Description
This article describes the steps to apply an IPS sensor to a FortiGate interface.
Scope
FortiGate.
Solution
Interface policies are implemented before the 'security' policies and are only flow-based. This feature allows the attachment of a set of IPS policies with the interface instead of the forwarding path, so packets can be delivered to IPS before entering firewall.
IPS sensors can be assigned to an interface policy. Both incoming and outgoing packets are inspected by the IPS sensor (signature).
CLI Configuration:
This is an example of an interface policy on port1 with a custom IPS sensor named 'Custom.IPS.Sensor':
config firewall interface-policy
edit 1
set interface "port1"
set srcaddr "all"
set dstaddr "all"
set service "ALL"
set ips-sensor-status enable
set ips-sensor "Custom.IPS.Sensor"
next
end
For IPv6 addresses, interface-policy6 should be used instead.
Note: Enabling the interface policy will disable traffic offload on that interface.
This video describes the steps to create a custom IPS Signature and Sensor.
