Create or edit an IPS sensor
The Intrusion Prevention System (IPS) combines signature detection and prevention with low latency and excellent reliability. With intrusion protection, you can create multiple IPS sensors, each containing a complete configuration based on signatures. Then, you can apply any IPS sensor to any security policy.
IPS sensors can be added, edited, cloned, and deleted as required.
To create an IPS sensor, go to Security Profiles > Intrusion Prevention and click Create New.
Configure the following settings and then select OK to save your changes:
|
Name |
The name of the IPS sensor. |
|
|
Comments |
Optional description of the IPS sensor. |
|
|
Block malicious URLs |
Enable this setting to block malicious URLs that FortiSandbox finds. Your FortiProxy unit must be connected to a registered FortiSandbox. |
|
|
IPS Signatures and Filters |
Add or edit an IPS signature or filter. See Add or edit an IPS signature or filter. While individual signatures can be added to a sensor, a filter allows you to add multiple signatures to a sensor by specifying the characteristics of the signatures to be added. |
|
|
Scan Outgoing Connections to Botnet Sites |
Select Block or Monitor to enable botnet blocking across all traffic that matches the policy. |
|
|
View IPS Signatures |
Select to see a list of predefined IPS signatures. To create an IPS signature, see Create or edit an IPS signature. |
|
|
API Preview |
The API Preview allows you to view all REST API requests being used by the page. You can make changes on the page that are reflected in the API request preview. This feature is not available if the user is logged in as an administrator that has read-only GUI permissions. |
|
To use the API Preview:
-
Click API Preview. The API Preview pane opens, and the values for the fields are visible (data). If a new object is being created, the POST request is shown.
-
Enable Show modified changes only to show the modified changes instead of the full configuration in the preview.
-
Click Copy to Clipboard to copy the JSON code shown on the preview screen to the clipboard.
-
Click Close to leave the preview.
To edit an IPS sensor:
-
From the IPS sensor list, select the sensor that you need to edit and then click Edit from the toolbar or double-click on the sensor name in the list. The Edit IPS Sensor window opens.
-
Edit the information as required and then select OK to save your changes.