Creating custom IPS rules

[shahar]

Hi,

I am trying to create a custom IPS rule to restrict TCP sessions by size.

I couldn’t find any way of defining the proper context for such a rule.

My scenario is – any single session should be terminated when over ‘X’ amount of data was transmitted on this session (especially SSL sessions).

Did anyone configure something of this sort? Is it possible? Considering the context of the signature should be ‘session’ and not a specific field.

Thanks.

[hmtay_FTNT]

Hello shahar,

You can write an IPS signature like this:

F-SBID( --name "HTTP.Limit"; --protocol tcp; --service HTTP; --flow from_server; --seq >,10000,relative; --severity info; )

You can modify the service to SSL if what you want to track is SSL. The key syntax to use is "--seq >,xxxxx,relative;". This syntax tracks the sequence number of the TCP session. The sequence number will increase with the size of the packets sent. In the above signature, it will trigger if the size of the HTTP packets sent from the server side exceeds 10000 bytes. If the signature is set to drop, it will drop the packet. You can modify the number to your liking.

HoMing

[shahar]

hello HoMing,

thank you for your replay.

from what i understand, this rule will only check the packet size.

i am trying to find a way to limit the SESSION size rather than packets size.

my goal is to terminate every session using TLS V1.0 protocol that exceeds the size of , let's say, 10GB.

thank you.

[hmtay_FTNT]

>>from what i understand, this rule will only check the packet size. i am trying to find a way to limit the SESSION size rather than packets size.

--seq >,xxxxx,relative checks the session size, not the packet size. Packet size is checked by the syntax --data_size. Let's say you have 5 packets from the server, at size 100b, 200b, 300b, 400b and 500b. If I set the syntax --seq to --seq >,200,relative, after the Fortigate sees the 2nd packet (200b), the Fortigate will drop the session when it receives the 3rd packet. This happens because the session is now at 300b and the signature triggers if the server side has sent more than 200 bytes. 

One caveat with this syntax is you can only check one direction at a time - either from client or from server. 

[shahar]

thank you for the replay.

i will try it.

hopefully this will solve my problem.