Two months ago, a Philippine ISP customer was hit with a 45 Gbps DDoS attack. Their entire network went down for 6 hours. Thousands of businesses lost internet access. The attack was a SYN flood targeting their DNS infrastructure. They had no DDoS protection.
DDoS attacks are getting bigger, cheaper, and more frequent. In 2024, the average attack size was 30 Gbps - enough to knock most businesses offline. Here's how to design protection that actually works.
What is ISP-Grade DDoS Protection?
ISP-grade DDoS protection is a multi-layered defense system designed to absorb and mitigate large-scale distributed denial-of-service attacks. It combines on-premises detection with cloud-based scrubbing to handle attacks that exceed your local bandwidth.
There are three types of DDoS attacks you need to protect against: Volumetric attacks (UDP floods, DNS amplification) that saturate bandwidth. Protocol attacks (SYN floods, Ping of Death) that exhaust network resources. Application attacks (HTTP floods, Slowloris) that target web servers.
Why ISP-Grade Protection Matters
A 10 Gbps DDoS attack costs attackers about $10 to launch. A 100 Gbps attack costs $50. The barrier to launching devastating attacks is almost zero.
Without protection, even a small attack can take down your website, email, and VPN. For ISPs, a DDoS attack doesn't just affect you - it affects every customer on your network.
How to Design DDoS Protection
Layer 1: On-Premises Detection
Deploy DDoS detection at your network edge. FortiGate's DoS policy can detect and mitigate smaller attacks (under 10 Gbps) at the source.
Configure FortiGate's DoS policy: Enable SYN flood protection, UDP flood protection, ICMP flood protection. Set thresholds based on your normal traffic baseline. Alert when thresholds are exceeded.
Layer 2: ISP-Level Scrubbing
For attacks larger than your bandwidth, you need ISP-level scrubbing. Work with your ISP to set up BGP-based DDoS mitigation. When an attack is detected, traffic is rerouted to a scrubbing center where malicious traffic is filtered.
Most ISPs offer this as a service. The cost is typically $500-2000/month depending on your bandwidth and protection level.
Layer 3: Cloud-Based Protection
Cloudflare, Akamai, and AWS Shield provide cloud-based DDoS protection. They absorb attacks at their edge, before traffic reaches your network.
For web applications, put them behind a CDN with DDoS protection. Cloudflare's free tier handles up to 50 Gbps attacks. For larger protection, their Pro plan starts at $20/month.
Layer 4: DNS Protection
DNS is the most common DDoS target. If your DNS goes down, everything goes down. Use: redundant DNS providers, Anycast DNS for distributed resolution, and DNS rate limiting on your authoritative servers.
Best Practices
1. Establish a baseline. Know your normal traffic patterns so you can detect anomalies. Use FortiAnalyzer or a monitoring tool to track traffic volumes.
2. Create an incident response plan. Who gets called? What's the escalation path? How do you communicate during an attack? Have this documented before you need it.
3. Test regularly. Run tabletop exercises and simulated attacks to verify your protection works. Don't wait for a real attack to find gaps.
4. Deploy redundant infrastructure. Single points of failure are attack magnets. Redundant ISPs, load balancers, and DNS providers reduce your attack surface.
5. Monitor upstream. Work with your ISP to get notified of attacks targeting your IP space.
Common Mistakes
Mistake 1: Relying solely on on-premises protection. FortiGate can handle small attacks, but a 50 Gbps attack will saturate your link before the firewall even sees it.
Mistake 2: No DNS redundancy. If you only use your ISP's DNS servers, a DDoS against them takes you offline. Use multiple DNS providers.
Mistake 3: Ignoring application-layer attacks. Volumetric attacks get attention, but Slowloris and HTTP floods can take down your web server with minimal bandwidth.
Conclusion
DDoS protection requires a multi-layer approach: on-premises detection, ISP scrubbing, cloud protection, and DNS redundancy. No single solution handles all attack types. Start with the basics - FortiGate DoS policies and a cloud CDN - then add layers as your risk grows.
Want to go deeper? Explore [Protect security services](/en/products/protect), [industry solutions](/en/solutions), or [get a security assessment](/en/contact).
FAQ
Q: How much does DDoS protection cost? A: Basic: $0-50/month (Cloudflare free tier + FortiGate DoS). Mid-range: $500-2000/month (ISP scrubbing). Enterprise: $5000+/month (dedicated mitigation service).
Q: Can FortiGate handle DDoS attacks? A: Yes, for smaller attacks (under your link bandwidth). FortiGate's DoS policy detects and mitigates SYN floods, UDP floods, and ICMP floods. For larger attacks, you need ISP or cloud scrubbing.
Q: How do I know if I'm under DDoS attack? A: Symptoms include: sudden bandwidth spike, slow or unavailable services, unusual traffic patterns from many sources. FortiGate logs and FortiAnalyzer dashboards show attack indicators.
Q: Should I blackhole routes during an attack? A: As a last resort, blackholing routes drops all traffic to the attacked IP. It takes the target offline but protects the rest of your network. Use only if scrubbing can't keep up.
Threat Landscape and Current Attack Vectors
Understanding the current threat landscape is essential for making informed security decisions. In 2025, the most common attack vectors include ransomware (up 150% from 2024), supply chain attacks (targeting software vendors and managed service providers), credential stuffing (exploiting password reuse across services), and zero-day exploits (targeting unpatched vulnerabilities).
According to the 2025 Verizon Data Breach Investigations Report, 68% of breaches involve a human element (phishing, stolen credentials, or errors). This means technology alone is not enough - you need people, processes, AND technology working together.
Implementation Roadmap
We recommend a phased approach to implementation. Phase 1 (Weeks 1-4): Assessment and design. Document current state, identify gaps, design target architecture. Phase 2 (Weeks 5-8): Deploy core components. Install and configure the primary solution in a test environment. Phase 3 (Weeks 9-12): Pilot testing. Deploy to 20-30% of users, collect feedback, refine configuration.
Phase 4 (Weeks 13-16): Full deployment. Roll out to remaining users with minimal disruption. Phase 5 (Weeks 17-20): Optimization. Fine-tune policies, optimize performance, and document procedures. This timeline works for most medium enterprises (200-500 users).
Compliance and Regulatory Considerations
If your organization is subject to regulatory requirements (PCI DSS, HIPAA, ISO 27001, GDPR), ensure your implementation addresses these requirements from the start. Retrofitting compliance is significantly more expensive than building it in. We recommend creating a compliance matrix that maps each regulatory requirement to specific technical controls.
Common compliance gaps we see: insufficient audit logging (PCI DSS requires 12 months of logs), missing encryption at rest (required by HIPAA and GDPR), inadequate access controls (required by ISO 27001), and missing incident response procedures (required by all frameworks).