IPS administration permissions

FortiManager includes IPS specific administrator profile permissions that can be used to determine an administrator's ability to view and manage IPS objects and IPS attributes within policies.

The following IPS permissions can be applied to an administrator profile. See Administrator profiles.

Permission	Description
IPS Objects ips-object	Determines an administrator's ability to view and manage IPS objects.
Policy IPS Attributes policy-ips-attrs	Determines the administrator's ability to manage IPS attributes (IPS and SSL/SSH Inspection) in Policies.

For more information on configuring administrator profile permissions, see Permissions.

Firewall and IPS administrators with role separation

To configure firewall and IPS administrators with role separation:

1. Create a new admin profile with Read Only permissions for IPS Objects and Edit Policy IPS Attributes, and assign the admin profile to a firewall administrator.
   The firewall administrators will have the following permissions for IPS objects and attributes:
   • The firewall admin can create and update Policies, but cannot set or change IPS sensors and SSH/SSL inspection profiles in Policies.
   • The firewall admin can set and change Profile Groups and apply them to a Policy, but cannot set or change the IPS sensors and SSH/SSL inspection profiles in a Profile Group.
   • The firewall admin has Read-only permission for IPS objects.
2. Create a new restricted IPS administrator using the default IPSadmin admin profile.
   The IPS administrator will have the following permissions for IPS objects and attributes:
   • The IPS admin can set and change IPS sensors and SSH/SSL inspection profiles in Policies after the Firewall administrator has created the Policy.
   • The IPS admin can set and change IPS sensor and SSH/SSL inspection profiles in Profile Groups after the Firewall administrator has created the Profile Group.
   • The IPS admin can create and update IPS sensors and SSH/SSL inspection profiles and their settings within Policies.
   • The IPS admin can select individual IPS sensors or SSH/SSL inspection profiles to install to devices.

To configure a firewall admin profile in the CLI:

config system admin profile

edit "FirewallAdmin"

set system-setting read-write

...

...

set ips-objects read<------ this is for IPS and SSH/SSL Inspection objects

...

set policy-ips-attrs read <------ this is for IPS and SSH/SSL Inspection attributes setting in policy

next

To view the default IPS admin profile in the CLI:

config sys admin profile

edit IPSadmin

show

config system admin profile

edit "IPSadmin"

set type restricted

set web-filter enable

set ips-filter enable

set app-filter enable

set device-fortiextender none

set update-incidents none

set triage-events none

set run-report none

set fgt-gui-proxy disable

set ips-lock none

set policy-ips-attrs none

next

end