Fortigate V5.4 IPS signature to block the FTP anonymous account

[kenchang0708]

Hi all,

My customer want to block the anonymous user to upload files to the internet FTP servers, otherwise the normal account can do that.

I tried to add the IPS signature as below, but it didn't work in version 5.4.

================================

Name: FTP_unauth_login Signature: F-SBID( --protocol tcp; --flow from_client; --dst_port 21; --pattern "PASS|20 0d 0a|"; --context packet; --within 7,context; --no_case; --data_size =7; --tag set,Tag.FTP.unauthenticated.user;) Name: FTP_unauth_PUT Signature: F-SBID( --protocol tcp; --flow from_client; --dst_port 21; --pattern "STOR|20|"; --context packet; --within 5,context; --no_case; --tag test,Tag.FTP.unauthenticated.user;) Name: FTP_unauth_STOR Signature: F-SBID( --protocol tcp; --flow from_client; --dst_port 21; --pattern "PUT|20|"; --context packet; --within 4,context; --no_case; --tag test,Tag.FTP.unauthenticated.user;)

================================

I tested some situations to tried and found out that, the "Tag.FTP.unauthenticated.user" parameter could not be searched.

Do you know how to modify the parameter in version 5.4?

Thanks and Best Regards,

Ken