Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

CLI Reference

config ips sensor

Configure IPS sensor.

config ips sensor

Description: Configure IPS sensor.

edit <name>

set comment {var-string}

set replacemsg-group {string}

set block-malicious-url [disable|enable]

set scan-botnet-connections [disable|block|...]

set extended-log [enable|disable]

config entries

Description: IPS sensor filter.

edit <id>

set rule <id1>, <id2>, ...

set location {user}

set severity {user}

set protocol {user}

set os {user}

set application {user}

set cve <cve-entry1>, <cve-entry2>, ...

set status [disable|enable|...]

set log [disable|enable]

set log-packet [disable|enable]

set log-attack-context [disable|enable]

set action [pass|block|...]

set rate-count {integer}

set rate-duration {integer}

set rate-mode [periodical|continuous]

set rate-track [none|src-ip|...]

config exempt-ip

Description: Traffic from selected source or destination IP addresses is exempt from this signature.

edit <id>

set src-ip {ipv4-classnet}

set dst-ip {ipv4-classnet}

next

end

set quarantine [none|attacker]

set quarantine-expiry {user}

set quarantine-log [disable|enable]

next

end

next

end

config ips sensor

Parameter

Description

Type

Size

Default

comment

Comment.

var-string

Maximum length: 255

replacemsg-group

Replacement message group.

string

Maximum length: 35

block-malicious-url

Enable/disable malicious URL blocking.

option

-

disable

 

Option

Description

disable

Disable malicious URL blocking.

enable

Enable malicious URL blocking.

scan-botnet-connections

Block or monitor connections to Botnet servers, or disable Botnet scanning.

option

-

disable

 

Option

Description

disable

Do not scan connections to botnet servers.

block

Block connections to botnet servers.

monitor

Log connections to botnet servers.

extended-log

Enable/disable extended logging.

option

-

disable

 

Option

Description

enable

Enable setting.

disable

Disable setting.

config entries

Parameter

Description

Type

Size

Default

rule <id>

Identifies the predefined or custom IPS signatures to add to the sensor.

Rule IPS.

integer

Minimum value: 0 Maximum value: 4294967295

0

location

Protect client or server traffic.

user

Not Specified

all

severity

Relative severity of the signature, from info to critical. Log messages generated by the signature include the severity.

user

Not Specified

all

protocol

Protocols to be examined. set protocol ? lists available protocols. all includes all protocols. other includes all unlisted protocols.

user

Not Specified

all

os

Operating systems to be protected. all includes all operating systems. other includes all unlisted operating systems.

user

Not Specified

all

application

Applications to be protected. set application ? lists available applications. all includes all applications. other includes all unlisted applications.

user

Not Specified

all

cve <cve-entry>

List of CVE IDs of the signatures to add to the sensor

CVE IDs or CVE wildcards.

string

Maximum length: 19

status

Status of the signatures included in filter. default enables the filter and only use filters with default status of enable. Filters with default status of disable will not be used.

option

-

default

 

Option

Description

disable

Disable status of selected rules.

enable

Enable status of selected rules.

default

Default.

log

Enable/disable logging of signatures included in filter.

option

-

enable

 

Option

Description

disable

Disable logging of selected rules.

enable

Enable logging of selected rules.

log-packet

Enable/disable packet logging. Enable to save the packet that triggers the filter. You can download the packets in pcap format for diagnostic use.

option

-

disable

 

Option

Description

disable

Disable packet logging of selected rules.

enable

Enable packet logging of selected rules.

log-attack-context

Enable/disable logging of attack context: URL buffer, header buffer, body buffer, packet buffer.

option

-

disable

 

Option

Description

disable

Disable logging of detailed attack context.

enable

Enable logging of detailed attack context.

action

Action taken with traffic in which signatures are detected.

option

-

default

 

Option

Description

pass

Pass or allow matching traffic.

block

Block or drop matching traffic.

reset

Reset sessions for matching traffic.

default

Pass or drop matching traffic, depending on the default action of the signature.

rate-count

Count of the rate.

integer

Minimum value: 0 Maximum value: 65535

0

rate-duration

Duration (sec) of the rate.

integer

Minimum value: 1 Maximum value: 65535

60

rate-mode

Rate limit mode.

option

-

continuous

 

Option

Description

periodical

Allow configured number of packets every rate-duration.

continuous

Block packets once the rate is reached.

rate-track

Track the packet protocol field.

option

-

none

 

Option

Description

none

none

src-ip

Source IP.

dest-ip

Destination IP.

dhcp-client-mac

DHCP client.

dns-domain

DNS domain.

quarantine

Quarantine method.

option

-

none

 

Option

Description

none

Quarantine is disabled.

attacker

Block all traffic sent from attacker's IP address. The attacker's IP address is also added to the banned user list. The target's address is not affected.

quarantine-expiry

Duration of quarantine. . Requires quarantine set to attacker.

user

Not Specified

5m

quarantine-log

Enable/disable quarantine logging.

option

-

enable

 

Option

Description

disable

Disable quarantine logging.

enable

Enable quarantine logging.

config exempt-ip

Parameter

Description

Type

Size

Default

src-ip

Source IP address and netmask.

ipv4-classnet

Not Specified

0.0.0.0 0.0.0.0

dst-ip

Destination IP address and netmask.

ipv4-classnet

Not Specified

0.0.0.0 0.0.0.0

config ips sensor

Configure IPS sensor.

config ips sensor

Description: Configure IPS sensor.

edit <name>

set comment {var-string}

set replacemsg-group {string}

set block-malicious-url [disable|enable]

set scan-botnet-connections [disable|block|...]

set extended-log [enable|disable]

config entries

Description: IPS sensor filter.

edit <id>

set rule <id1>, <id2>, ...

set location {user}

set severity {user}

set protocol {user}

set os {user}

set application {user}

set cve <cve-entry1>, <cve-entry2>, ...

set status [disable|enable|...]

set log [disable|enable]

set log-packet [disable|enable]

set log-attack-context [disable|enable]

set action [pass|block|...]

set rate-count {integer}

set rate-duration {integer}

set rate-mode [periodical|continuous]

set rate-track [none|src-ip|...]

config exempt-ip

Description: Traffic from selected source or destination IP addresses is exempt from this signature.

edit <id>

set src-ip {ipv4-classnet}

set dst-ip {ipv4-classnet}

next

end

set quarantine [none|attacker]

set quarantine-expiry {user}

set quarantine-log [disable|enable]

next

end

next

end

config ips sensor

Parameter

Description

Type

Size

Default

comment

Comment.

var-string

Maximum length: 255

replacemsg-group

Replacement message group.

string

Maximum length: 35

block-malicious-url

Enable/disable malicious URL blocking.

option

-

disable

 

Option

Description

disable

Disable malicious URL blocking.

enable

Enable malicious URL blocking.

scan-botnet-connections

Block or monitor connections to Botnet servers, or disable Botnet scanning.

option

-

disable

 

Option

Description

disable

Do not scan connections to botnet servers.

block

Block connections to botnet servers.

monitor

Log connections to botnet servers.

extended-log

Enable/disable extended logging.

option

-

disable

 

Option

Description

enable

Enable setting.

disable

Disable setting.

config entries

Parameter

Description

Type

Size

Default

rule <id>

Identifies the predefined or custom IPS signatures to add to the sensor.

Rule IPS.

integer

Minimum value: 0 Maximum value: 4294967295

0

location

Protect client or server traffic.

user

Not Specified

all

severity

Relative severity of the signature, from info to critical. Log messages generated by the signature include the severity.

user

Not Specified

all

protocol

Protocols to be examined. set protocol ? lists available protocols. all includes all protocols. other includes all unlisted protocols.

user

Not Specified

all

os

Operating systems to be protected. all includes all operating systems. other includes all unlisted operating systems.

user

Not Specified

all

application

Applications to be protected. set application ? lists available applications. all includes all applications. other includes all unlisted applications.

user

Not Specified

all

cve <cve-entry>

List of CVE IDs of the signatures to add to the sensor

CVE IDs or CVE wildcards.

string

Maximum length: 19

status

Status of the signatures included in filter. default enables the filter and only use filters with default status of enable. Filters with default status of disable will not be used.

option

-

default

 

Option

Description

disable

Disable status of selected rules.

enable

Enable status of selected rules.

default

Default.

log

Enable/disable logging of signatures included in filter.

option

-

enable

 

Option

Description

disable

Disable logging of selected rules.

enable

Enable logging of selected rules.

log-packet

Enable/disable packet logging. Enable to save the packet that triggers the filter. You can download the packets in pcap format for diagnostic use.

option

-

disable

 

Option

Description

disable

Disable packet logging of selected rules.

enable

Enable packet logging of selected rules.

log-attack-context

Enable/disable logging of attack context: URL buffer, header buffer, body buffer, packet buffer.

option

-

disable

 

Option

Description

disable

Disable logging of detailed attack context.

enable

Enable logging of detailed attack context.

action

Action taken with traffic in which signatures are detected.

option

-

default

 

Option

Description

pass

Pass or allow matching traffic.

block

Block or drop matching traffic.

reset

Reset sessions for matching traffic.

default

Pass or drop matching traffic, depending on the default action of the signature.

rate-count

Count of the rate.

integer

Minimum value: 0 Maximum value: 65535

0

rate-duration

Duration (sec) of the rate.

integer

Minimum value: 1 Maximum value: 65535

60

rate-mode

Rate limit mode.

option

-

continuous

 

Option

Description

periodical

Allow configured number of packets every rate-duration.

continuous

Block packets once the rate is reached.

rate-track

Track the packet protocol field.

option

-

none

 

Option

Description

none

none

src-ip

Source IP.

dest-ip

Destination IP.

dhcp-client-mac

DHCP client.

dns-domain

DNS domain.

quarantine

Quarantine method.

option

-

none

 

Option

Description

none

Quarantine is disabled.

attacker

Block all traffic sent from attacker's IP address. The attacker's IP address is also added to the banned user list. The target's address is not affected.

quarantine-expiry

Duration of quarantine. . Requires quarantine set to attacker.

user

Not Specified

5m

quarantine-log

Enable/disable quarantine logging.

option

-

enable

 

Option

Description

disable

Disable quarantine logging.

enable

Enable quarantine logging.

config exempt-ip

Parameter

Description

Type

Size

Default

src-ip

Source IP address and netmask.

ipv4-classnet

Not Specified

0.0.0.0 0.0.0.0

dst-ip

Destination IP address and netmask.

ipv4-classnet

Not Specified

0.0.0.0 0.0.0.0