Skip to main content
JohnGeorge
JohnGeorge
New Member
August 18, 2017
Question

Detecting attempted intrustions

  • August 18, 2017
  • 1 reply
  • 3253 views

My gear: 

Fortigate 300D: 5.6.0

FortiAnalyzer 200D: 5.6.0

 

I’ve got IPS profiles on all Fortigate policies. I’ve been running Metasploit (Penetration Test software) against my Fortigate. When running it from my internal network, many IPS events are triggered, and my FortiAnalyzer manages the events. When I run metasploit from outside the network on a public IP address… nothing.

I need to know there is an attack in progress. How do I configure IPS so I can get notified? Do I need to configure something else?

    1 reply

    MikePruett
    MikePruett
    New Member
    August 28, 2017

    you have IPS enabled on your inbound policies (and they are configured the same as the ones that are properly alerting?) Is the policy set to log properly?

    Terms & ConditionsAccessibility statement