Technical Tip: Testing of IPS sensor packet logging

[carabhavi]

Description

This article describes how to test IPS working and logging of the detection.

Scope

FortiGate.

Solution

In this example, create a new IPS sensor and include a filter that detects the EICAR test file and saves a packet log when it is found. This is an ideal first experience with packet logging because the EICAR test file can cause no harm, and it is freely available for testing purposes.

Create an IPS senor.

1. Go to Security Profiles -> Intrusion Protection.
2. Select Create New.
3. Name the new IPS sensor EICAR_test.
4. Under IPS Signatures, select 'Add Signatures'.A new window will appear.
5. Type- Select Signature. Default is filter.
6. Enter 'EICAR' in the Search field.
7. Select the Eicar.Virus.Test.File signature to highlight it.
8. Select 'Use Selected Signatures'.It will return to the IPS Sensor page.
9. Select the 'Action' column for the signature and select 'Block'.
10. Select the 'Packet Logging' column and scroll down to the bottom of the menu that appears to enable packet logging.
11. Select 'OK' to save the IPS sensor.

Add the IPS sensor to the security policy allowing Internet access.

1. Go to Policy & Objects -> IPv4 Policy.
2. Select the security policy that allows to access the Internet.
3. Select the 'Edit' icon.
4. Enable the IPS option under Security Profiles and choose the EICAR test from the available IPS sensors.
5. Enable 'SSL/SSH Inspection' and select 'deep-inspection'.
6. Enable 'Log Allowed Traffic' under 'Logging Options' and select 'All Sessions'.
7. Select 'OK'.

With the IPS sensor configured and selected in the security policy, the FortiGate blocks any attempt to download the EICAR test file.

Testing the IPS sensor.

1. Using the web browser, go to https://www.eicar.org and select the 'Download Anti Malware Testfile' button.
2. Scroll to the bottom of the page and select 'eicar.com' from the row labeled as using the secure, SSL-enabled HTTPS protocol.
3. The browser attempts to download the requested file and,

• If the file is successfully downloaded, the custom signature configuration fails at some point. Check the custom signature, the IPS sensor, and the firewall profile.
• If the download is blocked with a high-security alert message explaining that it is not permitted to download the file, the EICAR test file was blocked by the FortiGate antivirus scanner before the IPS sensor can examine it. Disable antivirus scanning and try to download the EICAR test file again.
• If no file is downloaded and the browser eventually times out, the custom signature successfully detects the EICAR test file and blocks the download.

Viewing the packet log.

1. Go to Log & Report -> Forward Traffic.
2. Locate the log entry that recorded the blocking of the EICAR test file block. The Message field data will be tools: EICAR.AV.Test.File.Download.
3. Select the View Packet Log icon in the Packet Log column.
4. The packet log viewer is displayed.
   

Notes:

• This feature is not available when the device does not have internal storage.
• To test different log severity values a Custom IPS Signature needs to be created: Technical Tip: How to configure custom IPS signature for a specific web site