Why is the IPS signatures of Fortigate Os7.2.10 so much less than the total number on Fortiguard?

Forum|Forum|1 year ago
March 3, 2025
5 replies
1999 views

I noticed a problem. When the updated version is the same (31.962 at the time of posting), the signatures under the v7.2.10 build1706 (Mature) version are much less than the total signatures displayed on Fortiguard, only 12,346. On the 0S6.2.16 system, it is 18,861, which is close to the total number of entries, and on another OS7.4 device, it is also close to the total number of entries. I have followed the tutorial to turn on extended signatures and set exclude-signatures to none.
Will this affect Fortigate's security features?
Update record query:Intrusion Prevention Service | FortiGuard Labs

Best answer by Catkin038

When I was reading the documentation recently, I noticed a feature update in the FortiOS 7.2.0 release notes
FortiGate models with the CP9 SPU receive the IPS full extended database (DB), and the other physical FortiGate models receive a slim version of the extended DB. This slim-extended DB is a smaller version of the full extended DB, and it is designed for customers who prefer performance.

The CP of SOC3 is CP9 Lite, so it can only use the slim database.

Catkin038Author

New Member

Some signatures cannot be found on Os7.2, such as Adobe.Acrobat.CVE-2022-34237.Use.After.Free CVE-2022-34237.

funkylicious

SuperUser

hi,

in the example you have given, its because it's part of the extended IPS db, and it may be that you have the regular one enabled.

https://www.fortiguard.com/encyclopedia/ips/51833

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Changing-the-IPS-database/ta-p/197371

"jack of all trades, master of none"

Catkin038Author

New Member

No, I have set the database to extended.
This was mentioned in my question

Catkin038AuthorAnswer

New Member

When I was reading the documentation recently, I noticed a feature update in the FortiOS 7.2.0 release notes
FortiGate models with the CP9 SPU receive the IPS full extended database (DB), and the other physical FortiGate models receive a slim version of the extended DB. This slim-extended DB is a smaller version of the full extended DB, and it is designed for customers who prefer performance.

The CP of SOC3 is CP9 Lite, so it can only use the slim database.

Sign up

Login with SSO

Login to the community

Login with SSO