IPS profile related

Hi Team,

I will suggest you to create signatures as per your requirement instead of adding whole list of signatures.

Lets say you have webserver in the internal network, add only the signatures related to http, https, sql and related signatures.

This will prevent your firewall to load complete signature list again which is not required in your case.

Under LAN to WAN policy keep the IP policy with 14K signatures, as we are not sure what type os attack we may come accross.

Kindly check and keep us posted

ok , thank you for the reply.

I will create profiles as per service . But when I select HTTP signatures they are around 6k or 8k. If I add the profile , will there be any impact to web application. will legitimate traffic will be block by signatures. 

When I see most of the critical signatures has "PASS" action and remaining are in block mode. How fortigate considering these signatures to be"  Pass or Block ". What is the deciding factor to Pass or block.  I am concerned because I don't want  legitimate traffic to be block.

how many IPS profile can we create for fortigate 501E.

when I select HTTP signatures they are around 6k or 8k. If I add the profile , will there be any impact to web application

---Usually there will not be any false positive in IPS.

If there is any false positive blocking, you can exempt the signature using this article:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Exempting-Allow-one-single-IPS-signature-for-IPS/ta-p/192671

For detecting the signature you can check under logs and reports >> IPS section.

Kindly check and keep us posted