Technical Tip: How to disable IPS custom signature

'status' is ignored on 'config ips custom' from v6.2.

Adding the '--status disable' attribute to a custom IPS signature as follows will disable the custom signature.

Example: 

• From CLI:

config ips custom

    edit "Detect.Ping"

        set signature "F-SBID( --attack_id 8704; --name \"Detect.Ping\"; --protocol icmp; --severity high; --icmp_type 8; --icmp_code 0; --status disable; )"

    next

end

Ping a server via FortiGate from a client. FortiGate does not log the detection of the custom IPS signature as expected.

• From CLI (Client):

[Client ~]# ping 10.130.178.1

    PING 10.130.178.1 (10.130.178.1) 56(84) bytes of data.

    64 bytes from 10.130.178.1: icmp_seq=1 ttl=63 time=0.817 ms

    64 bytes from 10.130.178.1: icmp_seq=2 ttl=63 time=0.701 ms

    64 bytes from 10.130.178.1: icmp_seq=3 ttl=63 time=0.673 ms

    64 bytes from 10.130.178.1: icmp_seq=4 ttl=63 time=0.696 ms

    ^C

Ping a server via FortiGate from a client using 'set status disable'. FortiGate logs the detection of the IPS custom signature.

• From CLI (FortiGate):

    config ips custom

        edit "Detect.Ping"

            set signature "F-SBID( --attack_id 8704; --name \"Detect.Ping\"; --protocol icmp; --severity high; --icmp_type 8; --icmp_code 0; )"

            set status disable<----- Ignored.

        next

    end

• From CLI (Client):

[Client ~]# ping 10.130.178.1

    PING 10.130.178.1 (10.130.178.1) 56(84) bytes of data.

    64 bytes from 10.130.178.1: icmp_seq=1 ttl=63 time=1.38 ms

    64 bytes from 10.130.178.1: icmp_seq=2 ttl=63 time=0.712 ms

    64 bytes from 10.130.178.1: icmp_seq=3 ttl=63 time=0.654 ms

    64 bytes from 10.130.178.1: icmp_seq=4 ttl=63 time=0.670 ms

• Retrieved from IPS Log.  FortiGate ignores 'set status disable' and logs the detection of the signature:

date=2024-10-08 time=20:01:09 eventtime=1728374470270691459 logid="0419016385" type="utm" subtype="ips"

    eventtype="signature" level="alert" vd="root" severity="high" srcip=10.130.78.2 srccountry="Reserved"

    dstip=10.130.178.1 dstcountry="Reserved" srcintf="port2" srcintfrole="undefined" dstintf="port1"

    dstintfrole="undefined" sessionid=19215 action="detected" proto=1 service="PING" policyid=1

    poluuid="ad53c614-4322-51ef-1ecb-341652dcde55" policytype="policy" attack="Detect.Ping" direction="outgoing"

    icmpid="0x6534" icmptype="0x08" icmpcode="0x00" attackid=8704 profile="IPS_Block"

    incidentserialno=111152832 msg="custom: Detect.Ping, repeated 4 times" crscore=30 craction=8192 crlevel="high"

Note:

'--status disable' attribute works when the status is the default in the IPS sensor. '--status disable' does not work when the status is enabled.

Related article:

Technical Tip: CLI attributes for custom IPS signatures