Fortinet black logo

CLI Reference

config ips sensor

config ips sensor

Configure IPS sensor.

config ips sensor
    Description: Configure IPS sensor.
    edit <name>
        set block-malicious-url [disable|enable]
        set comment {var-string}
        config entries
            Description: IPS sensor filter.
            edit <id>
                set rule <id1>, <id2>, ...
                set location {user}
                set severity {user}
                set protocol {user}
                set os {user}
                set application {user}
                set cve <cve-entry1>, <cve-entry2>, ...
                set status [disable|enable|...]
                set log [disable|enable]
                set log-packet [disable|enable]
                set log-attack-context [disable|enable]
                set action [pass|block|...]
                set rate-count {integer}
                set rate-duration {integer}
                set rate-mode [periodical|continuous]
                set rate-track [none|src-ip|...]
                config exempt-ip
                    Description: Traffic from selected source or destination IP addresses is exempt from this signature.
                    edit <id>
                        set src-ip {ipv4-classnet}
                        set dst-ip {ipv4-classnet}
                    next
                end
                set quarantine [none|attacker]
                set quarantine-expiry {user}
                set quarantine-log [disable|enable]
            next
        end
        set extended-log [enable|disable]
        set replacemsg-group {string}
        set scan-botnet-connections [disable|block|...]
    next
end

config ips sensor

Parameter

Description

Type

Size

Default

block-malicious-url

Enable/disable malicious URL blocking.

option

-

disable

Option

Description

disable

Disable malicious URL blocking.

enable

Enable malicious URL blocking.

comment

Comment.

var-string

Maximum length: 255

extended-log

Enable/disable extended logging.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

name

Sensor name.

string

Maximum length: 35

replacemsg-group

Replacement message group.

string

Maximum length: 35

scan-botnet-connections

Block or monitor connections to Botnet servers, or disable Botnet scanning.

option

-

disable

Option

Description

disable

Do not scan connections to botnet servers.

block

Block connections to botnet servers.

monitor

Log connections to botnet servers.

config entries

Parameter

Description

Type

Size

Default

id

Rule ID in IPS database.

integer

Minimum value: 0 Maximum value: 4294967295

0

rule <id>

Identifies the predefined or custom IPS signatures to add to the sensor.

Rule IPS.

integer

Minimum value: 0 Maximum value: 4294967295

location

Protect client or server traffic.

user

Not Specified

all

severity

Relative severity of the signature, from info to critical. Log messages generated by the signature include the severity.

user

Not Specified

all

protocol

Protocols to be examined. set protocol ? lists available protocols. all includes all protocols. other includes all unlisted protocols.

user

Not Specified

all

os

Operating systems to be protected. all includes all operating systems. other includes all unlisted operating systems.

user

Not Specified

all

application

Applications to be protected. set application ? lists available applications. all includes all applications. other includes all unlisted applications.

user

Not Specified

all

cve <cve-entry>

List of CVE IDs of the signatures to add to the sensor

CVE IDs or CVE wildcards.

string

Maximum length: 19

status

Status of the signatures included in filter. default enables the filter and only use filters with default status of enable. Filters with default status of disable will not be used.

option

-

default

Option

Description

disable

Disable status of selected rules.

enable

Enable status of selected rules.

default

Default.

log

Enable/disable logging of signatures included in filter.

option

-

enable

Option

Description

disable

Disable logging of selected rules.

enable

Enable logging of selected rules.

log-packet

Enable/disable packet logging. Enable to save the packet that triggers the filter. You can download the packets in pcap format for diagnostic use.

option

-

disable

Option

Description

disable

Disable packet logging of selected rules.

enable

Enable packet logging of selected rules.

log-attack-context

Enable/disable logging of attack context: URL buffer, header buffer, body buffer, packet buffer.

option

-

disable

Option

Description

disable

Disable logging of detailed attack context.

enable

Enable logging of detailed attack context.

action

Action taken with traffic in which signatures are detected.

option

-

default

Option

Description

pass

Pass or allow matching traffic.

block

Block or drop matching traffic.

reset

Reset sessions for matching traffic.

default

Pass or drop matching traffic, depending on the default action of the signature.

rate-count

Count of the rate.

integer

Minimum value: 0 Maximum value: 65535

0

rate-duration

Duration (sec) of the rate.

integer

Minimum value: 1 Maximum value: 65535

60

rate-mode

Rate limit mode.

option

-

continuous

Option

Description

periodical

Allow configured number of packets every rate-duration.

continuous

Block packets once the rate is reached.

rate-track

Track the packet protocol field.

option

-

none

Option

Description

none

none

src-ip

Source IP.

dest-ip

Destination IP.

dhcp-client-mac

DHCP client.

dns-domain

DNS domain.

quarantine

Quarantine method.

option

-

none

Option

Description

none

Quarantine is disabled.

attacker

Block all traffic sent from attacker's IP address. The attacker's IP address is also added to the banned user list. The target's address is not affected.

quarantine-expiry

Duration of quarantine.. Requires quarantine set to attacker.

user

Not Specified

5m

quarantine-log

Enable/disable quarantine logging.

option

-

enable

Option

Description

disable

Disable quarantine logging.

enable

Enable quarantine logging.

config exempt-ip

Parameter

Description

Type

Size

Default

id

Exempt IP ID.

integer

Minimum value: 0 Maximum value: 4294967295

0

src-ip

Source IP address and netmask.

ipv4-classnet

Not Specified

0.0.0.0 0.0.0.0

dst-ip

Destination IP address and netmask.

ipv4-classnet

Not Specified

0.0.0.0 0.0.0.0

config ips sensor

Configure IPS sensor.

config ips sensor
    Description: Configure IPS sensor.
    edit <name>
        set block-malicious-url [disable|enable]
        set comment {var-string}
        config entries
            Description: IPS sensor filter.
            edit <id>
                set rule <id1>, <id2>, ...
                set location {user}
                set severity {user}
                set protocol {user}
                set os {user}
                set application {user}
                set cve <cve-entry1>, <cve-entry2>, ...
                set status [disable|enable|...]
                set log [disable|enable]
                set log-packet [disable|enable]
                set log-attack-context [disable|enable]
                set action [pass|block|...]
                set rate-count {integer}
                set rate-duration {integer}
                set rate-mode [periodical|continuous]
                set rate-track [none|src-ip|...]
                config exempt-ip
                    Description: Traffic from selected source or destination IP addresses is exempt from this signature.
                    edit <id>
                        set src-ip {ipv4-classnet}
                        set dst-ip {ipv4-classnet}
                    next
                end
                set quarantine [none|attacker]
                set quarantine-expiry {user}
                set quarantine-log [disable|enable]
            next
        end
        set extended-log [enable|disable]
        set replacemsg-group {string}
        set scan-botnet-connections [disable|block|...]
    next
end

config ips sensor

Parameter

Description

Type

Size

Default

block-malicious-url

Enable/disable malicious URL blocking.

option

-

disable

Option

Description

disable

Disable malicious URL blocking.

enable

Enable malicious URL blocking.

comment

Comment.

var-string

Maximum length: 255

extended-log

Enable/disable extended logging.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

name

Sensor name.

string

Maximum length: 35

replacemsg-group

Replacement message group.

string

Maximum length: 35

scan-botnet-connections

Block or monitor connections to Botnet servers, or disable Botnet scanning.

option

-

disable

Option

Description

disable

Do not scan connections to botnet servers.

block

Block connections to botnet servers.

monitor

Log connections to botnet servers.

config entries

Parameter

Description

Type

Size

Default

id

Rule ID in IPS database.

integer

Minimum value: 0 Maximum value: 4294967295

0

rule <id>

Identifies the predefined or custom IPS signatures to add to the sensor.

Rule IPS.

integer

Minimum value: 0 Maximum value: 4294967295

location

Protect client or server traffic.

user

Not Specified

all

severity

Relative severity of the signature, from info to critical. Log messages generated by the signature include the severity.

user

Not Specified

all

protocol

Protocols to be examined. set protocol ? lists available protocols. all includes all protocols. other includes all unlisted protocols.

user

Not Specified

all

os

Operating systems to be protected. all includes all operating systems. other includes all unlisted operating systems.

user

Not Specified

all

application

Applications to be protected. set application ? lists available applications. all includes all applications. other includes all unlisted applications.

user

Not Specified

all

cve <cve-entry>

List of CVE IDs of the signatures to add to the sensor

CVE IDs or CVE wildcards.

string

Maximum length: 19

status

Status of the signatures included in filter. default enables the filter and only use filters with default status of enable. Filters with default status of disable will not be used.

option

-

default

Option

Description

disable

Disable status of selected rules.

enable

Enable status of selected rules.

default

Default.

log

Enable/disable logging of signatures included in filter.

option

-

enable

Option

Description

disable

Disable logging of selected rules.

enable

Enable logging of selected rules.

log-packet

Enable/disable packet logging. Enable to save the packet that triggers the filter. You can download the packets in pcap format for diagnostic use.

option

-

disable

Option

Description

disable

Disable packet logging of selected rules.

enable

Enable packet logging of selected rules.

log-attack-context

Enable/disable logging of attack context: URL buffer, header buffer, body buffer, packet buffer.

option

-

disable

Option

Description

disable

Disable logging of detailed attack context.

enable

Enable logging of detailed attack context.

action

Action taken with traffic in which signatures are detected.

option

-

default

Option

Description

pass

Pass or allow matching traffic.

block

Block or drop matching traffic.

reset

Reset sessions for matching traffic.

default

Pass or drop matching traffic, depending on the default action of the signature.

rate-count

Count of the rate.

integer

Minimum value: 0 Maximum value: 65535

0

rate-duration

Duration (sec) of the rate.

integer

Minimum value: 1 Maximum value: 65535

60

rate-mode

Rate limit mode.

option

-

continuous

Option

Description

periodical

Allow configured number of packets every rate-duration.

continuous

Block packets once the rate is reached.

rate-track

Track the packet protocol field.

option

-

none

Option

Description

none

none

src-ip

Source IP.

dest-ip

Destination IP.

dhcp-client-mac

DHCP client.

dns-domain

DNS domain.

quarantine

Quarantine method.

option

-

none

Option

Description

none

Quarantine is disabled.

attacker

Block all traffic sent from attacker's IP address. The attacker's IP address is also added to the banned user list. The target's address is not affected.

quarantine-expiry

Duration of quarantine.. Requires quarantine set to attacker.

user

Not Specified

5m

quarantine-log

Enable/disable quarantine logging.

option

-

enable

Option

Description

disable

Disable quarantine logging.

enable

Enable quarantine logging.

config exempt-ip

Parameter

Description

Type

Size

Default

id

Exempt IP ID.

integer

Minimum value: 0 Maximum value: 4294967295

0

src-ip

Source IP address and netmask.

ipv4-classnet

Not Specified

0.0.0.0 0.0.0.0

dst-ip

Destination IP address and netmask.

ipv4-classnet

Not Specified

0.0.0.0 0.0.0.0