Firewall Rate Limiting and DDoS Protection: Configuration Guide

April 15, 2026·2 min read·256 words

Basic rate limiting and DDoS protection for enterprise firewalls. These measures complement, but do not replace, cloud scrubbing services such as Cloudflare and Akamai. FortiGate, Palo Alto, and Cisco configurations. 2026 guide.

DDoS Attack Types

Volumetric: UDP/ICMP floods and bandwidth saturation
Protocol: SYN flood, Ping of Death, and Smurf
Application (L7): HTTP floods, Slowloris, and sophisticated attacks
Amplification: DNS, NTP, and Memcached (attackers send a small request, and the victim receives an amplified response)

FortiGate DoS Protection

config firewall DoS-policy
edit 1
set name "DoS-WAN"
set interface "port10"
set srcaddr "all"
set dstaddr "all"
set service "ALL"
config anomaly
edit "icmp_flood"
set status enable
set action block
set threshold 1000
next
edit "tcp_syn_flood"
set status enable
set threshold 2000

Palo Alto Zone Protection

Zone Protection Profile: protects the entire zone
DoS Protection Profile: provides more granular policy control
Types: flood (SYN/UDP/ICMP), reconnaissance, and packet-based
Thresholds: alert, activate, and maximum

Cisco IOS

ip tcp intercept list 101: SYN flood protection
ip tcp intercept drop-mode random
CoPP (Control Plane Policing): protects the router CPU
ip arp inspection: protects against L2 ARP spoofing

Firewall DDoS Protection Limitations

Does not protect against massive volumetric attacks (>10 Gbps)
The FW itself can become saturated
Solution: upstream scrubbing (Cloudflare, Akamai, Radware)
GRE redirection or BGP blackholing for mitigation

Scrubbing Services

Cloudflare Magic Transit: BGP + GRE
Akamai Prolexic: enterprise leader
Radware DefensePro: on-premises hardware
AWS Shield Advanced
Capacity: mitigation of up to 10 Tbps

Order from OPTINOC

FW DDoS configuration + cloud scrubbing integration. FortiGate, Palo Alto, and Cisco. Quote within 48h.