How to protect clients and servers with IPS?

[fjulianom]

Hi guys,

I have a FortiGate and three firewall policies: one for the communication from clients (laptops) to servers, one for the communication from servers to clients, and one for Internet access from clients to Internet:

Clients --> Servers

Servers --> Clients

Clients --> Internet

I have configured two IPS profiles for protecting clients (target: client) and servers (target: server), called "protect_client" and "protect_server" respectively.

What IPS profiles I have to use in each policy?

Regards,

Julián

[fjulianom]

Hi guys,

Any idea?

Regards,

Julián

[Dave_Hall · Accepted solution]

Generally, you will want to place an IPS sensor (profile) on traffic originating from internal to WAN (or your internet - e.g. client browsing) - if you have servers facing or accessing the Internet you will want to apply an IPS sensor to that traffic too (e.g. internal server -> WAN (or Internet). 

Generally, in my personal experience I have never seen IPS applied to internal traffic communications, - usually server/client computers have (or should have) security/firewall mechanisms in place to prevent or log such incidents. And if I have any say in the matter, I rather see all outside mobile devices blocked from accessing your internal network.

Also keep in mind too, that IPS (and other security policies) on the Fortigate can only be applied to traffic crossing a "interface" (e.g. LAN->WAN, WAN->LAN, LAN->DMZ, etc.). 

[fjulianom]

Hi Dave,

Thanks for your interest. When you say "Generally, in my personal experience I have never seen IPS applied to internal traffic communications, - usually server/client computers have (or should have) security/firewall mechanisms in place to prevent or log such incidents.". But does that mean that the built-in security/firewall mechanisms of servers/clients work well for only internal communications but not from WAN to LAN?

Regards,

Julián