Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Juquinha
New Contributor

IPS Block or Quarantine?

Hi!

 

I would like to know from you guys if there is a best-practice rule in terms of the IPS action? I am wondering if it is better to only block (and have all those signatures processed daily by the IPS engine) or quarantine the source IP for, i don't know, 1 day or something like that, to save the resources of the box and either receive  a fewer number os malicious hits.

 

Feel free to hint.

1 REPLY 1
abarushka
Staff
Staff

Hello,

 

It is hard to say which option is better. It depends on the conditions and environment.

FortiGate
Labels
Top Kudoed Authors