Re: FortiDDoS config
In this case, ignore what your VAR told you. Your instincts were correct.
Normally you need to attach the system to your Internet link(s). Note Odd ports (1,3,5..) must face your firewall or "inside" network and even ports (2,4,6..) must face the Internet. FortiDDoS is completely transparent -- it has no MAC nor IP addresses in the data path so it has no impact on the network when cabled in.
BUT - before cabling, connect to Mgmt 1 port, set up credentials and set up NTP (critical) and time-zone. Each of NTP and Time Zone settings causes a system reboot which will impact traffic if the system is cabled. FDD-600B has no bypass/fail-open capability.
You need to configure the public IPs you use for different services into Service Protection Profiles. Normally we suggest the following:
- Firewall, proxies, Wifi gateways or any predominantly outbound service
- Web servers
- VPN or other authenticating inbound servers
- DNS if you have a publically-accessible DNS server
First you define the Service Protection Policies (SPPs) - the categories above that are relevant to you. Then you define the SPP Policies (subnets or /32s) that fit into each SPP.
- Be sure to include your full public subnet in an SPP. If you have a /24, for example, and the above services only use 15 or 20 IPs, enter the full /24 in an SPP called "Full_Subnet" or similar. You do not need to worry about a /24 and multiple /32s in the same /24 - the system figures that out. Attackers will attack any IP address that is routed to your network link, even addresses that are not in use.
Once you have the SPPs and subnets defined, you need to leave the system for about a week of learning. It will be transparent to all traffic but if you look at some graphs you will see "drops". When the SPPs are in Detection Mode (default) the system reports on bad packets it sees (showing "drops") but it never drops a packet.
The next step is setting System Thresholds. There are 230,000 of these per SPP in each direction, so you cannot do that manually. The system has a process. If you get that far, either return to the forum for help or:
If the system is registered and you have any warranty available you can create a TAC ticket asking for implementation help.