Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
gabyrossi
Contributor

help me block ares

Hi, I need to know if someone could block the Ares (v. 2.0.9.3030). I have a Fortigate-100A 3.00, bould 0406,070126 and also tryed with a newer version but it won´t block it. This is what I´m doing: on the IPS->SIGNATURE->PREDEFINED->with the DROP action, the severity level set HIGH and in PROTOCOL DECODER -> P2P_DECODER -> P2P DIRECT-CONNECT with the DROP action and the severity level set HIGH too. On the policy profile on the IPS, I also set the severity level to HIGH I did it just as it says on the Fortinet document: http://kc.forticare.com/default.asp?id=1628&SID=&Lang=1 If someone could block it or if someone has any tip, I would be really thankfull. Greetings Gabriel
2 REPLIES 2
Not applicable

I have the same issue too any ideas? SIlvio
abelio
Valued Contributor

Silvio, last IPS updates fixed the problem (version >= 2.402) You have 3 signatures: " Ares.Chat.Join" -- detect joining a chat channel " Ares.Connect.Detection" -- detect connecting network (old " ares" sig) " Ares.Search.Detection" -- detect searching Set action to " Drop" and adjust Severity in your protection profile to catch them.

regards




/ Abel

regards / Abel
Labels
Top Kudoed Authors