Benefits and limitations of the Offline Protection mode

Key Benefits

• No Network Reconfiguration: Offline Protection mode requires only a SPAN/mirror port to copy traffic to FortiWeb. There’s no need to reroute traffic through the appliance, avoiding downtime or complex topology changes.

• Zero Impact on Traffic Flow: Legitimate traffic flows directly between clients and servers without added latency or bottlenecks.

Limitations

• If the attack completes before the RST arrives (e.g., a quick SQLi exploit), blocking fails.

• It does not block the client’s IP address or prevent future connections.

• Only works for TCP-based attacks (e.g., HTTP/HTTPS). Useless for UDP/ICMP-based attacks.

• High latency may delay RST delivery, rendering it ineffective.

• Some systems ignore RST packets or require multiple RSTs to terminate a session.