Skip to main content
shahar
shahar
New Member
March 23, 2017
Question

Creating custom IPS rules

  • March 23, 2017
  • 1 reply
  • 6258 views

Hi,

I am trying to create a custom IPS rule to restrict TCP sessions by size.

I couldn’t find any way of defining the proper context for such a rule.

My scenario is – any single session should be terminated when over ‘X’ amount of data was transmitted on this session (especially SSL sessions).

Did anyone configure something of this sort? Is it possible? Considering the context of the signature should be ‘session’ and not a specific field.

 

Thanks.

    1 reply

    hmtay_FTNT
    Staff
    hmtay_FTNT
    Staff
    March 23, 2017

    Hello shahar,

     

    You can write an IPS signature like this:

     

    F-SBID( --name "HTTP.Limit"; --protocol tcp; --service HTTP; --flow from_server; --seq >,10000,relative; --severity info; )

     

    You can modify the service to SSL if what you want to track is SSL. The key syntax to use is "--seq >,xxxxx,relative;". This syntax tracks the sequence number of the TCP session. The sequence number will increase with the size of the packets sent. In the above signature, it will trigger if the size of the HTTP packets sent from the server side exceeds 10000 bytes. If the signature is set to drop, it will drop the packet. You can modify the number to your liking.

     

    HoMing

    shahar
    shaharAuthor
    New Member
    March 26, 2017

    hello HoMing,

    thank you for your replay.

    from what i understand, this rule will only check the packet size.

    i am trying to find a way to limit the SESSION size rather than packets size.

    my goal is to terminate every session using TLS V1.0 protocol that exceeds the size of , let's say, 10GB.

     

    thank you.

    hmtay_FTNT
    Staff
    hmtay_FTNT
    Staff
    March 27, 2017

    >>from what i understand, this rule will only check the packet size. i am trying to find a way to limit the SESSION size rather than packets size.

     

    --seq >,xxxxx,relative checks the session size, not the packet size. Packet size is checked by the syntax --data_size. Let's say you have 5 packets from the server, at size 100b, 200b, 300b, 400b and 500b. If I set the syntax --seq to --seq >,200,relative, after the Fortigate sees the 2nd packet (200b), the Fortigate will drop the session when it receives the 3rd packet. This happens because the session is now at 300b and the signature triggers if the server side has sent more than 200 bytes. 

     

    One caveat with this syntax is you can only check one direction at a time - either from client or from server. 

    Terms & ConditionsAccessibility statement