Fortinet FortiDDoS, Installation Manual

Page: 14 / 37

Installation & Initial Configuration Configuring the operating mode
FortiDDoS v3.2 Installation Guide
28-320-183686-20130401
14
http://docs.fortinet.com/ • Feedback
Configuring the operating mode
Serial mode
Serial mode is the default mode of operation. In the Default mode, the FortiDDoS
device is positioned ‘inline’, meaning it is between the protected system(s) and the rest
of the network.
Figure 10 shows this.
Direction-based VID-based detection mode
Detection mode for a set of chosen VIDs in a specific direction is a mode in which the
appliance does not perform any blocking of data, but it does log events and build
traffic profiles. Data passes through the FortiDDoS device as it travels to and from the
protected system(s) and the rest of the network. After a sufficient learning period of
2-14 days, the FortiDDoS device should be placed inline (in Prevention mode).
Figure 10: Logical network configuration for Detection Mode
FortiDDoS devices can be simply placed in series (in-line) or can be placed in tandem
with a bypass switch to avoid failures.
Fortinet recommends FortiBridge bypass switches for failover protection. For other
bypass switches available in the market, please contact your Sales Engineer to check
if it is qualified to work with FortiDDoS appliances. Refer to
“Configuration Options” on
page 22 .
Direction-Based VID-Based Prevention Mode
Prevention Mode for a set of chosen VIDs in a specific direction is the full-function
operating mode of the FortiDDoS device. Place the unit inline between the protected
system(s) and the rest of the network. Any anomalous traffic or traffic that exceeds
threshold values is blocked. You can configure the unit to send any blocked traffic out
the corresponding auxiliary ports to a forensic capture device for further analysis.
Configuring
additional modes
To set the function of the auxiliary ports Click Configure > Global > Operating Mode .
1 Asymmetric Pair - Internal : LAN 2 and WAN 2 will be connected in such a way
that asymmetric traffic between two networks can be combined. This mode is
useful in case you want to connect 2 FortiDDoS devices in an asymmetric network.
Traffic from 2 uplinks is combined in both the FortiDDoS device using copies on
auxiliary ports.
Note: For connecting and configuring the bypass switches, the procedure remains same as the
Detection Mode. Please refer to the sections above.