Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

CLI Reference

config ips global

Configure IPS global parameter.

config ips global

Description: Configure IPS global parameter.

set fail-open [enable|disable]

set database [regular|extended]

set traffic-submit [enable|disable]

set anomaly-mode [periodical|continuous]

set session-limit-mode [accurate|heuristic]

set socket-size {integer}

set engine-count {integer}

set sync-session-ttl [enable|disable]

set np-accel-mode [none|basic]

set cp-accel-mode [none|basic|...]

set deep-app-insp-timeout {integer}

set deep-app-insp-db-limit {integer}

set exclude-signatures [none|industrial]

set packet-log-queue-depth {integer}

set ngfw-max-scan-range {integer}

config tls-active-probe

Description: TLS active probe configuration.

set interface-select-method [auto|sdwan|...]

set interface {string}

set vdom {string}

set source-ip {ipv4-address}

set source-ip6 {ipv6-address}

end

end

config ips global

Parameter

Description

Type

Size

Default

fail-open

Enable to allow traffic if the IPS buffer is full. Default is disable and IPS traffic is blocked when the IPS buffer is full.

option

-

disable

 

Option

Description

enable

Enable IPS fail open.

disable

Disable IPS fail open.

database

Regular or extended IPS database. Regular protects against the latest common and in-the-wild attacks. Extended includes protection from legacy attacks.

option

-

regular **

 

Option

Description

regular

IPS regular database package.

extended

IPS extended database package.

traffic-submit

Enable/disable submitting attack data found by this FortiGate to FortiGuard.

option

-

disable

 

Option

Description

enable

Enable traffic submit.

disable

Disable traffic submit.

anomaly-mode

Global blocking mode for rate-based anomalies.

option

-

continuous

 

Option

Description

periodical

After an anomaly is detected, allow the number of packets per second according to the anomaly configuration.

continuous

Block packets once an anomaly is detected. Overrides individual anomaly settings.

session-limit-mode

Method of counting concurrent sessions used by session limit anomalies. Choose between greater accuracy (accurate) or improved performance (heuristics).

option

-

heuristic

 

Option

Description

accurate

Accurately count concurrent sessions, demands more resources.

heuristic

Use heuristics to estimate the number of concurrent sessions. Acceptable in most cases.

socket-size

IPS socket buffer size. Max and default value depend on available memory. Can be changed to tune performance.

integer

Minimum value: 0 Maximum value: 128 **

64 **

engine-count

Number of IPS engines running. If set to the default value of 0, FortiOS sets the number to optimize performance depending on the number of CPU cores.

integer

Minimum value: 0 Maximum value: 255

0

sync-session-ttl

Enable/disable use of kernel session TTL for IPS sessions.

option

-

enable

 

Option

Description

enable

Enable use of kernel session TTL for IPS sessions.

disable

Disable use of kernel session TTL for IPS sessions.

np-accel-mode *

Acceleration mode for IPS processing by NPx processors.

option

-

basic

 

Option

Description

none

NPx acceleration disabled.

basic

NPx acceleration enabled.

cp-accel-mode *

IPS Pattern matching acceleration/offloading to CPx processors.

option

-

advanced

 

Option

Description

none

CPx acceleration/offloading disabled.

basic

Offload basic pattern matching to CPx processors.

advanced

Offload more types of pattern matching resulting in higher throughput than basic mode. Requires two CP8s or one CP9.

deep-app-insp-timeout

Timeout for Deep application inspection .

integer

Minimum value: 0 Maximum value: 2147483647

0

deep-app-insp-db-limit

Limit on number of entries in deep application inspection database

integer

Minimum value: 0 Maximum value: 2147483647

0

exclude-signatures

Excluded signatures.

option

-

industrial

 

Option

Description

none

No signatures excluded.

industrial

Exclude industrial signatures.

packet-log-queue-depth

Packet/pcap log queue depth per IPS engine.

integer

Minimum value: 128 Maximum value: 4096

128

ngfw-max-scan-range

NGFW policy-mode app detection threshold.

integer

Minimum value: 0 Maximum value: 4294967295

4096

* This parameter may not exist in some models.

** Values may differ between models.

config tls-active-probe

Parameter

Description

Type

Size

Default

interface-select-method

Specify how to select outgoing interface to reach server.

option

-

auto

 

Option

Description

auto

Set outgoing interface automatically.

sdwan

Set outgoing interface by SD-WAN or policy routing rules.

specify

Set outgoing interface manually.

interface

Specify outgoing interface to reach server.

string

Maximum length: 15

vdom

Virtual domain name for TLS active probe.

string

Maximum length: 31

source-ip

Source IP address used for TLS active probe.

ipv4-address

Not Specified

0.0.0.0

source-ip6

Source IPv6 address used for TLS active probe.

ipv6-address

Not Specified

::

config ips global

Configure IPS global parameter.

config ips global

Description: Configure IPS global parameter.

set fail-open [enable|disable]

set database [regular|extended]

set traffic-submit [enable|disable]

set anomaly-mode [periodical|continuous]

set session-limit-mode [accurate|heuristic]

set socket-size {integer}

set engine-count {integer}

set sync-session-ttl [enable|disable]

set np-accel-mode [none|basic]

set cp-accel-mode [none|basic|...]

set deep-app-insp-timeout {integer}

set deep-app-insp-db-limit {integer}

set exclude-signatures [none|industrial]

set packet-log-queue-depth {integer}

set ngfw-max-scan-range {integer}

config tls-active-probe

Description: TLS active probe configuration.

set interface-select-method [auto|sdwan|...]

set interface {string}

set vdom {string}

set source-ip {ipv4-address}

set source-ip6 {ipv6-address}

end

end

config ips global

Parameter

Description

Type

Size

Default

fail-open

Enable to allow traffic if the IPS buffer is full. Default is disable and IPS traffic is blocked when the IPS buffer is full.

option

-

disable

 

Option

Description

enable

Enable IPS fail open.

disable

Disable IPS fail open.

database

Regular or extended IPS database. Regular protects against the latest common and in-the-wild attacks. Extended includes protection from legacy attacks.

option

-

regular **

 

Option

Description

regular

IPS regular database package.

extended

IPS extended database package.

traffic-submit

Enable/disable submitting attack data found by this FortiGate to FortiGuard.

option

-

disable

 

Option

Description

enable

Enable traffic submit.

disable

Disable traffic submit.

anomaly-mode

Global blocking mode for rate-based anomalies.

option

-

continuous

 

Option

Description

periodical

After an anomaly is detected, allow the number of packets per second according to the anomaly configuration.

continuous

Block packets once an anomaly is detected. Overrides individual anomaly settings.

session-limit-mode

Method of counting concurrent sessions used by session limit anomalies. Choose between greater accuracy (accurate) or improved performance (heuristics).

option

-

heuristic

 

Option

Description

accurate

Accurately count concurrent sessions, demands more resources.

heuristic

Use heuristics to estimate the number of concurrent sessions. Acceptable in most cases.

socket-size

IPS socket buffer size. Max and default value depend on available memory. Can be changed to tune performance.

integer

Minimum value: 0 Maximum value: 128 **

64 **

engine-count

Number of IPS engines running. If set to the default value of 0, FortiOS sets the number to optimize performance depending on the number of CPU cores.

integer

Minimum value: 0 Maximum value: 255

0

sync-session-ttl

Enable/disable use of kernel session TTL for IPS sessions.

option

-

enable

 

Option

Description

enable

Enable use of kernel session TTL for IPS sessions.

disable

Disable use of kernel session TTL for IPS sessions.

np-accel-mode *

Acceleration mode for IPS processing by NPx processors.

option

-

basic

 

Option

Description

none

NPx acceleration disabled.

basic

NPx acceleration enabled.

cp-accel-mode *

IPS Pattern matching acceleration/offloading to CPx processors.

option

-

advanced

 

Option

Description

none

CPx acceleration/offloading disabled.

basic

Offload basic pattern matching to CPx processors.

advanced

Offload more types of pattern matching resulting in higher throughput than basic mode. Requires two CP8s or one CP9.

deep-app-insp-timeout

Timeout for Deep application inspection .

integer

Minimum value: 0 Maximum value: 2147483647

0

deep-app-insp-db-limit

Limit on number of entries in deep application inspection database

integer

Minimum value: 0 Maximum value: 2147483647

0

exclude-signatures

Excluded signatures.

option

-

industrial

 

Option

Description

none

No signatures excluded.

industrial

Exclude industrial signatures.

packet-log-queue-depth

Packet/pcap log queue depth per IPS engine.

integer

Minimum value: 128 Maximum value: 4096

128

ngfw-max-scan-range

NGFW policy-mode app detection threshold.

integer

Minimum value: 0 Maximum value: 4294967295

4096

* This parameter may not exist in some models.

** Values may differ between models.

config tls-active-probe

Parameter

Description

Type

Size

Default

interface-select-method

Specify how to select outgoing interface to reach server.

option

-

auto

 

Option

Description

auto

Set outgoing interface automatically.

sdwan

Set outgoing interface by SD-WAN or policy routing rules.

specify

Set outgoing interface manually.

interface

Specify outgoing interface to reach server.

string

Maximum length: 15

vdom

Virtual domain name for TLS active probe.

string

Maximum length: 31

source-ip

Source IP address used for TLS active probe.

ipv4-address

Not Specified

0.0.0.0

source-ip6

Source IPv6 address used for TLS active probe.

ipv6-address

Not Specified

::