Technical Note: TOR Signature
Description
TOR custom IPS signature for legacy FortiOS versions:
| Description | TOR custom IPS signature |
| Components |
|
| Steps or Commands | To add a custom IPS signature, go to IPS> Signature>Custom and select Create New. F-SBID( --name "TOR.Web.Proxy.TLSv1.Detection"; --protocol tcp; --flow from_client; --seq <,3000,relative; --pattern "|16 03 01|"; --within 3,packet; --pattern "|0b|"; --distance 2; --within 1; --pattern "|3c|identity|3e|0"; --no_case; --distance 15; --within 300; --pattern "Tor"; --no_case; --distance -100; --within 100; ) |
In FortiOS version 4.0 MR3 and version 5.0.x, the predefined signature "TOR" can be used under category "proxy", without using a custom signature:
Scope
FortiGate 4.0 MR3
FortiGate 5.0.x (MR0)
Solution