Setting Signature Threshold Values - Fortinet FortiGate 50A Installation And Configuration Manual

Network Intrusion Detection System (NIDS)

Setting signature threshold values

FortiGate-50A Installation and Configuration Guide
You can change the default threshold values for the NIDS Prevention signatures listed
in Table 20. The threshold depends on the type of attack. For flooding attacks, the
threshold is the maximum number of packets received per second. For overflow
attacks, the threshold is the buffer size for the command. For large ICMP attacks, the
threshold is the ICMP packet size limit to pass through.
For example, setting the icmpflood signature threshold to 500 allows 500 echo
requests from a source address, to which the system sends echo replies. The
FortiGate unit drops any requests over the threshold of 500.
If you enter a threshold value of 0 or a number out of the allowable range, the
FortiGate unit uses the default value.
Table 20: NIDS Prevention signatures with threshold values
Signature Threshold value units
abbreviation
synflood Threshold: Maximum number of SYN
segments received per second.
Queue Size: Maximum proxied
connections.
Timeout: Number of seconds for the
SYN cookie to keep a proxied
connection alive.
portscan Maximum number of SYN segments
received per second
srcsession Total number of TCP sessions initiated
from the same source
ftpovfl Maximum buffer size for an FTP
command (bytes)
smtpovfl Maximum buffer size for an SMTP
command (bytes)
pop3ovfl Maximum buffer size for a POP3
command (bytes)
udpflood Maximum number of UDP packets
received from the same source or sent
to the same destination per second
udpsrcsession Total number of UDP sessions initiated
from the same source
icmpflood Maximum number of ICMP packets
received from the same source or sent
to the same destination per second
icmpsrcsession Total number of ICMP sessions
initiated from the same source
icmpsweep Maximum number of ICMP packets
received from the same source per
second
icmplarge Maximum ICMP packet size (bytes)
Preventing attacks
Default Minimum Maximum
threshold threshold threshold
value value value
2048 1 1000000
4096 100 1000000
15 1 3600
512 1 1000000
2048 1 1000000
256 32 1408
512 32 1408
512 32 1408
2048 1 1000000
2048 1 1000000
256 1 1000000
128 1 1000000
128 1 1000000
32000 64 64000
221