If you encounter the following errors on fortigate while entering dDos policy,

“Invalid synproxy configuration.” on web gui or
“Only SP inteface has syn proxy feature.” on CLI

You should check tcp_syn_flood paramater which is in Dos Sensor configuration. If the firewall doesn’t have CE4, XE2 or FE8 cards it does not work in proxy mode.

You can see fortigate document below about this error,

Configuring security processing modules
FortiGate Security Processing Modules, such as the CE4, XE2, and FE8, can increase
overall system performance by accelerating some security and networking processing on
the interfaces they provide. They also allow the FortiGate unit to offload the processing to
the security module, thereby freeing up its own processor for other tasks. The security
module performs its own IPS and firewall processing, but you can configure it to favor
IPS in hostile high-traffic environments.
If you have a security processing module, use the following CLI commands to configure it
to devote more resources to IPS than firewall. This example shows the CLI commands
required to configure a security module in slot 1 for increased IPS performance.
config system amc-slot
edit sw1
set optimization-mode fw-ips
set ips-weight balanced
set ips-p2p disable
set ips-fail-open enable
set fp-disable none
set ipsec-inb-optimization enable
set syn-proxy-client-timer 3
set syn-proxy-server-timer 3
end
In addition to offloading IPS processing, security processing modules provide a hardware
accelerated SYN proxy to defend against SYN flood denial of service attacks. When
using a security module, configure your DoS sensor tcp_syn_flood anomaly with the
Proxy action. The Proxy action activates the hardware accelerated SYN proxy.

Because DoS sensors are configured before being applied to an interface, you can
assign a DoS sensor with the Proxy action to an interface that does not have hardware
SYN proxy support. In this circumstance, the Proxy action is invalid and a Pass action
will be applied.