To configure MM1 message flood threshold – web-based manager

1. Go to Security Profiles > MMS Profile.
2. Select Create New.
3. Enter MM1 flood for Profile Name.
4. Expand MMS Bulk Email Filtering Detection.
5. Enter the following information, and select OK.

MM1 (first column)
Enable	Enable
Message Flood Window	60 minutes
Message Flood Limit	100
Message Flood Block Time	30 minutes
Message Flood Action	Block

To configure MM1 message flood threshold – CLI

config firewall mms-profile edit profile_name config flood mm1 set status1 enable set window1 60 set limit1 100 set action1 block set block-time1 30

Notifying administrators of floods

end

end

The threshold values that you set for your network will depend on factors such as how busy your network is and the kinds of problems that your network and your subscribers encounter. For example, if your network is not too busy you may want to set message flood thresholds relatively high so that only an exceptional situation will exceed a flood threshold. Then you can use log messages and archived MMS messages to determine what caused the flood.

If your subscribers are experiencing problems with viruses that send excessive amounts of messages, you may want to set thresholds lower and enable blocking to catch problems as quickly as possible and block access to keep the problem from spreading.

Flood actions

When the Carrier-enabled FortiGate unit detects a message flood, it can take any combination of the five actions that you can configure for the flood threshold. For detailed options, see Message Flood.

Notifying administrators of floods

You can configure alert notifications for message floods by selecting the Alert Notification message flood action.

The FortiOS Carrier unit sends alert notifications to administrators using the MM1, MM3, MM4, or MM7 content interface. To send an alert notification you must configure addresses and other settings required for the content interface.

For example, to send notifications using the MM1 content interface you must configure a source MSISDN, hostname, URL, and port to which to send the notification. You can also configure schedules for when to send the notifications.

Finally you can add multiple MSISDN numbers to the MMS protection profile and set which flood thresholds to send to each MSISDN.

Example — three flood threshold levels with different actions for each threshold

You can set up to three threshold levels to take different actions at different levels of activity.

The first example threshold records log messages when a subscriber’s handset displays erratic behavior by sending multiple messages using MM1 at a relatively low threshold. The erratic behavior could indicate a problem with the subscriber’s handset. For example, you may have determined for your network that if a subscriber sends more the 45 messages in 30 minutes that you want to record log messages as a possible indication or erratic behavior.

From the web-based manager in an MMS profile set message Flood Threshold 1 to:

Enable

Selected

Example — three flood threshold levels with different actions for each threshold

Message Flood Window	30 minutes
Message Flood Limit	45
Message Flood Action	Log

From the CLI:

config firewall mms-profile edit profile_name config flood mm1 set status1 enable set window1 30 set limit1 45 set action1 log

end

end

Set a second higher threshold to take additional actions when a subscriber sends more that 100 messages in 30 minutes. Set the actions for this threshold to log the flood, archive the message that triggered the second threshold, and block the sender for 15 minutes.

From the web-based manager in an MMS profile set message Flood Threshold 2 to:

Enable	Selected
Message Flood Window	30 minutes
Message Flood Limit	100
Message Block Time	15 minutes
Message Flood Action	Log, DLP archive First message only, Block

From the CLI:

config firewall mms-profile edit profile_name config flood mm1 set status2 enable set window2 30 set limit2 100

set action2 block log archive-first set block-time2 15

end

end

Set the third and highest threshold to block the subscriber for an extended period and sand an administrator alert if the subscriber sends more than 200 messages in 30 minutes. Set the actions for this threshold to block the sender for four hours (240 minutes), log the flood, archive the message that triggered the third threshold, and send an alert to the administrator.

From the web-based manager in an MMS profile set message Flood Threshold 3 to:

Example — three flood threshold levels with different actions for each threshold

Enable	Selected
Message Flood Window	30 minutes
Message Flood Limit	200
Message Block Time	240 minutes
Message Flood Action	Log, Block, Alert Notification

Because you have selected the Alert Notification action you must also configure alert notification settings. For this example, the source MSISDN is 5551234—telephone number 555-1234. When administrators receive MMS messages from this MSIDSN they can assume a message flood has been detected.

In this example, alert notifications are sent by the FortiOS Carrier unit to the MMSC using MM1. The host name of the MMSC is mmscexample, the MMSC URL is /, and the port used by the MMSC is 80. In this example, the alert notification window starts at 8:00am and extends for eight hours on weekdays (Monday-Friday) and the minimum interval between message flood notifications is two hours.

Source MSISDN	5551234
Message Protocol	MM1
Hostname	mmscexample
URL	/
Port	80
Notifications Per Second Limit	0
Window Start Time	8:00
Window Duration	8:00
Day of Week	Mon, Tue, Wed, Thu, Fri, Sat
Interval	2 hours

From the CLI:

config firewall mms-profile edit profile_name config notification alert-flood-1 set alert-src-msisdn 5551234 set set msg-protocol mm1 set mmsc-hostname mmscexample

set mmsc-url / set mmsc-port 80 set rate-limit 0 set tod-window-start 8:00

Notifying message flood senders and receivers

set tod-window-duration 8:00

set days-allowed monday tuesday wednesday thursday friday set alert-int 2 set alert-int-mode hours

end

You must also add the MSISDNs of the administrators to be notified of the message flood. In this example, the administrator flood threshold 3 alert notifications are sent to one administrator with MSISDN 5554321.

To add administrator’s MSISDNs for flood threshold 3 from the web-based manager when configuring a protection profile, select MMS Bulk Email Filtering Detection > Recipient MSISDN > Create New.

MSISDN	5554321
Flood Level 3	Select

From the CLI:

config firewall mms-profile edit profile_name config notif-msisdn edit 5554321 set threshold flood-thresh-3

end

end