Technical Tip: CLI attributes for custom IPS signatures

Description

This article describes that CLI attributes for custom signatures are ignored in v6.2 and above versions.

Scope

FortiGate v6.2, v6.4, v7.0, v7.2, v7.4 and v7.6.

Solution

Creating a custom signature as follows:

config ips custom
    edit "test_signature"
        set signature "F-SBID( --attack_id 8888; --name test_signature;)
        set severity low    
        set location server 
        set status disable 
        set comment "test"
    next
end

The 'status', 'location', 'severity' and 'status' CLI attributes are not used anymore and will have no effect.

The status will remain the default 'enable' and severity 'critical'.

The severity can only be defined in the signature syntax with the '--severity' statement.

Related articles:

Technical Tip: How to configure custom IPS signature for a specific web site

Technical Tip: How to disable IPS custom signature