Fortigate IPS Apache.Log4j.Error.Log.Remote.Code.Execution on non standard http/https ports?

[esec]

Hi,

we are using Apache.Log4j.Error.Log.Remote.Code.Execution IPS signatures to protect some webservers and noticed that the IPS signature is blocking attempts if the connection is made to a webserver on port 80 and 443 but if there is a connection to a server on a different port like 8443 for example the IPS doesn´t identify it.

The policy have IPS, deep inspection and web filter applied and we see the logs for all other security features on the traffic, but nothing from the IPS.

Do anyone know if the Log4j signature only is for port 80 and 443? We have tried on different models (100E, 100F and on FortiOS 6.4.8 and FortiOS 6.4.6).

Thanks!

[jpm1111]

If you have stuff running on other ports, you should have it configured to monitor those ports as well. Set the filters on the IPS Sensor screen.