Fortinet FortiGate 100 Installation & Configuration Manual page 227

Network Intrusion Detection System (NIDS)
FortiGate-100 Installation and Configuration Guide
For example, setting the icmpflood signature threshold to 500 will allow 500 echo
requests from a source address, to which the system sends echo replies. If the
number of requests is 501 or higher, the FortiGate unit will block the attacker to
eliminate disruption of system operations.
If you enter a threshold value of 0 or a number out of the allowable range, the
FortiGate unit uses the default value.
Table 6: NIDS Prevention signatures with threshold values
Signature
abbreviation
synflood
portscan
srcsession
ftpovfl
smtpovfl
pop3ovfl
udpflood
udpsrcsession
icmpflood
icmpsrcsession
icmpsweep
icmplarge
To set Prevention signature threshold values:
1 Go to NIDS > Prevention.
2 Select Modify
Signatures that do not have threshold values do not have Modify
3 Type the Threshold value.
4 Select the Enable check box.
5 Select OK.
Threshold value units
Maximum number of SYN segments
received per second
Maximum number of SYN segments
received per second
Total number of TCP sessions initiated
from the same source
Maximum buffer size for an FTP
command (bytes)
Maximum buffer size for an SMTP
command (bytes)
Maximum buffer size for a POP3
command (bytes)
Maximum number of UDP packets
received from the same source or sent
to the same destination per second
Total number of UDP sessions initiated
from the same source
Maximum number of UDP packets
received from the same source or sent
to the same destination per second
Total number of ICMP sessions
initiated from the same source
Maximum number of ICMP packets
received from the same source per
second
Maximum ICMP packet size (bytes)
beside the signature for which you want to set the Threshold value.
Setting signature threshold values
Default Minimum Maximum
threshold threshold threshold
value value value
200 30 3000
128 10 256
2048 128 10240
256 128 1024
512 128 1024
512 128 1024
2048 512 102400
1024 512 102400
256 128 102400
128 64 2048
32 16 2048
32000 1024 64000
icons.
227