config security dos http-request-flood-protection
The HTTP Request Flood policy can limit the rate of HTTP requests from a client based on a session cookie, restricting the number of requests per second per session. This feature operates at the application layer, utilizing session cookies, rather than relying solely on TCP/IP connections at the network layer. This allows the system to distinguish between multiple clients that may share the same source IP address, such as in cases where network address translation (NAT) is used.
For this feature to function, the client must support cookies.
Primarily designed to protect against HTTP request-based DDoS attacks, the policy works by adding a Set-Cookie header to the HTTP response before forwarding the backend real-server's response to the client. As a result, subsequent client requests will include the relevant cookie (with most browsers supporting cookies). Using these cookies as keys, FortiADC can assess whether the request rate exceeds the configured limits, helping to identify and mitigate potential DDoS attacks.
Before you begin:
- You must have Read-Write permission for Security settings.
After you have configured HTTP Request Flood policies, you can select them in DoS Protection Profile.
Syntax
config security dos http-request-flood-protection
edit <name>
set status {enable|disable}
set request-limit-per-session <integer>
set action {pass|deny|period-block|captcha}
set block-period <integer>
set log {enable|disable}
set severity {high|medium|low}
set max-http-tps <integer>
next
end
|
status |
Enable or disable this HTTP Connection Flood policy. This is disabled by default. |
|
request-limit-per-session |
Specify the maximum number of HTTP requests allowed per second for a given session cookie. A value of 0 indicates no limit on HTTP requests. The default value is set to 0, with an acceptable range of 0-65535. When FortiADC receives an HTTP request, it first checks for a match between the URL and host. If a match is found, FortiADC inserts a cookie into the response header. For subsequent requests carrying the cookie inserted by FortiADC, the system tracks all TCP connections associated with the same cookie. If the number of connections reaches the specified limit, FortiADC enforces the configured action. |
|
action |
Specify the action to take when the HTTP Connection Flood policy is triggered.
|
|
block-period |
The block-period option is available is action is period-block. Specify the duration (in seconds) for blocking connections. The default value is 60 seconds, with an acceptable range of 1 to 3600 seconds. During this period, HTTP requests containing the blocked cookie will result in the associated TCP connection being terminated. This blocking action persists even after the FortiADC is rebooted. |
|
log |
Enable or Disable logging. When enabled, the action will be logged. |
|
severity |
Select the severity level.
The default value is high. |
|
max-http-tps |
Specify the number of shared memory blocks allocated for request limiting. The default value is 200000. |
Example
config security dos http-request-flood-protection
edit "request1"
set status enable
set request-limit-per-session 5
set max-http-tps 180000
set action period-block
set block-period 120
set log enable
set severity medium
next
end