How to set up DDoS (Distributed Denial of Service) protection, Intervention Attacks, and Spoofing protection on a FortiGate firewall

To set up DDoS protection, Intrusion Prevention System (IPS), and Anti-Spoofing protection via the FortiGate GUI, here’s a step-by-step guide for each:

---

1. Setting Up DDoS Protection (DoS Protection)

Step 1: Enable and Configure DoS Protection

1. Log in to the FortiGate Web GUI.
2. In the left-hand menu, navigate to Security Profiles > DoS Policy.
3. Click on Create New to add a new DoS protection profile.
4. Fill in the necessary details:
   • Name: Name your profile (e.g., DDoS_Protection).
   • Incoming Interface: Select the interface where traffic is expected (e.g., WAN).
   • Source Address: Choose all to apply it to all sources (or specific IPs if required).
   • Destination Address: Choose all (or specify particular destinations).
   • Service: Select the services to monitor, or leave it as ALL for all protocols.
   • Action: Choose the action you want (e.g., Block or Alert).
5. You can set thresholds for certain types of attacks, such as request rates per second. Configure as necessary.
6. Click OK to save the profile.

Step 2: Apply the DoS Profile to Firewall Policy

1. Go to Policy & Objects > IPv4 Policy.
2. Click on the edit icon for the policy where you want to apply DoS protection (e.g., LAN to WAN).
3. In the Security Profiles section, enable DoS Protection.
4. Choose the DoS Protection Profile you just created from the drop-down menu.
5. Click OK to save the changes.

Step 3: Monitor DDoS Activity

• Navigate to Log & Report > Traffic Log to view any DoS-related logs and activity.

---

2. Setting Up Intrusion Prevention (IPS) for Intervention Attacks

Step 1: Create an IPS Profile

1. Log in to the FortiGate Web GUI.
2. Navigate to Security Profiles > Intrusion Prevention.
3. Click Create New to add a new IPS profile.
4. Configure the following:
   • Name: Give it a descriptive name (e.g., IPS_Protection).
   • Action: Set to Block to block detected attacks or Monitor to log only.
   • Attack Database: Use the default database or select another database for attack signatures.
   • Enable Logging: Check the box to log detected intrusion events.
5. Click OK to save the profile.

Step 2: Apply the IPS Profile to a Policy

1. Go to Policy & Objects > IPv4 Policy.
2. Select the policy to which you want to apply IPS protection (e.g., LAN to WAN).
3. In the Security Profiles section, enable IPS.
4. Choose the IPS Profile you created.
5. Click OK to save the policy.

Step 3: Monitor IPS Activity

1. Go to Log & Report > Event Log > IPS to monitor IPS logs.
2. Use Monitor > Traffic to view real-time IPS protection statistics.

---

3. Setting Up Anti-Spoofing Protection

Step 1: Enable Anti-Spoofing on Interfaces

1. Log in to the FortiGate Web GUI.
2. Go to Network > Interfaces.
3. Click on the edit icon for the interface (e.g., WAN or LAN) where you want to enable anti-spoofing.
4. In the Advanced section, enable Anti-Spoofing by checking the box.
   • Anti-Spoofing ensures that traffic received on an interface is valid for the source IPs associated with that interface.

Step 2: Configure Anti-Spoofing Settings

1. You can configure the anti-spoofing behavior:
   • Strict Mode: FortiGate strictly verifies that traffic from a given interface matches the expected source address.
   • Loose Mode: Traffic from other IP ranges is allowed but logged as potential spoofing attempts.
2. After selecting your preferred mode, click OK to save the settings.

Step 3: Apply Anti-Spoofing on Policies

1. Anti-Spoofing checks are applied automatically once enabled on the interface. However, ensure that your firewall policies align with the interfaces where you enabled anti-spoofing.

---

4. Testing and Monitoring

After enabling the protections, you can test their effectiveness:

• DDoS Protection: Use tools to simulate a DDoS attack and verify that the firewall detects and mitigates the traffic.
• IPS Protection: Use vulnerability scanners or simulate intrusion attempts to verify IPS functionality.
• Anti-Spoofing: Try sending spoofed packets to test whether the firewall blocks them.

Monitor Logs

• DDoS and DoS Protection: Go to Log & Report > Traffic Log to review DoS logs.
• IPS Protection: Go to Log & Report > Event Log > IPS to view IPS detection logs.
• Anti-Spoofing: Review the Log & Report > Traffic Log to see anti-spoofing alerts.

---

Summary of Key Steps

• DDoS Protection: Create a DoS Policy and apply it to the relevant firewall policy.
• IPS Protection: Create an IPS Profile and apply it to firewall policies.
• Anti-Spoofing: Enable Anti-Spoofing on interfaces to protect against spoofed traffic.

By following these steps in the FortiGate GUI, you can protect your network against DDoS attacks, unauthorized intrusions, and spoofing.

 

To set up DDoS (Distributed Denial of Service) protection, Intervention Attacks, and Spoofing protection on a FortiGate firewall, you need to configure several features such as DoS policy, IPS (Intrusion Prevention System), and anti-spoofing settings.

Here’s how to set them up via the FortiGate Web GUI:

1. Set Up DDoS Protection (DoS Protection) on FortiGate

DDoS attacks often overwhelm a system by flooding it with traffic. FortiGate provides mechanisms to protect against these attacks.

Step 1: Enable DoS Protection

1. Log in to the FortiGate Web Interface.
2. Navigate to Security Profiles > DoS Policy.
3. Click Create New to create a new DoS protection profile.
4. Configure the following:
   • Name: Name your DoS policy (e.g., DDoS_Protection).
   • Incoming Interface: Select the interfaces where the attack might occur (e.g., WAN).
   • Source Address: Select the source address (e.g., all for all incoming addresses).
   • Destination Address: Select the destination address (e.g., all for all internal addresses).
   • Service: Define the types of traffic to monitor (e.g., ALL or specific protocols).
   • Action: Choose the action for attack detection (e.g., Block or Alert).

Step 2: Configure Attack Thresholds

In the DoS policy settings:

• Thresholds: Set thresholds for how much traffic can flow before the system considers it an attack. For example, set a threshold for the number of requests per second.
• Enable Logging: Enable logging for DoS attacks to monitor and investigate any DDoS incidents.

Step 3: Apply the DoS Policy to a Firewall Policy

Once the DoS protection policy is created, apply it to the relevant firewall policy:

1. Go to Policy & Objects > IPv4 Policy.
2. Edit the firewall policy where the DDoS protection should apply.
3. Under Security Profiles, enable DoS Protection and select the profile you just created.

Step 4: Monitor DDoS Activity

Go to Log & Report > Traffic Log to monitor any DoS or DDoS activity. You can also review real-time activity in Monitor > DoS Stats.

---

2. Set Up Intrusion Prevention (IPS) for Intervention Attacks

Intrusion Prevention Systems (IPS) detect and prevent attacks, including intervention or unauthorized attempts to interact with your network.

Step 1: Create an IPS Profile

1. Log in to the FortiGate Web Interface.
2. Go to Security Profiles > Intrusion Prevention.
3. Click Create New to create a new IPS profile.
4. Configure the following:
   • Name: Give the profile a name (e.g., IPS_Protection).
   • Action: Choose whether to Block, Monitor, or Pass specific types of traffic. Set it to Block to stop intrusion attacks.
   • Log: Enable logging for IPS events.
   • Attack Database: Select the default attack database for the latest threats. FortiGate regularly updates its attack signatures.

Step 2: Apply the IPS Profile to a Firewall Policy

1. Go to Policy & Objects > IPv4 Policy.
2. Edit the policy where you want to apply IPS protection.
3. In the Security Profiles section, enable IPS and select the IPS profile you created.
4. Click OK to save the policy.

Step 3: Monitor IPS Activity

• Go to Log & Report > Event Log > IPS to monitor detected intrusion attempts and their status.

---

3. Set Up Anti-Spoofing Protection

Spoofing attacks occur when an attacker tries to make malicious traffic appear as if it comes from a trusted source. Anti-spoofing checks can prevent such attacks.

Step 1: Enable Anti-Spoofing

1. Log in to the FortiGate Web Interface.
2. Navigate to Network > Interfaces.
3. Edit the interface where anti-spoofing should be applied (e.g., WAN, LAN).
4. Under the Advanced section, enable Anti-Spoofing.
   • Anti-spoofing checks whether traffic that claims to be from a trusted source (like the internal network) is actually coming from that source.
   • FortiGate will drop packets where the source address does not match the interface’s network range.

Step 2: Configure Anti-Spoofing Settings

You can configure the FortiGate to perform anti-spoofing checks in the following ways:

• Strict Mode: FortiGate strictly verifies that the source IP matches the network for each interface.
• Loose Mode: Allows traffic from other networks but logs the events when spoofed traffic is detected.

Step 3: Apply Anti-Spoofing to Your Policies

Anti-spoofing checks are applied automatically once enabled on an interface. However, you can make sure that your firewall policies are specifically set to allow traffic from trusted networks and block others.

---

4. Test and Verify Your Configurations

• DDoS Testing: To verify DDoS protection, use traffic generation tools or simulate a DDoS attack to ensure that the FortiGate firewall is responding appropriately.
• IPS Testing: Use network vulnerability scanners or attempt simulated intrusion attacks to verify IPS protection.
• Anti-Spoofing Testing: Attempt to send spoofed packets to the FortiGate to verify that anti-spoofing blocks the traffic.

5. Monitor Logs and Reports

Regularly monitor the following to ensure your protection is functioning as expected:

• Log & Report > Traffic Log: Review traffic logs for any unusual activity.
• Log & Report > Event Log: Check for IPS and DoS events.
• Monitor > Traffic: Monitor real-time traffic statistics to detect any abnormal patterns.

---

Summary of Configurations:

1. DDoS Protection: Use DoS policies to protect against volumetric attacks.
2. IPS (Intrusion Prevention): Apply IPS profiles to detect and block known intrusion signatures and unauthorized intervention.
3. Anti-Spoofing: Enable anti-spoofing to prevent traffic that pretends to come from trusted internal addresses.

By setting up these protections, you can improve the security of your FortiGate firewall against DDoS attacks, intrusion attempts, and spoofing.