Skip to main content
carabhavi
Staff
carabhavi
Staff
May 18, 2020

Technical Tip: Testing of IPS sensor packet logging

  • May 18, 2020
  • 0 replies
  • 47277 views

Description


This article describes how to test the IPS working and logging of the detection.

 

Scope

 

FortiGate.

Solution


In this example, create a new IPS sensor and include a filter that detects the EICAR test file and saves a packet log when it is found. This is an ideal first experience with packet logging because the EICAR test file can cause no harm, and it is freely available for testing purposes.

Create an IPS sensor.

  1. Go to Security Profiles -> Intrusion Protection.
  2. Select Create New.
  3. Name the new IPS sensor EICAR_test.
  4. Under IPS Signatures, select 'Add Signatures'.A new window will appear.
  5. Type- Select Signature. Default is filter.
  6. Enter 'EICAR' in the Search field.
  7. Select the Eicar.Virus.Test.File signature to highlight it.
  8. Select 'Use Selected Signatures'.It will return to the IPS Sensor page.
  9. Select the 'Action' column for the signature and select 'Block'.
  10. Select the 'Packet Logging' column and scroll down to the bottom of the menu that appears to enable packet logging.
  11. Select 'OK' to save the IPS sensor.

 

Add the IPS sensor to the security policy, allowing Internet access.

  1. Go to Policy & Objects -> IPv4 Policy.
  2. Select the security policy that allows access to the Internet.
  3. Select the 'Edit' icon.
  4. Enable the IPS option under Security Profiles and choose the EICAR test from the available IPS sensors.
  5. Enable 'SSL/SSH Inspection' and select 'deep-inspection'.
  6. Enable 'Log Allowed Traffic' under 'Logging Options' and select 'All Sessions'.
  7. Select 'OK'.

 

With the IPS sensor configured and selected in the security policy, the FortiGate blocks any attempt to download the EICAR test file.

Testing the IPS sensor.

  1. Using the web browser, go to EICAR and select the 'Download Anti Malware Testfile' button.
  2. Scroll to the bottom of the page and select 'eicar.com' from the row labeled as using the secure, SSL-enabled HTTPS protocol.
  3. The browser attempts to download the requested file and:
  • If the file is successfully downloaded, the custom signature configuration fails at some point. Check the custom signature, the IPS sensor, and the firewall profile.
  • If the download is blocked with a high-security alert message explaining that it is not permitted to download the file, the EICAR test file was blocked by the FortiGate antivirus scanner before the IPS sensor can examine it. Disable antivirus scanning and try to download the EICAR test file again.
  • If no file is downloaded and the browser eventually times out, the custom signature successfully detects the EICAR test file and blocks the download.

 

Viewing the packet log.

  1. Go to Log & Report -> Forward Traffic.
  2. Locate the log entry that recorded the blocking of the EICAR test file block. The Message field data will be tools: EICAR.AV.Test.File.Download.
  3. Select the View Packet Log icon in the Packet Log column.
  4. The packet log viewer is displayed.

 

IPS logs will show that Eicar.Virus.Test.File is blocked:

 

date=2026-03-13 time=02:17:53 eventtime=1773393473639150984 tz="-0700" logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" severity="info" srcip=10.1.1.1 srccountry="Reserved" dstip=89.238.73.97 dstcountry="Germany" srcintf="port5" srcintfrole="undefined" dstintf="port1" dstintfrole="undefined" sessionid=28664 action="dropped" proto=6 service="HTTPS" policyid=2 poluuid="6878b44c-0d82-51f1-4b04-8297af69aa0d" policytype="policy" attack="Eicar.Virus.Test.File" srcport=50640 dstport=443 hostname="secure.eicar.org" url="/eicar.com.txt" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" httpmethod="GET" direction="incoming" attackid=29844 profile="TEST_EICAR" ref="http://www.fortinet.com/ids/VID29844" incidentserialno=67108869 msg="file_transfer: Eicar.Virus.Test.File"

 

Firewall policy:

 

config firewall policy
    edit 2
        set name "Internet"
        set uuid 6878b44c-0d82-51f1-4b04-8297af69aa0d
        set srcintf "port5"
        set dstintf "virtual-wan-link"
        set action accept
        set srcaddr "all"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set ssl-ssh-profile "deep-inspection"  <------------- Deep inspection is required to block the EICAR test file.
        set ips-sensor "TEST_EICAR"
        set logtraffic all
        set nat enable
    next

end

   

Notes:

    Terms & ConditionsAccessibility statement