Fortigate 7.4 IPS - Allow known threat within an IPS rule
Hello,
we have an application which uses a HTTP method in a way which is known to be a threat as of FortiGuard https://fortiguard.fortinet.com/encyclopedia/ips/12351
I´d like to workaround this an although still blocking threats with severity medium high critical, I´d like to allow that special "HTTP.Server.Authorization.Buffer.Overflow" method, which is know as IPS rule 12351. The rules severity is high and the default action is "block". I tried to override this.
But the following rule does not work. Has anybody a suggestion why or what I could have done better?
config ips sensor
edit "protect-workararound"
set block-malicious-url enable
set scan-botnet-connections block
config entries
edit 1
set rule 12351
set status enable
set log disable
set action pass
end
next
edit 2
set severity medium high critical
next
end
next
end
best regards
Martin
