Fortinet FortiDDoS User manual
FortiDDoS v3.2
Installation Guide
April 1, 2013
28-320-183686-20130401
Copyright © 2013 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, and FortiGuard®,
are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be
trademarks of Fortinet. All other product or company names may be trademarks of their
respective owners. Performance metrics contained herein were attained in internal lab
tests under ideal conditions, and performance may vary. Network variables, different
network environments and other conditions may affect performance results. Nothing
herein represents any binding commitment by Fortinet, and Fortinet disclaims all
warranties, whether express or implied, except to the extent Fortinet enters a binding
written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly
warrants that the identified product will perform according to the performance metrics
herein. For absolute clarity, any such warranty will be limited to performance in the same
ideal conditions as in Fortinet’s internal lab tests. Fortinet disclaims in full any guarantees.
Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication
without notice, and the most current version of the publication shall be applicable.
Technical Documentation docs.fortinet.com
Knowledge Base kb.fortinet.com
Customer Service & Support support.fortinet.com
Training Services training.fortinet.com
FortiGuard www.fortiguard.com
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 3
http://docs.fortinet.com/ • Feedback
Table of Contents
Introduction .............................................................................................. 5
Scope of this document ................................................................................... 5
Introduction....................................................................................................... 5
Package contents ............................................................................................. 5
Simple deployment overview............................................................................ 6
Physical interfaces.................................................................................................. 6
Simple deployment................................................................................................. 7
Basic web hosting deployment .............................................................................. 8
Managed hosting deployment with high availability............................................... 9
Installation & Initial Configuration........................................................ 10
Installing the physical system ......................................................................... 10
Connecting the power cord.................................................................................. 10
Connecting the management ports...................................................................... 10
Setting up network properties ........................................................................ 10
Configuring interface settings......................................................................... 11
Checking system status ................................................................................. 12
Configuring the operating mode..................................................................... 14
Serial mode........................................................................................................... 14
Configuring additional modes .............................................................................. 14
Configuring prevention or detection mode for a set of VIDs in a specific direction .. 15
Configuring bypass mode .................................................................................... 15
Configuring emergency bypass mode.................................................................. 16
Configuring link down synchronization or link state propagation ........................ 16
Assigning Virtual Identifiers (VIDs) to protect systems ................................... 16
Configuring VIDs................................................................................................... 17
Performing a sanity test.................................................................................. 18
Steps for performing a ping test........................................................................... 18
Monitoring events ........................................................................................... 20
Showing traffic................................................................................................ 20
Showing event reports.......................................................................................... 21
Table of Contents
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 4
http://docs.fortinet.com/ • Feedback
Configuration Options ........................................................................... 22
Using bypass switches for fail-over................................................................ 22
Using an optical bypass switch with heartbeat .................................................... 23
Using copper 10/100/1000 bypass switch with heartbeat................................... 23
Using traffic diversion in service provider environment.................................. 24
Traffic diversion .................................................................................................... 24
Traffic diversion using a single divert-from and inject-to router and a switch ..... 26
Using load balancing to support higher bandwidth in service provider
environment .................................................................................................... 29
Load balancing ..................................................................................................... 29
Using FortiGuard IP Reputation Service......................................................... 36
Configuring FortiGuard IP Reputation Service ..................................................... 36
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 5
http://docs.fortinet.com/ • Feedback
Introduction
Scope of this document
This document gives the details in installing and configuring FortiDDoS devices.
This document covers:
•Package contents
•Simple deployment overview
•Installing the physical system
•Setting up network properties
•Configuring interface settings
•Checking system status
•Configuring the operating mode
•Assigning Virtual Identifiers (VIDs) to protect systems
•Performing a sanity test
•Monitoring events
•Showing traffic
•Using bypass switches for fail-over
•Using traffic diversion in service provider environment
•Using load balancing to support higher bandwidth in service provider environment
•Using FortiGuard IP Reputation Service
Introduction
This document explains the tasks required to initially install a FortiDDoS device in a
network. We assume that you have already read the FortiDDoS Fundamentals Guide,
and are familiar with the fundamental concepts related to FortiDDoS devices. This
document explains package contents, system overview, selecting a mode of
operation, the physical installation, how to change the IP address for the management
port, and how to assign Virtual Identifiers to protect specific systems. It also shows you
how to perform a ping test, and an overview of how to monitor events and traffic.
Package contents
Before you begin, please be sure the following items are in the package. If the package
is not complete, contact your supplier.
•FortiDDoS device
•Power cord
•Documentation CD
•Brackets to mount the chasis on a rack
Introduction Simple deployment overview
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 6
http://docs.fortinet.com/ • Feedback
Simple deployment overview
The simple configuration and location of interfaces on the FortiDDoS devices are
described below.
Physical
interfaces
Refer to Figure 1 on page 7 for physical interfaces on FortiDDoS devices.
Traffic Processing (TP) Boards
FDD-100A contains one Traffic Processing Board.
FDD-200A contains two Traffic Processing Boards.
FDD-300A contains three Traffic Processing Boards.
Data ports on each TP Board
There are two pairs of Ethernet ports located on the back panel of the FortiDDoS
device. There are copper and SFP ports. At a given time, you can use either copper or
fiber for a link.
For the FDD-100A, ports are marked LAN 1, WAN 1, LAN 2 and WAN 2.
The FDD-200A has additional ports that are marked LAN 3, WAN 3, LAN 4 and WAN 4.
The FDD-300A has additional ports that are marked LAN 5, WAN 5, LAN 6 and WAN 6.
USB keyboard port
Use of the keyboard port is optional and is to be used during diagnostics on the
console.
Serial Interface through USB port
A serial console can be connected using a USB to serial adapter. The console can be
used for Command Line Interface (CLI) access for advanced usage.
Monitor port
Use of monitor port is optional and is to be used during diagnostics on the console.
This is a DVI port. If you have VGA monitor connector, you will need a DVI to VGA
adapter for connecting your monitor.
Ethernet port for management interface
The management of FortiDDoS devices is normally done over IP over Ethernet. The
Gigabit Ethernet Port can be connected to a private or public network. The device
Web-based Manager can then be accessed over SSL using the connection. For
diagnostics, the CLI can be accessed over secure shell (ssh) over the same network.
Note: Please retain the carton, including the original packing materials in case there is a need to
return the product.
Introduction Simple deployment overview
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 7
http://docs.fortinet.com/ • Feedback
Figure 1: Back panel of a FortiDDoS 100A device with copper and fiber interfaces and the management Interfaces
Simple
deployment
The FortiDDoS device is designed to protect a system or a network of systems from
rate-based attacks and anomaly attacks. If multiple systems or workgroups are
protected by a FortiDDoS device, a switch will be required between the FortiDDoS
appliance and the protected systems.
Figure 2: A simple network prior to installation of a FortiDDoS device
In a simple network shown in Figure 2, a system is connected to an Ethernet local area
network.
In the simplest configuration, you can install a FortiDDoS unit as an inline device, as
shown in Figure 3.
Figure 3: Network with a FortiDDoS device protecting a single system
The appliance is stateful and bidirectional, so a concept of ‘direction’ must be
introduced to differentiate between inbound and outbound traffic.
As shown in Figure 4 below, in a typical installation, the Ethernet segment connected
to the protected systems is connected to LAN 1. The Ethernet segment connected to
the rest of the network (typically the Internet) is connected to WAN 1.
Introduction Simple deployment overview
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 8
http://docs.fortinet.com/ • Feedback
Figure 4: Recommended directionality of FortiDDoS devices
Basic web
hosting
deployment
More complex setups can protect multiple systems. In a basic web hosting
deployment a FortiDDoS device can protect systems in multiple customer cages as
shown in Figure 5. You can either use a single VID system or a multiple VID system.
Please refer to the FortiDDoS Fundamentals Guide for concepts related to VID and the
FortiDDoS Web-Based Manager Guide for the actual configuration of VIDs.
Figure 5: Basic web hosting deployment of FortiDDoS devices
Introduction Simple deployment overview
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 9
http://docs.fortinet.com/ • Feedback
Managed hosting
deployment with
high availability
Figure 6 shows another setup protecting multiple systems in a data center
environment.
In this case two FortiDDoS devices independently protect the routers and the
subsequent networks from DoS and DDoS attacks.
Figure 6: Managed hosting deployment with high availability
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 10
http://docs.fortinet.com/ • Feedback
Installation & Initial Configuration
There are nine main steps to install and configure FortiDDoS devices. They are:
1Installing the physical system
2Setting up network properties
3Configuring interface settings
4Checking system status
5Configuring the operating mode
6Assigning Virtual Identifiers (VIDs) to protect systems.
7Performing a sanity test
8Monitoring events
9Showing traffic
Installing the physical system
Follow these steps to install the system:
Connecting the
power cord
1Take the FortiDDoS device out of the box and make sure the power switch is off.
2Connect one end of the power cord to an appropriate 110/220 outlet and the other
end to the appliance itself.
Connecting the
management
ports
To manage the FortiDDoS device via a web browser:
1Connect the 10/100 ethernet port to a workgroup switch/router or use a crossover
Ethernet cable to a computer with an HTML web browser. The IP address of the
management port is preset to 192.168.1.1.
2You must first access the FortiDDoS device using this IP address, but you may
change it by clicking Manage > Global > Device Configuration > IP Address after
you connect.
Setting up network properties
To set the network properties:
1From a workstation or PC, access the graphical user interface on the FortiDDoS
device over the management Ethernet by using the default address
https://192.168.1.1 as the URL.
Caution: The appliance must be switched off for at least 30 seconds before restarting.
Note: You must use https when entering the address. The system will not respond to access
requests using http (without the ‘s’).
Installation & Initial Configuration Configuring interface settings
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 11
http://docs.fortinet.com/ • Feedback
2Log in using the default user ID fddroot and the default password rootpasswd.
3You can change the IP address to one that is appropriate for your domain using the
Manage > Global > Device Configuration > IP address menu. The DNS and gateway
settings are used to send E-mail summaries of events. E-mail cannot be sent until
valid addresses are configured for these fields.
4The host name is used to logically name the FortiDDoS system for easy reference.
Following table contains the default IP addresses and name assignments of your
FortiDDoS device.
Configuring interface settings
Every network is different and the interfaces to which the main ports and auxiliary ports
of the FortiDDoS device are connected have to be described clearly to the device so
that it can communicate with the networks without any errors.
You must know the network settings before installing FortiDDoS device. The existing
switches/routers/firewalls have their ports set to certain speed, duplexity, and flow
control mode.
With those settings in mind, you must set the values in the Configure> Global> Card 1
> Interface Settings Menu shown in Figure 7.
1Configure LAN 1 to Copper or Fiber and then to Auto or Forced depending on the
port connected to LAN 1. If you set it to Forced, configure the speed, the duplex
value and the flow control value. Some of the settings will be enabled or disabled
depending on the Interface or Mode.
2Repeat step 1for WAN 1, LAN 2 and WAN 2.
3Repeat the same steps for other cards in the appliance.
Table 1: Default IP Addresses & Hostname
IP Address for FortiDDoS device 192.168.1.1
Netmask 255.255.255.0
DNS 1 Address UNDEFINED
DNS 2 Address UNDEFINED
Gateway Address UNDEFINED
Hostname A unique character string assigned by the
factory
Installation & Initial Configuration Checking system status
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 12
http://docs.fortinet.com/ • Feedback
Figure 7: Configuring interface settings for ports
Checking system status
The System Status page (accessible from the main menu), shown in Figure 8 and
Figure 9 show the overall health of the system.
These pages shows the port status. You must make sure that the Configured, Actual
and Link Partner Ability correspond correctly to your network and expectation.
These pages will also tell you if the sendmail service is operational. This service can be
used in conjunction with the Event Monitor to notify you (or other email recipients) of
system events. This can be configured under the Configure > Current VID > Event
Notification menu.
For the FortiDDoS device to send a mail message, it must be able to contact a Domain
Name Server (DNS) to resolve the domain name of the email addresses. The status
page will indicate whether the system is able to reach a DNS server.
In case you are having trouble establishing connectivity, you must carefully study the
values for configured, actual and link partner ability.
Note: In case of forced settings, the link partner abilities must be ignored.
Installation & Initial Configuration Checking system status
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 13
http://docs.fortinet.com/ • Feedback
Figure 8: Status page for FortiDDoS devices with copper connections - Part 1
Figure 9: Status page for FortiDDoS devices with copper connections - Part 2
Installation & Initial Configuration Configuring the operating mode
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 14
http://docs.fortinet.com/ • Feedback
Configuring the operating mode
Serial mode Serial mode is the default mode of operation. In the Default mode, the FortiDDoS
device is positioned ‘inline’, meaning it is between the protected system(s) and the rest
of the network. Figure 10 shows this.
Direction-based VID-based detection mode
Detection mode for a set of chosen VIDs in a specific direction is a mode in which the
appliance does not perform any blocking of data, but it does log events and build
traffic profiles. Data passes through the FortiDDoS device as it travels to and from the
protected system(s) and the rest of the network. After a sufficient learning period of
2-14 days, the FortiDDoS device should be placed inline (in Prevention mode).
Figure 10: Logical network configuration for Detection Mode
FortiDDoS devices can be simply placed in series (in-line) or can be placed in tandem
with a bypass switch to avoid failures.
Fortinet recommends FortiBridge bypass switches for failover protection. For other
bypass switches available in the market, please contact your Sales Engineer to check
if it is qualified to work with FortiDDoS appliances. Refer to “Configuration Options” on
page 22.
Direction-Based VID-Based Prevention Mode
Prevention Mode for a set of chosen VIDs in a specific direction is the full-function
operating mode of the FortiDDoS device. Place the unit inline between the protected
system(s) and the rest of the network. Any anomalous traffic or traffic that exceeds
threshold values is blocked. You can configure the unit to send any blocked traffic out
the corresponding auxiliary ports to a forensic capture device for further analysis.
Configuring
additional modes
To set the function of the auxiliary ports Click Configure > Global > Operating Mode.
1 Asymmetric Pair - Internal: LAN 2 and WAN 2 will be connected in such a way
that asymmetric traffic between two networks can be combined. This mode is
useful in case you want to connect 2 FortiDDoS devices in an asymmetric network.
Traffic from 2 uplinks is combined in both the FortiDDoS device using copies on
auxiliary ports.
Note: For connecting and configuring the bypass switches, the procedure remains same as the
Detection Mode. Please refer to the sections above.
Installation & Initial Configuration Configuring the operating mode
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 15
http://docs.fortinet.com/ • Feedback
Figure 11: Ports
2 Asymmetric Pair - External: Connect LAN 2 and WAN 2 to external ports that
copy the traffic for the other link. The task of copying is entrusted to an external
source. Traffic from 2 uplinks is combined in both the FortiDDoS device using
copies available on the auxiliary ports.
3 Default Mode: Connect LAN 2 to internal network and WAN 2 to the second
Internet link. This mode is useful in case you want to connect 1 FortiDDoS device in
an asymmetric network or a network having two Internet links. Traffic from 2 links is
combined internally in the device. However, at the egress port, the traffic
corresponds to the corresponding link. E.g. WAN 1 receives traffic from LAN 1 and
vice versa. Similarly LAN 2 receives traffic from WAN 2 and versa.
Configuring
prevention or
detection mode
for a set of VIDs
in a specific
direction
To set the Prevention/Detection Mode of a set of VIDs, click Configure > Global >
Operating Mode. Please refer to Figure 11 above.
In Prevention/Detection Mode section, click the VIDs you want in Prevention Mode and
leave the VIDs unchecked if you want them in Detection Mode. You can choose the
modes in Inbound or Outbound or both directions.
Click Save.
Configuring
bypass mode
Bypass is relevant in case of appliance management path failure. It is assumed that the
data path failures are handled separately - in some cases using an external bypass
switch.
In case of Management Path failure, the user can choose one of the following:
1Extrinsic Bypass
2Intrinsic Bypass
3No Bypass
Choose Extrinsic Bypass in case you want the external bypass switch to be enabled -
implies no prevention.
Choose Intrinsic Bypass in case you want the intrinsic bypass to be triggered - in case
you do not have external bypass switches and also implies no prevention.
Installation & Initial Configuration Assigning Virtual Identifiers (VIDs) to protect systems
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 16
http://docs.fortinet.com/ • Feedback
Choose No Bypass in case you want the existing mode to continue without updated
thresholds - implies no continuous learning and adaptive prevention/detection.
To set the Bypass Mode of the appliance, click Configure > Global > Operating Mode.
Please refer to Figure 11 above.
In Bypass Mode section, select one of the above bypass modes.
Click Save.
Configuring
emergency
bypass mode
At certain times, to eliminate the possibility of malfunction of the FortiDDoS device,
you may want to bypass the device logic while keeping the device inline. To achieve
such a functionality, you can keep the appliance in Emergency Bypass Mode. This
ensures that the packets which arrive at ingress ports are simply transferred to the
corresponding egress ports - just like a wire.
To set the Emergency Bypass Mode of the appliance, click Configure > Global >
Operating Mode. Please refer to Figure 11 above.
In Emergency Bypass Mode section, click on the checkbox for Emergency Bypass.
Click Save.
Configuring link
down
synchronization
or link state
propagation
Link Down Synchronization lets you configure FortiDDoS device to force the partner
link down on a segment when one of the links goes down. The device monitors the link
state for a pair of ports which are protecting a segment. These correspond to LAN 1
(connected to LAN) or WAN 1 (connected to the Internet). Similarly for Dual WAN Link
mode, these ports correspond to LAN 2 and WAN 2.
If the link goes down on either port, the partner port is disabled. Link Down
Synchronization once enabled, propagates the link state across the FortiDDoS device.
This is the default functionality. If you want to disable this functionality, you must select
Hub mode.
This feature is not useful when using bypass switches and must be set to HUB mode
instead of default WIRE mode.
To enable Link Down Synchronization, you don’t have to make any changes. It is set as
the factory default.
To set the Link Down Synchronization to Hub Mode, click Configure > Global > Link
Down Synchronization.
In Link Down Synchronization section, click on the radio button for Hub.
Type yes in the text box and press OK.
Assigning Virtual Identifiers (VIDs) to protect systems
Virtual Identifiers (VIDs) enable you to “virtualize” the device to behave as if it were
multiple physical appliances with each appliance conforming to a single
server/network.
Because each networked system has different traffic characteristics, the FortiDDoS
device allows you to build a unique profile for each server/network you want to protect.
Note: Changes to Link Down Synchronization requires restarting the services - which leads to
some downtime. Please plan for the downtime.
Installation & Initial Configuration Assigning Virtual Identifiers (VIDs) to protect systems
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 17
http://docs.fortinet.com/ • Feedback
These servers/networks may be specific to individual departments, or may be used for
different applications such as web hosting, E-mail or DNS queries.
Your FortiDDoS device is pre-configured to accommodate either 1, 4, or 8 VIDs. Each
VID can be measured against a unique set of threshold parameters that are
independent of other VIDs. This is shown in Figure 12 Not all VIDs need to be
configured; you may leave blank those that you do not need.
Figure 12: Network with FortiDDoS protecting multiple VIDs
Configuring VIDs To configure a VID:
1From the main menu, click Configure > Global > VIDs
2Simply enter the following information:
• Subnet ID
This ID is used to for subnet-based reporting. Administrator can generate attack
event report for individual subnets.
You can enter up to 512 subnets. Please refer to the datasheet of your
appliance.
• IP Address
This corresponds to the IP address of the subnet you want to add to a VID.
• Netmask
This corresponds to the Netmask of the subnet you want to add to a VID.
Note: It is recommended that you use a single network switch between the FortiDDoS device
and protected systems. The goal is to avoid inserting any potential source of attack traffic
that does not pass through the device.
Installation & Initial Configuration Performing a sanity test
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 18
http://docs.fortinet.com/ • Feedback
• VID Number
This corresponds to the actual VID number.
• Alternate VID Number
This corresponds to the alternate VID number. An alternate VID is a VID where
the subnet is transferred once the traffic to the subnet exceeds the Threshold
(below)
• Threshold
The threshold corresponds to the packet rate beyond which the subnet is
moved to Alternate VID number. If the traffic goes below this threshold for a
preconfigured time period, it goes back to the (original) VID Number. The timeout
is defined in the same screen in a different fieldset. This feature can be enabled
or disabled by switching the check-box Allow VID Switching based on
thresholds to off or on.
• Comment
For a detailed description of VID configuration, please refer to the Web-based Manager
Administration Guide.
Performing a sanity test
The following steps can serve as a simple demonstration of how FortiDDoS devices
block traffic. To run the demo, the network configuration should be in serial
prevention mode as shown in Figure 13. The protected server should respond to
ICMP Echo (ping) packets, and a connected system upstream must be capable of
generating a series of ICMP Echo Request packets.
Figure 13: Ping test configuration
Steps for
performing a ping
test
1Configure the FortiDDoS device threshold for ping to 5 packets per second.
To do this, click Configure > Current VID > Blocking Threshold > Layer 3 > Protocols
from the main menu. You set the ICMP threshold here because it is in the Layer 3
packet that you determine the type of protocol to use. In this case, you will set a
threshold for ICMP packets, which corresponds to protocol number 1. Refer to
Figure 14.
Set your inbound and outbound thresholds for ICMP to 5 packets per second.
Installation & Initial Configuration Performing a sanity test
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 19
http://docs.fortinet.com/ • Feedback
Figure 14: Blocking Conditions for ICMP for Ping Test
You must click Save in the screen above the Layer 3 Classifier table to record your
settings in the system. The system may pause for a few seconds before confirming
that the new values have been updated.
2Generating ICMP (ping) traffic
From the PC/Workstation, generate a small, controlled flood of 100 ICMP Echo
(ping) packets directed to the protected system. In UNIX/LINUX, the command line
input will look like this:
ping –c 100 –i 0.1 AA.BB.CC.DD (where AA.BB.CC.DD represents the IP
address of the protected system)
The command above will generate an ICMP Echo Request (ping) packet to the
specified address every 0.1 seconds until 100 packets are sent. This is the
equivalent of 10 packets per second for 10 seconds.
Following is a screen capture from an actual ping flood test. Notice that the first few
pings are allowed to pass and receive a response. As soon as the rate per second
rises above the threshold, (somewhere in the first 11 packets) the FortiDDoS device
blocks all ICMP packets for the 10 second threshold. After the blocking period,
ICMP packets are again allowed until the threshold is reached.
In the sequence below, this is reflected by responses to the first 7 ping requests,
followed by no response to the next 80 packets (blocked by the appliance). Then
packets 87-93 are allowed before the threshold is again reached.
[root@client1 win]# ping -c 100 -i 0.1 172.16.0.50
PING 172.16.0.50 (172.16.0.50) 56(84) bytes of data.
64 bytes from 172.16.0.50: icmp_seq=1 ttl=64 time=0.503 ms
64 bytes from 172.16.0.50: icmp_seq=2 ttl=64 time=0.307 ms
Installation & Initial Configuration Monitoring events
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401 20
http://docs.fortinet.com/ • Feedback
64 bytes from 172.16.0.50: icmp_seq=3 ttl=64 time=0.220 ms
64 bytes from 172.16.0.50: icmp_seq=4 ttl=64 time=0.314 ms
64 bytes from 172.16.0.50: icmp_seq=5 ttl=64 time=0.260 ms
64 bytes from 172.16.0.50: icmp_seq=6 ttl=64 time=0.281 ms
64 bytes from 172.16.0.50: icmp_seq=7 ttl=64 time=0.206 ms
64 bytes from 172.16.0.50: icmp_seq=87 ttl=64 time=0.275 ms
64 bytes from 172.16.0.50: icmp_seq=88 ttl=64 time=0.336 ms
64 bytes from 172.16.0.50: icmp_seq=89 ttl=64 time=0.192 ms
64 bytes from 172.16.0.50: icmp_seq=90 ttl=64 time=0.192 ms
64 bytes from 172.16.0.50: icmp_seq=91 ttl=64 time=0.247 ms
64 bytes from 172.16.0.50: icmp_seq=92 ttl=64 time=0.172 ms
64 bytes from 172.16.0.50: icmp_seq=93 ttl=64 time=0.284 ms
--- 172.16.0.50 ping statistics ---
100 packets transmitted, 14 received, 86% packet loss, time
11253ms
rtt min/avg/max/mdev = 0.172/0.270/0.503/0.082 ms
The line above mentions that 14 responses were received, indicating 86 packets
were not received.
Monitoring events
The Monitor button on the screen shows the properties of all events that have occurred
for a selected period of time.
Event Monitor provides a comprehensive way to display network attacks so that users
can investigate them intuitively. Users can choose a particular date range or number of
events to be displayed. In addition, FortiDDoS devices provide categorized event
entries as well as VID and database choices so that users can see only the events of
their interest.
The events can be viewed at various levels as a table.
When packets are dropped by the appliance, you can see the cause of the drops and
other details as events in the event monitor.
Refer to the DDoS Fundamentals Guide for further details.
Showing traffic
The FortiDDoS user interface provides several granular traffic graphs. You can see the
traffic through each VID independently. The detailed description of these graphs is
available in the FortiDDoS Web-based Manager Guide. Corresponding to the ping test
in “Performing a sanity test” on page 18, activity will appear in the following and
several other graphs:
1Show > Global > Card 1 > LAN 1 and WAN 1
2Show > Current VID > Layer 3 > My Graphs > Protocols
3Show > Current VID > Layer 4 > My Graphs > ICMP Types and Codes.
Note: The number of blocked requests may vary between 80 and 90 depending on when the
flood is started relative to the FortiDDoS device one second boundary.
Table of contents
