Skip to main content
smartgate
Visitor III
January 25, 2024
Question

What is fortigate IPS set status default ?

  • January 25, 2024
  • 5 replies
  • 6069 views

There is a set status default item in FORTIGATE IPS config. What does this do? I understand that enable/disable indicates the status of the signature/filter added to the IPS settings. But what happens when the status is set to default?

5 replies

AEK
SuperUser
SuperUser
January 25, 2024

When it is set to default, the action for that signature is the one shown in the Action column.

AEK
rosatechnocrat
Explorer III
January 25, 2024

@smartgate : Are you reffering for the signature configuration. 

 

If referring to signature config -- then status default sets the action of the signature to default whatever defined in signature definition. Or you can change the signature from default to custom block. 

 

For more clarity , you might to share screenshot or config that you referring to... Even there is a default IPS Security Profile as well. 

Subscribe "ROSA Technocrat" on Youtube for Fortinet Videos and Troubleshooting https://www.youtube.com/@rosatechnocrat
smartgate
smartgateAuthor
Visitor III
January 25, 2024

It has been confirmed that the default IPS status setting operates according to the default status of each signature in the IPS signature category. Here's a question. Which signatures are registered with a status of disable? By what criteria is this selected, and is there a reason why this disabled signature does not seem to work?

AEK
SuperUser
SuperUser
January 25, 2024

That's a good question.

I don't know the formal answer but in my opinion it can be related to one of the following:

  • Vulnerability is very old and is no more present on any nowadays systems
  • Vulnerability is not critical and does not have a so bad impact
  • Vulnerability can be confused with a needed functionality, so if it is blocked it can impact some other important functionality
AEK
rosatechnocrat
Explorer III
January 25, 2024

Disabled signatures are based on signature definitions update or manalluy disabled. 

To find out all disabled signatures , you can apply a column for status and filter with disabled. You can see below screenshot on how to find out disabled signatures. 

 

disabled sig.PNG

Subscribe "ROSA Technocrat" on Youtube for Fortinet Videos and Troubleshooting https://www.youtube.com/@rosatechnocrat
smartgate
smartgateAuthor
Visitor III
January 25, 2024

Yes, I know. What I'm curious about is that if you set the status to default and select a signature with the default status of disable like in this picture, this signature won't work, so I'm curious why there is a separate disable signature.11.png

 

rosatechnocrat
Explorer III
January 25, 2024

As signature can be disabled manually as well instead of default status. 

Subscribe "ROSA Technocrat" on Youtube for Fortinet Videos and Troubleshooting https://www.youtube.com/@rosatechnocrat