Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

CLI Reference

config ips global

Configure IPS global parameter.

config ips global

Description: Configure IPS global parameter.

set fail-open [enable|disable]

set database [regular|extended]

set traffic-submit [enable|disable]

set anomaly-mode [periodical|continuous]

set session-limit-mode [accurate|heuristic]

set intelligent-mode [enable|disable]

set socket-size {integer}

set engine-count {integer}

set sync-session-ttl [enable|disable]

set np-accel-mode [none|basic]

set ips-reserve-cpu [disable|enable]

set cp-accel-mode [none|basic|...]

set skype-client-public-ipaddr {var-string}

set deep-app-insp-timeout {integer}

set deep-app-insp-db-limit {integer}

set exclude-signatures [none|industrial]

set packet-log-queue-depth {integer}

config tls-active-probe

Description: TLS active probe configuration.

set interface-select-method [auto|sdwan|...]

set interface {string}

set vdom {string}

set source-ip {ipv4-address}

set source-ip6 {ipv6-address}

end

end

config ips global

Parameter name

Description

Type

Size

fail-open

Enable to allow traffic if the IPS process crashes. Default is disable and IPS traffic is blocked when the IPS process crashes.

option

-

 

Option

Description

enable

Enable IPS fail open.

disable

Disable IPS fail open.

database

Regular or extended IPS database. Regular protects against the latest common and in-the-wild attacks. Extended includes protection from legacy attacks.

option

-

 

Option

Description

regular

IPS regular database package.

extended

IPS extended database package.

traffic-submit

Enable/disable submitting attack data found by this FortiGate to FortiGuard.

option

-

 

Option

Description

enable

Enable traffic submit.

disable

Disable traffic submit.

anomaly-mode

Global blocking mode for rate-based anomalies.

option

-

 

Option

Description

periodical

After an anomaly is detected, allow the number of packets per second according to the anomaly configuration.

continuous

Block packets once an anomaly is detected. Overrides individual anomaly settings.

session-limit-mode

Method of counting concurrent sessions used by session limit anomalies. Choose between greater accuracy (accurate) or improved performance (heuristics).

option

-

 

Option

Description

accurate

Accurately count concurrent sessions, demands more resources.

heuristic

Use heuristics to estimate the number of concurrent sessions. Acceptable in most cases.

intelligent-mode

Enable/disable IPS adaptive scanning (intelligent mode). Intelligent mode optimizes the scanning method for the type of traffic.

option

-

 

Option

Description

enable

Enable intelligent scan mode.

disable

Disable intelligent scan mode.

socket-size

IPS socket buffer size. Max and default value depend on available memory. Can be changed to tune performance.

integer

Minimum value: 0 Maximum value: 256

engine-count

Number of IPS engines running. If set to the default value of 0, FortiOS sets the number to optimize performance depending on the number of CPU cores.

integer

Minimum value: 0 Maximum value: 255

sync-session-ttl

Enable/disable use of kernel session TTL for IPS sessions.

option

-

 

Option

Description

enable

Enable use of kernel session TTL for IPS sessions.

disable

Disable use of kernel session TTL for IPS sessions.

np-accel-mode

Acceleration mode for IPS processing by NPx processors.

option

-

 

Option

Description

none

NPx acceleration disabled.

basic

NPx acceleration enabled.

ips-reserve-cpu

Enable/disable IPS daemon's use of CPUs other than CPU 0

option

-

 

Option

Description

disable

Disable IPS daemon's use of CPUs other than CPU 0 (all daemons run on all CPUs).

enable

Enable IPS daemon's use of CPUs other than CPU 0.

cp-accel-mode

IPS Pattern matching acceleration/offloading to CPx processors.

option

-

 

Option

Description

none

CPx acceleration/offloading disabled.

basic

Offload basic pattern matching to CPx processors.

advanced

Offload more types of pattern matching resulting in higher throughput than basic mode. Requires two CP8s or one CP9.

skype-client-public-ipaddr

Public IP addresses of your network that receive Skype sessions. Helps identify Skype sessions. Separate IP addresses with commas.

var-string

Maximum length: 255

deep-app-insp-timeout

Timeout for Deep application inspection (1 - 2147483647 sec., 0 = use recommended setting).

integer

Minimum value: 0 Maximum value: 2147483647

deep-app-insp-db-limit

Limit on number of entries in deep application inspection database (1 - 2147483647, 0 = use recommended setting)

integer

Minimum value: 0 Maximum value: 2147483647

exclude-signatures

Excluded signatures.

option

-

 

Option

Description

none

No signatures excluded.

industrial

Exclude industrial signatures.

packet-log-queue-depth

Packet/pcap log queue depth per IPS engine.

integer

Minimum value: 128 Maximum value: 4096

Parameter name

Description

Type

Size

interface-select-method

Specify how to select outgoing interface to reach server.

option

-

 

Option

Description

auto

Set outgoing interface automatically.

sdwan

Set outgoing interface by SD-WAN or policy routing rules.

specify

Set outgoing interface manually.

interface

Specify outgoing interface to reach server.

string

Maximum length: 15

vdom

Virtual domain name for TLS active probe.

string

Maximum length: 31

source-ip

Source IP address used for TLS active probe.

ipv4-address

Not Specified

source-ip6

Source IPv6 address used for TLS active probe.

ipv6-address

Not Specified

config ips global

Configure IPS global parameter.

config ips global

Description: Configure IPS global parameter.

set fail-open [enable|disable]

set database [regular|extended]

set traffic-submit [enable|disable]

set anomaly-mode [periodical|continuous]

set session-limit-mode [accurate|heuristic]

set intelligent-mode [enable|disable]

set socket-size {integer}

set engine-count {integer}

set sync-session-ttl [enable|disable]

set np-accel-mode [none|basic]

set ips-reserve-cpu [disable|enable]

set cp-accel-mode [none|basic|...]

set skype-client-public-ipaddr {var-string}

set deep-app-insp-timeout {integer}

set deep-app-insp-db-limit {integer}

set exclude-signatures [none|industrial]

set packet-log-queue-depth {integer}

config tls-active-probe

Description: TLS active probe configuration.

set interface-select-method [auto|sdwan|...]

set interface {string}

set vdom {string}

set source-ip {ipv4-address}

set source-ip6 {ipv6-address}

end

end

config ips global

Parameter name

Description

Type

Size

fail-open

Enable to allow traffic if the IPS process crashes. Default is disable and IPS traffic is blocked when the IPS process crashes.

option

-

 

Option

Description

enable

Enable IPS fail open.

disable

Disable IPS fail open.

database

Regular or extended IPS database. Regular protects against the latest common and in-the-wild attacks. Extended includes protection from legacy attacks.

option

-

 

Option

Description

regular

IPS regular database package.

extended

IPS extended database package.

traffic-submit

Enable/disable submitting attack data found by this FortiGate to FortiGuard.

option

-

 

Option

Description

enable

Enable traffic submit.

disable

Disable traffic submit.

anomaly-mode

Global blocking mode for rate-based anomalies.

option

-

 

Option

Description

periodical

After an anomaly is detected, allow the number of packets per second according to the anomaly configuration.

continuous

Block packets once an anomaly is detected. Overrides individual anomaly settings.

session-limit-mode

Method of counting concurrent sessions used by session limit anomalies. Choose between greater accuracy (accurate) or improved performance (heuristics).

option

-

 

Option

Description

accurate

Accurately count concurrent sessions, demands more resources.

heuristic

Use heuristics to estimate the number of concurrent sessions. Acceptable in most cases.

intelligent-mode

Enable/disable IPS adaptive scanning (intelligent mode). Intelligent mode optimizes the scanning method for the type of traffic.

option

-

 

Option

Description

enable

Enable intelligent scan mode.

disable

Disable intelligent scan mode.

socket-size

IPS socket buffer size. Max and default value depend on available memory. Can be changed to tune performance.

integer

Minimum value: 0 Maximum value: 256

engine-count

Number of IPS engines running. If set to the default value of 0, FortiOS sets the number to optimize performance depending on the number of CPU cores.

integer

Minimum value: 0 Maximum value: 255

sync-session-ttl

Enable/disable use of kernel session TTL for IPS sessions.

option

-

 

Option

Description

enable

Enable use of kernel session TTL for IPS sessions.

disable

Disable use of kernel session TTL for IPS sessions.

np-accel-mode

Acceleration mode for IPS processing by NPx processors.

option

-

 

Option

Description

none

NPx acceleration disabled.

basic

NPx acceleration enabled.

ips-reserve-cpu

Enable/disable IPS daemon's use of CPUs other than CPU 0

option

-

 

Option

Description

disable

Disable IPS daemon's use of CPUs other than CPU 0 (all daemons run on all CPUs).

enable

Enable IPS daemon's use of CPUs other than CPU 0.

cp-accel-mode

IPS Pattern matching acceleration/offloading to CPx processors.

option

-

 

Option

Description

none

CPx acceleration/offloading disabled.

basic

Offload basic pattern matching to CPx processors.

advanced

Offload more types of pattern matching resulting in higher throughput than basic mode. Requires two CP8s or one CP9.

skype-client-public-ipaddr

Public IP addresses of your network that receive Skype sessions. Helps identify Skype sessions. Separate IP addresses with commas.

var-string

Maximum length: 255

deep-app-insp-timeout

Timeout for Deep application inspection (1 - 2147483647 sec., 0 = use recommended setting).

integer

Minimum value: 0 Maximum value: 2147483647

deep-app-insp-db-limit

Limit on number of entries in deep application inspection database (1 - 2147483647, 0 = use recommended setting)

integer

Minimum value: 0 Maximum value: 2147483647

exclude-signatures

Excluded signatures.

option

-

 

Option

Description

none

No signatures excluded.

industrial

Exclude industrial signatures.

packet-log-queue-depth

Packet/pcap log queue depth per IPS engine.

integer

Minimum value: 128 Maximum value: 4096

Parameter name

Description

Type

Size

interface-select-method

Specify how to select outgoing interface to reach server.

option

-

 

Option

Description

auto

Set outgoing interface automatically.

sdwan

Set outgoing interface by SD-WAN or policy routing rules.

specify

Set outgoing interface manually.

interface

Specify outgoing interface to reach server.

string

Maximum length: 15

vdom

Virtual domain name for TLS active probe.

string

Maximum length: 31

source-ip

Source IP address used for TLS active probe.

ipv4-address

Not Specified

source-ip6

Source IPv6 address used for TLS active probe.

ipv6-address

Not Specified