| Description |
This article describes how to disable a specific IPS signature on 'config ips custom'. |
| Scope | FortiGate v7.2, v7.4 |
| Solution |
'status' is ignored on 'config ips custom' from v6.2. Adding the '--status disable' attribute to a custom IPS signature as follows will disable the custom signature.
Example:
config ips custom edit "Detect.Ping" set signature "F-SBID( --attack_id 8704; --name \"Detect.Ping\"; --protocol icmp; --severity high; --icmp_type 8; --icmp_code 0; --status disable; )" next end
Ping a server via FortiGate from a client. FortiGate does not log the detection of the custom IPS signature as expected.
[Client ~]# ping 10.130.178.1 PING 10.130.178.1 (10.130.178.1) 56(84) bytes of data. 64 bytes from 10.130.178.1: icmp_seq=1 ttl=63 time=0.817 ms 64 bytes from 10.130.178.1: icmp_seq=2 ttl=63 time=0.701 ms 64 bytes from 10.130.178.1: icmp_seq=3 ttl=63 time=0.673 ms 64 bytes from 10.130.178.1: icmp_seq=4 ttl=63 time=0.696 ms ^C
Ping a server via FortiGate from a client using 'set status disable'. FortiGate logs the detection of the IPS custom signature.
config ips custom edit "Detect.Ping" set signature "F-SBID( --attack_id 8704; --name \"Detect.Ping\"; --protocol icmp; --severity high; --icmp_type 8; --icmp_code 0; )" set status disable<----- Ignored. next end
[Client ~]# ping 10.130.178.1 PING 10.130.178.1 (10.130.178.1) 56(84) bytes of data. 64 bytes from 10.130.178.1: icmp_seq=1 ttl=63 time=1.38 ms 64 bytes from 10.130.178.1: icmp_seq=2 ttl=63 time=0.712 ms 64 bytes from 10.130.178.1: icmp_seq=3 ttl=63 time=0.654 ms 64 bytes from 10.130.178.1: icmp_seq=4 ttl=63 time=0.670 ms
date=2024-10-08 time=20:01:09 eventtime=1728374470270691459 logid="0419016385" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" severity="high" srcip=10.130.78.2 srccountry="Reserved" dstip=10.130.178.1 dstcountry="Reserved" srcintf="port2" srcintfrole="undefined" dstintf="port1" dstintfrole="undefined" sessionid=19215 action="detected" proto=1 service="PING" policyid=1 poluuid="ad53c614-4322-51ef-1ecb-341652dcde55" policytype="policy" attack="Detect.Ping" direction="outgoing" icmpid="0x6534" icmptype="0x08" icmpcode="0x00" attackid=8704 profile="IPS_Block" incidentserialno=111152832 msg="custom: Detect.Ping, repeated 4 times" crscore=30 craction=8192 crlevel="high"
Note: '--status disable' attribute works when the status is the default in the IPS sensor. '--status disable' does not work when the status is enabled.
Related article: |
