config security dos tcp-access-flood-protection
A TCP Connection Access Flood Protection policy defends against connection flood attacks, which attempt to exhaust FortiADC’s connection handling capacity by rapidly initiating large volumes of TCP connection requests. These attacks may originate from a single IP or a distributed botnet, aiming to deny service to legitimate clients. By enforcing a per-source IP connection threshold, FortiADC detects excessive connection attempts and triggers a configured mitigation action to preserve system availability and prevent resource exhaustion.
Example
config security dos tcp-access-flood-protection
edit <name>
set max-access-count <integer>
set action {pass|deny|block-period}
set block-period <integer>
set severity {high|medium|low}
set log {enable|disable}
set exception <datasource>
next
end
|
max-access-count |
Specifies the maximum number of concurrent TCP connections allowed per source IP address. When the number of connections exceeds this limit, the configured action is triggered. The default value is 0, with a valid range of 0–65535. |
|
action |
Defines the behavior when the source IP exceeds the connection limit. Available options are:
The default value is deny. |
|
block-period |
The block-period option is available if action is block-period. Specifies the duration (in seconds) for which new connections from a source IP are blocked when block-period is selected as the action. The default is 60 seconds, with a valid range of 1–3600. |
|
severity |
Sets the severity level of log messages generated when the connection limit is exceeded. Options include:
The default value is high. |
|
log |
Enables or disables logging when the source IP exceeds the connection limit. The default value is disable. |
|
exception |
Specify the DoS Exception configuration object. See config security dos exception. This policy enforces a per-source IP connection limit. When a source IP is included in the exception rule, FortiADC excludes it from enforcement and allows the IP to exceed the defined connection threshold. |
Example
configure security dos tcp-access-flood-protection
edit tcp-conn
set max-access-count 256
set action block-period
set block-period 20
set log enable
set severity medium
set exception exception_1
next
end