Description
This article describes the steps to apply an IPS sensor to a FortiGate interface.
Scope
FortiGate.
Solution
Interface policies are implemented before the 'security' policies and are only flow-based. This feature allows the attachment of a set of IPS policies with the interface instead of the forwarding path, so packets can be delivered to IPS before entering firewall.
IPS sensors can be assigned to an interface policy. Both incoming and outgoing packets are inspected by the IPS sensor (signature). It is recommended to apply the IPS sensors closer to the source so the packets can get inspected at the earliest stage.
CLI Configuration:
This is an example of an interface policy on port1 with a custom IPS sensor named 'Custom.IPS.Sensor':
config firewall interface-policy
edit 1
set interface "port1"
set srcaddr "all"
set dstaddr "all"
set service "ALL"
set ips-sensor-status enable
set ips-sensor "Custom.IPS.Sensor"
next
end
For IPv6 addresses, interface-policy6 should be used instead.
Note:
Enabling the interface policy will disable traffic offload on that interface.
