IPS Signatures

[FortiSpain]

Hi,

We owe a Fortinet Fortigate 50G in a domestic environment. In the section "IPS Signatures", we can see more than 5864 entries. 84% is blocked but 16% shows "pass":

Here you have a few examples:

Does this mean a risk for our installation? Would it be better to have them all marked as "Block"? If positive, how can I change the action?

Thank you

[FortiSpain]

Thank you.

Is the following correct as policy?

Thank you

[mpapisetty]

yes, that policy should do. 

[FortiSpain]

Thank you. Now, please, where do I have to go to run the commands you said?

[mpapisetty]

just open the CLI console and run them directly at the # prompt. 

[FortiSpain]

Hi again!

Done! Now, instead of 5000 entries, I can see almost 20000 IPS signatures. I am very happy!

I would like to set everything as BLOCKED. What do I have to do?

Thanks again!

[mpapisetty]

Hi @FortiSpain ,

I would not recommend doing that unless you are confident about each of the signatures and the traffic in the network. As such, it is best to leave it to FortiGuard to decide what should be allow and what should be block as it works for most network deployments. Otherwise, you may have traffic blocked as false positives. 

If you would like to go ahead with it anyway, then you can create a new IPS sensor from "Security Profiles"->"Intrusion Prevention"->"Create New", add all signatures and change the action to block. (as shown in the image attached)

[FortiSpain]

If you do not recommend, then i will leave it as it is. 

Thank you.

All the best!

[mpapisetty]

Glad that the issue is resolved. Kindly mark the relevant comments as solution so that others can benefit from the same. 

[FortiSpain]

... I have added "all" in "Service"