| Description |
This article describes how to create and use IPS custom signatures for specific requirements, such as limiting access based on the rate to the specific website or application.
Some of that can be done by applying the DoS policy, which gives the flexibility to control and block L3/L4 Anomalies of the OSI model. IPS custom signatures can help to move checks up to L7 of the OSI model.
A sample of the traffic would be needed, which can usually be achieved by running a sniffer on the FortiGate, which can then be converted to .pcap file format and analyzed with a network protocol analyzer (Wireshark) so that the signature can be created to match the particular parameters.
The example below demonstrates how to create an IPS custom signature to inspect SNI from the user's hello messages, monitor the request rate, and subsequently isolate (quarantine) the source IP if the rate limit is exceeded.
|
| Scope | FortiGate. |
| Solution |
Topology:
 CLI options: config ips custom
edit "SSL.SNI.Custom"
set signature "F-SBID( --attack_id 3896; --name \"SSL.SNI.Custom\"; --protocol tcp; --service SSL; --flow from_client; --pattern \"www.fortiguard.com\"; --no_case; --context HOST;)"
set comment '' next
end
 CLI options: config ips sensor
edit "SSL.SNI.Sensor"
config entries
edit 1
set rule 3896
set status enable
set action block
set rate-count 2
set rate-duration 30
set rate-mode periodical
set rate-track src-ip
set quarantine attacker
set quarantine-expiry 1m
next
end
The custom signature and sensor are configured as follows: The SNI match pattern is www.fortiguard.com. If two (2) requests are made within thirty (30) seconds from the same source IP (set rate-track src-ip), it will be blocked and quarantined for one (1) minute.
|
