{"id":12,"date":"2021-12-15T20:07:57","date_gmt":"2021-12-16T04:07:57","guid":{"rendered":"https:\/\/172.105.20.94\/?p=12"},"modified":"2022-04-17T13:46:55","modified_gmt":"2022-04-17T21:46:55","slug":"configure-dos-policy-on-fortinet","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=12","title":{"rendered":"Configure DoS Policy on FortiGate"},"content":{"rendered":"\n<p style=\"line-height:1\">This is a diagram to do a Fortinet Dos Lab.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"571\" src=\"https:\/\/172.105.20.94\/wp-content\/uploads\/2021\/12\/image.png\" alt=\"\" class=\"wp-image-13\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-300x176.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-768x450.png 768w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p style=\"line-height:1\">Fortinet \u2013 Policy and Objects \u2013 IPv4 DoS Policy.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"385\" src=\"https:\/\/172.105.20.94\/wp-content\/uploads\/2021\/12\/image-1.png\" alt=\"\" class=\"wp-image-14\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-1.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-1-300x118.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-1-768x303.png 768w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p style=\"line-height:1\">Change TCP_port_scan setting to 5 and ICMP_flood setting to 4.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"793\" src=\"https:\/\/172.105.20.94\/wp-content\/uploads\/2021\/12\/image-2.png\" alt=\"\" class=\"wp-image-15\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-2.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-2-300x244.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-2-768x625.png 768w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"455\" src=\"https:\/\/172.105.20.94\/wp-content\/uploads\/2021\/12\/image-3.png\" alt=\"\" class=\"wp-image-16\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-3.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-3-300x140.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-3-768x358.png 768w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p style=\"line-height:1\">Configure quarantine setting on the Fortinet DoS Policy.<\/p>\n\n\n\n<p style=\"line-height:1\">config firewall DoS-policy<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp; edit 1<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set interface &#8220;port1&#8221;<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set srcaddr &#8220;all&#8221;<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set dstaddr &#8220;all&#8221;<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set service &#8220;ALL&#8221;<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; config anomaly<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; edit &#8220;icmp_flood&#8221;<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set status enable<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;set log enable<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set quarantine attacker<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set quarantine-expiry 5m&nbsp;<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set quarantine-log disable<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set threshold 4<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; next<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"439\" src=\"https:\/\/172.105.20.94\/wp-content\/uploads\/2021\/12\/image-4.png\" alt=\"\" class=\"wp-image-17\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-4.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-4-300x135.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-4-768x346.png 768w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; config anomaly<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; edit &#8220;tcp_port_scan&#8221;<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set status enable<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;set log enable<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set quarantine attacker<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set quarantine-expiry 5m&nbsp;<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set quarantine-log disable<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set threshold 5<\/p>\n\n\n\n<p style=\"line-height:1\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; next<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"513\" src=\"https:\/\/172.105.20.94\/wp-content\/uploads\/2021\/12\/image-5.png\" alt=\"\" class=\"wp-image-18\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-5.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-5-300x158.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-5-768x404.png 768w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p style=\"line-height:1\">Sending 5 packets per second, Fortinet starts to block the excessive ICMP packets. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"521\" src=\"https:\/\/172.105.20.94\/wp-content\/uploads\/2021\/12\/image-6.png\" alt=\"\" class=\"wp-image-19\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-6.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-6-300x160.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-6-768x410.png 768w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p style=\"line-height:1\">Check Fortinet Anomaly log.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"927\" src=\"https:\/\/172.105.20.94\/wp-content\/uploads\/2021\/12\/image-7.png\" alt=\"\" class=\"wp-image-20\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-7.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-7-300x285.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-7-768x730.png 768w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p style=\"line-height:1\">Fortinet Fortiview.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"518\" src=\"https:\/\/172.105.20.94\/wp-content\/uploads\/2021\/12\/image-8.png\" alt=\"\" class=\"wp-image-21\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-8.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-8-300x159.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-8-768x408.png 768w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p style=\"line-height:1\">Fortinet Monitor \u2013 Banned IP. AT IP Address was blocked by Fortinet Firewall.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"749\" src=\"https:\/\/172.105.20.94\/wp-content\/uploads\/2021\/12\/image-9.png\" alt=\"\" class=\"wp-image-22\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-9.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-9-300x230.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-9-768x590.png 768w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p style=\"line-height:1\">Doing port scan on Kali machine by using Nmap command.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"775\" src=\"https:\/\/172.105.20.94\/wp-content\/uploads\/2021\/12\/image-10.png\" alt=\"\" class=\"wp-image-23\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-10.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-10-300x238.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-10-768x610.png 768w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p style=\"line-height:1\">Fortinet was blocked port scan on the opened port 80.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"742\" src=\"https:\/\/172.105.20.94\/wp-content\/uploads\/2021\/12\/image-11.png\" alt=\"\" class=\"wp-image-24\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-11.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-11-300x228.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-11-768x584.png 768w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>This is a diagram to do a Fortinet Dos Lab. Fortinet \u2013 Policy and Objects \u2013 IPv4 DoS Policy. Change TCP_port_scan setting to 5 and ICMP_flood setting to 4. Configure quarantine setting on the Fortinet DoS Policy. config firewall DoS-policy &nbsp;&nbsp;&nbsp; edit 1 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set interface &#8220;port1&#8221; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set srcaddr &#8220;all&#8221; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set dstaddr &#8220;all&#8221; [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,11],"tags":[14,13],"class_list":["post-12","post","type-post","status-publish","format-standard","hentry","category-fortigate","category-security","tag-fortinet","tag-security"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/12","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12"}],"version-history":[{"count":3,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/12\/revisions"}],"predecessor-version":[{"id":2966,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/12\/revisions\/2966"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}