Fortinet Network Device IPS - Default Chapter; Table of Contents

Contents
FortiGate IPS User Guide Version 3.0 MR7
01-30007-0080-20080916 3
Contents
Introduction ........................................................................................ 5
The FortiGate IPS............................................................................................... 5
About this document......................................................................................... 6
Document conventions.................................................................................. 6
Fortinet documentation .................................................................................... 6
Fortinet Knowledge Center .......................................................................... 8
Comments on Fortinet technical documentation .......................................... 8
Customer service and technical support ........................................................ 8
IPS overview and general configuration.......................................... 9
The FortiGate IPS............................................................................................... 9
IPS settings and controls .............................................................................. 9
When to use IPS ......................................................................................... 10
Network performance...................................................................................... 10
Default signature and anomaly settings ...................................................... 10
Default fail open setting............................................................................... 10
Controlling sessions .................................................................................... 11
Setting the buffer size ................................................................................. 11
Monitoring the network and dealing with attacks ........................................ 11
Configuring logging and alert email............................................................. 11
Attack log messages ................................................................................... 12
The FortiGuard Center ................................................................................ 13
Using IPS sensors in a protection profile ..................................................... 14
Creating a protection profile that uses IPS sensors .................................... 14
Adding protection profiles to firewall policies .............................................. 14
Adding protection profiles to user groups.................................................... 15
Predefined signatures ..................................................................... 17
IPS predefined signatures .............................................................................. 17
Viewing the predefined signature list............................................................ 17
Fine tuning IPS predefined signatures for enhanced system performance 18
Custom signatures........................................................................... 21
IPS custom signatures.................................................................................... 21
Viewing the custom signature list.................................................................. 21
Custom signature configuration .................................................................... 22
Adding custom signatures using the web-based manager ......................... 22
Adding custom signatures using the CLI..................................................... 22