FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
ssteo
Staff
Staff
Article Id 193903

Description

 

This article describes how to choose a signature in an IPS profile and change the default action.

 

Scope

 

FortiGate.


Solution

 

  1. Go to Security Profiles -> Intrusion Prevention, select an IPS profile, and select ‘Edit’.

  2. Under ‘IPS Signatures and Filters’, select ‘Create New’.

 

IPS sign.PNG

 

  1. Under the ‘Add signatures’ page, make sure Type is set to ‘Signature’. Search for a signature to block. In this example, it is ‘MS.Windows.Server.HTTP.sys.DoS’. Select that signature and select ‘Add Selected’. Change the ‘Action’ from ‘Default’ to ‘Block’ and select ‘OK’.

 

signature.PNG

 

  1. The signature appears under ‘IPS Signatures and Filters’ with 'Action = Block'. Select ‘OK’ to save.
block1.PNG

 

Contributors