FortiDDoS is a dedicated solution for mitigating distributed denial-of-service attacks, based on learning normal traffic rather than on signatures.
FortiDDoS is Fortinet's range of appliances and virtual machines dedicated to detecting and mitigating distributed denial-of-service (DDoS) attacks. The product is still sold and documented in 2026. Its underlying principle is straightforward: learn what the legitimate traffic of a network looks like, then automatically block whatever deviates from it, across layers 3, 4 and 7.
A DDoS attack seeks to make a service unavailable by saturating either the available bandwidth, the resources of a device (the session tables of a firewall, the processor of a server), or a specific application. Next-generation firewalls do include anti-DoS policies, but they keep state for every session: during a massive flood, the firewall itself can sometimes become the point of failure.
A specialized appliance sits upstream and focuses on a single task: distinguishing abnormal traffic from normal traffic very quickly, without spending resources tracking every connection the way a firewall would. This is the approach behind FortiDDoS, which is mainly aimed at internet service providers, hosting providers and organizations that expose critical services.
What sets FortiDDoS apart is that it does not depend on a database of attack signatures. The appliance builds a baseline of usual traffic from a very large number of parameters: protocols, ports, packet sizes, connection rates, HTTP methods, DNS queries and so on. From this baseline it derives adaptive thresholds, which are recalculated over time, and it takes action when the observed traffic exceeds them.
This approach offers two practical advantages:
On the other hand, it requires a careful learning phase. If the baseline is built during an atypical period (maintenance work, a seasonal peak), the thresholds will be poorly calibrated. Administrators must therefore monitor this phase closely and review the thresholds periodically after any architectural change.
The official documentation describes protection spread across several levels:
Layer 7 attacks are often the hardest to spot, because each individual request looks legitimate: it is their volume and their distribution that give them away.
Fortinet positions FortiDDoS as an always-on solution placed inline in the traffic path, rather than as an out-of-band detection system that redirects traffic after the fact. The appliances include bypass mechanisms so that the network is not cut off if the device fails, and high availability is supported.
The range includes hardware appliances of different capacities as well as virtual machines (VM04, VM08, VM16) for smaller or virtualized environments. Older generations of appliances follow their own end-of-support schedule: before any renewal project, check the status of your models on the Fortinet support portal.
One important point: an on-premises appliance cannot absorb a volumetric attack that exceeds the capacity of your internet link. FortiDDoS provides a documented API that allows integration with third-party cloud traffic scrubbing services. The most robust architecture therefore combines fast, fine-grained local protection with an upstream service, at the operator level or in the cloud, to handle volumetric peaks.
The tool alone is not enough. The joint CISA, FBI and MS-ISAC guide on DDoS attacks distinguishes between volumetric, protocol and application-layer attacks, and recommends preparing for them in advance. In practice, this means you should:
Unavailability scenarios should also be included in your business continuity plan.
Operating a solution such as FortiDDoS properly requires a solid command of network protocol fundamentals, the ability to read a traffic profile and an understanding of how firewalls, anti-DDoS appliances and upstream services fit together. Several training paths contribute to this:
FortiDDoS addresses a specific need: automatically detecting and mitigating denial-of-service attacks through behavioral analysis of traffic. Its effectiveness nevertheless depends on proper calibration, on an architecture that plans for absorbing volumetric attacks upstream, and on teams capable of interpreting what they observe.