Firewall Rate Limiting and DDoS Protection: Configuration Guide

April 15, 2026·2 min read·256 words

Basic rate limiting and DDoS protection for enterprise firewalls. These measures complement, but do not replace, cloud scrubbing services such as Cloudflare and Akamai. FortiGate, Palo Alto, and Cisco configurations. 2026 guide.

DDoS Attack Types

Volumetric: UDP/ICMP floods and bandwidth saturation
Protocol: SYN flood, Ping of Death, and Smurf
Application (L7): HTTP floods, Slowloris, and sophisticated attacks
Amplification: DNS, NTP, and Memcached (attackers send a small request, and the victim receives an amplified response)

FortiGate DoS Protection

config firewall DoS-policy
edit 1
set name "DoS-WAN"
set interface "port10"
set srcaddr "all"
set dstaddr "all"
set service "ALL"
config anomaly
edit "icmp_flood"
set status enable
set action block
set threshold 1000
next
edit "tcp_syn_flood"
set status enable
set threshold 2000

Palo Alto Zone Protection

Zone Protection Profile: protects the entire zone
DoS Protection Profile: provides more granular policy control
Types: flood (SYN/UDP/ICMP), reconnaissance, and packet-based
Thresholds: alert, activate, and maximum

Cisco IOS

ip tcp intercept list 101: SYN flood protection
ip tcp intercept drop-mode random
CoPP (Control Plane Policing): protects the router CPU
ip arp inspection: protects against L2 ARP spoofing

Firewall DDoS Protection Limitations

Does not protect against massive volumetric attacks (>10 Gbps)
The FW itself can become saturated
Solution: upstream scrubbing (Cloudflare, Akamai, Radware)
GRE redirection or BGP blackholing for mitigation

Scrubbing Services

Cloudflare Magic Transit: BGP + GRE
Akamai Prolexic: enterprise leader
Radware DefensePro: on-premises hardware
AWS Shield Advanced
Capacity: mitigation of up to 10 Tbps

Order from OPTINOC

FW DDoS configuration + cloud scrubbing integration. FortiGate, Palo Alto, and Cisco. Quote within 48h.

Frequently Asked Questions

Un firewall peut-il arrêter une attaque DDoS volumétrique ?

Un firewall protège contre les attaques de faible à moyenne intensité (< 1 Gbps). Pour les attaques volumétriques massives (> 10 Gbps), un service de mitigation en amont (Cloudflare, Akamai, OVH Anti-DDoS) est indispensable car l'attaque sature le lien avant d'atteindre le firewall.

Quels sont les types de rate limiting à configurer ?

Trois niveaux : CoPP (Control Plane Policing) sur les routeurs pour protéger le CPU, rate limiting applicatif sur le firewall pour limiter les connexions par IP, et policing de bande passante sur les interfaces pour les flux abusifs.

Comment dimensionner les seuils de rate limiting ?

Analysez le trafic normal pendant 2 semaines avec NetFlow. Identifiez les pics légitimes (max connections/s, max bandwidth). Configurez les seuils à 150-200% du pic normal pour éviter les faux positifs tout en bloquant les attaques.