fully-formed TCP connections per source IP address. This effectively prevents TCP flood-style denial-of-service (DoS) attacks.

TCP flood attacks exploit the fact that servers must consume memory to maintain the state of the open connection until either the timeout, or the client or server closes the connection. This consumes some memory even if the client is not currently sending any HTTP requests.

Normally, a legitimate client forms a single TCP connection, through which they may make several HTTP requests. As a result, each client consumes a negligible amount of memory to track the state of the TCP connection. However, an attacker opens many connections with perhaps zero or one request each, until the server is exhausted and has no memory left to track the TCP states of new connections with legitimate clients.

This command is similar to waf http-connection-flood-check-rule. However, this feature counts TCP connections per IP, while the other command counts TCP connections per session cookie.

It is also similar to syncookie in server-policy policy. However, this feature counts fully-formed TCP connections, while the anti-SYN flood feature counts partially-formed TCP connections.

To apply this rule, include it in an application-layer DoS-prevention policy and include that policy in an inline protection profile. For details, see waf application-layer-dos-prevention.

To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.

Syntax

config waf layer4-connection-flood-check-rule

edit "<rule_name>"

set layer4-connection-threshold <limit_int>

set action {alert | alert_deny | block-period | deny_no_log}

set block-period <seconds_int>

set severity {High | Medium | Low | Info}

set trigger-policy "<trigger-policy_name>"

next

end

Variable Description Default

"<rule_name>"

Enter the name of a new or existing rule. The maximum length is 63 characters.

To display the list of existing rules, enter:

edit ?

No default.

layer4-connection-threshold <limit_int>

Enter the maximum number of TCP connections allowed from the same IP address. The valid range is 0–65,536. 0

action {alert | alert_deny | block-period | deny_no_log}

Select one of the following actions that the FortiWeb appliance will perform when the count exceeds the rate limit:

  • alert—Accept the connection and generate an alert email and/or log message.
  • alert_deny—Block the connection and generate an alert email and/or log message.
  • block-period—Block subsequent requests from the client for a number of seconds. Also configure block-period <seconds_int>.
  • deny_no_log—Deny a request. Do not generate a log message.

Caution: This setting will be ignored if monitor-mode {enable | disable} is enabled.

Note: Logging and/or alert email will occur only if enabled and configured. For details, see log disk and log alertMail.

Note: If an auto-learning profile will be selected in the policy with Offline Protection profiles that use this rule, you should select alert. If the action is alert_deny, the FortiWeb appliance will reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For details about auto-learning requirements, see waf web-protection-profile autolearning-profile.

alert

block-period <seconds_int>

Enter the length of time (in seconds) for which the FortiWeb appliance will block additional requests after a source IP address exceeds the rate threshold.

The block period is shared by all clients whose traffic originates from the source IP address. The valid range is 1–3,600.

600

severity {High | Medium | Low | Info}

Select the severity level to use in logs and reports generated when a violation of the rule occurs. Medium

trigger-policy "<trigger-policy_name>"

Enter the name of the trigger to apply when this rule is violated. For details, see log trigger-policy. The maximum length is 63 characters.

To display the list of existing trigger policies, enter:

set trigger ?

No default.

Example

This example illustrates a basic TCP flood check rule.

config waf layer4-connection-flood-check-rule

edit "Web Portal Network Connect Limit"

set action alert_deny

set layer4-connection-threshold 10

set severity Medium

set trigger-policy "Server_Policy_Trigger"

next

end

Related topics