Fortigate IPS - RDS Gateway Traffic

[sbabcock23]

I have an Remote Desktop Services (RDS) Gateway service running on port 443. I am trying to implement IPS rules on FortiOS 7.4.8 that block unsuccessful attempts at logging in. I can see in the HTTP/IIS logs that a 403 unauthenticated code is given when users enter an incorrect password.

I tried leveraging the HTTP.Authentication.Brute.Force policy and configuring it with a threshold of 3 for a duration of 60 seconds but that did not seem to work.

I then proceeded to create a custom rule (below), however it yielded the same results.

F-SBID( --attack_id 1870; --name \"HTTP.401.Unauthorized.Multiple\"; --service HTTP; --protocol TCP; --pattern \"401 Unauthorized\"; )

Does anyone know how to configure the IPS to detect unsuccessful login attempts against an RDS GW server?

FortiGate 

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

[Anthony_E]

Hello,

To configure FortiGate IPS for monitoring RDS Gateway traffic, follow these steps:

1. Create an IPS Protection Profile: Go to `Security Profiles` > `Intrusion Prevention`.
2. Create a new IPS sensor or edit an existing one.
3. Add specific signatures relevant to RDS Gateway traffic or use a general profile that covers common threats.
4. Configure Firewall Policies: Go to `Policy & Objects` > `IPv4 Policy`.
5. Create or edit a policy that handles RDS Gateway traffic.
6. Apply the IPS protection profile to this policy.
7. Monitor and Log Traffic.
8. Ensure logging is enabled for the IPS profile to monitor traffic and detect any potential threats.
9. Go to `Log & Report` > `Intrusion Prevention` to view logs and analyze traffic patterns.
10. Adjust IPS Settings.
11. Based on the logs, adjust the IPS settings to block or allow specific traffic as needed.
12. Use the CLI to fine-tune IPS actions if necessary.