Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
tonyagustin
New Contributor

IPS Signature to protect SMTP Submission

Hello.

We've configured a custom signature to detect Login Brute Force Attack against SMTP service:

F-SBID( --attack_id 9419; --name "SMTP.Login.Brute.Force.Custom"; --protocol tcp; --flow from_server,reversed; --pattern "Authentication failed";--no_case; --context packet; --distance 4,context; --within 40,context; --rate 5,30; --track dst_ip; )

It is include into our IPS profile. We're using SSL inspection profile (protection ssl server).

That signature works fine for SMTP (port 25) and SMTPS (port 465), but it doesn't work for SMTP submission (port 587, encrypted of course).

Anyone has configured a custom signature to protect SMTP submission?

Thank you!

1 Solution
AEK
Contributor II

Did you try it for SMTP submission without STARTTLS? Does your signature work for it?

View solution in original post

3 REPLIES 3
Anthony_E
Community Manager
Community Manager

Hello Tony,

 

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

 

Regards,

Anthony-Fortinet Community Team.
AEK
Contributor II

Did you try it for SMTP submission without STARTTLS? Does your signature work for it?

tonyagustin

Hello.

Yes, it works fine without STARTTLS.

Thank you.