Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

Administration Guide

Intrusion prevention profiles

Intrusion prevention profiles can be used to manage IPS filters and signatures, block malicious URLs, and configure Botnet C&C scanning.

Profiles can be installed to the FortiGate devices included in ADOMs that are assigned to the restricted administrator account. The administrator can select which devices to install changes to, giving them the ability to test signatures and filters on a subset of devices before installing the changes to all managed devices.

You can see where each profile in the Profile table is being used by enabling Used in the Column Settings.

Intrusion prevention profiles include the revision history of changes made to the profile. Using the revision history you can compare two previous versions of the profile, and if needed, revert to a previous revision.

To create a IPS profile:
  1. Log in as a restricted administrator.
  2. In the tree menu, select Intrusion Prevention > Profiles.
  3. In the toolbar, click Create New.
  4. Configure the profile settings, and click OK.

    Name

    The profile name.

    Comment

    Optionally, enter a description of the profile.

    IPS Signatures and Filters

    Click Create New and select the Type as either Filter or Signature to add IPS signatures and filters to the table. The table list can be filtered to simplify adding them. You can quickly edit an existing signature or filter by double-clicking it in the list.

     

    Filters

    When creating filters, the following settings are available: Action (Allow, Monitor, Block, Reset, Default, Quarantine), Packet Logging, Status, and Filter. Click the edit filter icon to create a new filter.

    For information on hold-time and CVE filter options, see Intrusion prevention hold-time and CVE filtering.

     

    Signatures

    When selecting signatures, the following settings are available: Action (Allow, Monitor, Block, Reset, Default, Quarantine), Packet Logging, Status, Rate-based Setting, Exempt IPs, and Signatures. Click Add Signature to select a new signature.

    As a restricted administrator, custom IPS signatures can be created by navigating to Intrusion Prevention > IPS Signatures in the tree menu. See Intrusion prevention signatures.

    Botnet C&C

    Enable Botnet C&C to scan outgoing connections to botnet sites. Botnet C&C can be set to Block, Disable, or Monitor.

    Advanced Options

    Enable or disable extended logging.

    Revision

    Enter a change note that includes details about the change made to the IPS profile.

    Revision History

    View the revision history for this profile.

    Select View Diff in the toolbar to compare two versions in revision history.

    Select Revert in the toolbar to revert to a previous version based on revision history.

    Tooltip

    To clone an existing profile, right-click the profile in the content pane, and select Clone.

To edit a IPS profile:
  1. Log in as a restricted administrator.
  2. In the tree menu, select Intrusion Prevention > Profiles.
  3. In the content pane, select a profile, and take one of the following actions:
    • In the toolbar, click Edit.
    • Right-click the profile, and select Edit.
  4. Edit the settings, and click OK.
To view where a profile is being used:
  1. Log in as a restricted administrator.
  2. In the tree menu, select Profiles.
  3. In the content pane, select a profile from the list, and click Where Used in the More dropdown menu.
    The dialog window displays the ADOM and policy package/block where the package is currently being used.
  4. (Optional) Select a policy in the list, and click View to display the policy details.

To revert a profile to a previous version:
  1. Log in as a restricted administrator.
  2. In the tree menu, select Intrusion Prevention > Profiles.
  3. In the content pane, edit the profile that you want to revert from the list.
    Past changes made to this profile are listed in a table under Revision History.
  4. Select a saved revision from the table and click Revert, and click OK in the window confirming that you want to revert the profile.
To view IPS profile usages:
  1. Log in as a restricted administrator.
  2. In the tree menu, select Intrusion Prevention > Profiles.
  3. In the toolbar, select More > IPS Profile Usages.
    The IPS Profile Usages window displays the status (synced or modified) and timestamps for each IPS sensor installed on managed devices.
  4. When an IPS sensor has been modified, you can click Show Diff in the status column to view modifications made to the IPS profile that are not installed to the device.

Intrusion prevention profiles

Intrusion prevention profiles can be used to manage IPS filters and signatures, block malicious URLs, and configure Botnet C&C scanning.

Profiles can be installed to the FortiGate devices included in ADOMs that are assigned to the restricted administrator account. The administrator can select which devices to install changes to, giving them the ability to test signatures and filters on a subset of devices before installing the changes to all managed devices.

You can see where each profile in the Profile table is being used by enabling Used in the Column Settings.

Intrusion prevention profiles include the revision history of changes made to the profile. Using the revision history you can compare two previous versions of the profile, and if needed, revert to a previous revision.

To create a IPS profile:
  1. Log in as a restricted administrator.
  2. In the tree menu, select Intrusion Prevention > Profiles.
  3. In the toolbar, click Create New.
  4. Configure the profile settings, and click OK.

    Name

    The profile name.

    Comment

    Optionally, enter a description of the profile.

    IPS Signatures and Filters

    Click Create New and select the Type as either Filter or Signature to add IPS signatures and filters to the table. The table list can be filtered to simplify adding them. You can quickly edit an existing signature or filter by double-clicking it in the list.

     

    Filters

    When creating filters, the following settings are available: Action (Allow, Monitor, Block, Reset, Default, Quarantine), Packet Logging, Status, and Filter. Click the edit filter icon to create a new filter.

    For information on hold-time and CVE filter options, see Intrusion prevention hold-time and CVE filtering.

     

    Signatures

    When selecting signatures, the following settings are available: Action (Allow, Monitor, Block, Reset, Default, Quarantine), Packet Logging, Status, Rate-based Setting, Exempt IPs, and Signatures. Click Add Signature to select a new signature.

    As a restricted administrator, custom IPS signatures can be created by navigating to Intrusion Prevention > IPS Signatures in the tree menu. See Intrusion prevention signatures.

    Botnet C&C

    Enable Botnet C&C to scan outgoing connections to botnet sites. Botnet C&C can be set to Block, Disable, or Monitor.

    Advanced Options

    Enable or disable extended logging.

    Revision

    Enter a change note that includes details about the change made to the IPS profile.

    Revision History

    View the revision history for this profile.

    Select View Diff in the toolbar to compare two versions in revision history.

    Select Revert in the toolbar to revert to a previous version based on revision history.

    Tooltip

    To clone an existing profile, right-click the profile in the content pane, and select Clone.

To edit a IPS profile:
  1. Log in as a restricted administrator.
  2. In the tree menu, select Intrusion Prevention > Profiles.
  3. In the content pane, select a profile, and take one of the following actions:
    • In the toolbar, click Edit.
    • Right-click the profile, and select Edit.
  4. Edit the settings, and click OK.
To view where a profile is being used:
  1. Log in as a restricted administrator.
  2. In the tree menu, select Profiles.
  3. In the content pane, select a profile from the list, and click Where Used in the More dropdown menu.
    The dialog window displays the ADOM and policy package/block where the package is currently being used.
  4. (Optional) Select a policy in the list, and click View to display the policy details.

To revert a profile to a previous version:
  1. Log in as a restricted administrator.
  2. In the tree menu, select Intrusion Prevention > Profiles.
  3. In the content pane, edit the profile that you want to revert from the list.
    Past changes made to this profile are listed in a table under Revision History.
  4. Select a saved revision from the table and click Revert, and click OK in the window confirming that you want to revert the profile.
To view IPS profile usages:
  1. Log in as a restricted administrator.
  2. In the tree menu, select Intrusion Prevention > Profiles.
  3. In the toolbar, select More > IPS Profile Usages.
    The IPS Profile Usages window displays the status (synced or modified) and timestamps for each IPS sensor installed on managed devices.
  4. When an IPS sensor has been modified, you can click Show Diff in the status column to view modifications made to the IPS profile that are not installed to the device.