Viewing The Dos Sensor List; Configuring Dos Sensors - Fortinet FortiGate Series Administration Manual

Hide thumbs Also See for FortiGate Series:

Table of Contents

Viewing the DoS sensor list

To view the anomaly list, go to UTM > Intrusion Protection > DoS Sensor.

Figure 325: The DoS sensor list

Add a new DoS sensor to the bottom of the list.

A unique identifier for each DoS sensor. The ID does not indicate the

sequence in which the sensors examine network traffic.

Select to enable the DoS sensor.

The DoS sensor name.

An optional description of the DoS sensor.

Delete the DoS sensor.

Edit the following information: Action, Severity, and Threshold.

Insert DoS Sensor

Create a new DoS sensor before the current sensor.

Move To icon

Move the current DoS sensor to another position in the list. After

selecting this icon, enter the destination position in the window that

appears, and select OK.

Because an improperly configured DoS sensor can interfere with network traffic, no DoS

sensors are present on a factory default FortiGate unit. You must create your own and

then select them in a DoS policy before they will take effect. Thresholds for newly created

sensors are preset with recommended values that you can adjust to meet the needs of

your network.

Note: It is important to know normal and expected network traffic before changing the

default anomaly thresholds. Setting the thresholds too low could cause false positives, and

setting the thresholds too high could allow otherwise avoidable attacks.

To configure DoS sensors, go to UTM > Intrusion Protection > DoS Sensor. Select the Edit

icon of an existing DoS sensor, or select Create New to create a new DoS sensor.

Note: You can configure NAC quarantine for DoS sensors from the FortiGate CLI. For

more information, see

"Configuring NAC quarantine" on page

FortiGate Version 4.0 MR1 Administration Guide

Intrusion Protection

Insert DoS Sensor before

01-410-89802-20090903

http://docs.fortinet.com/