IPS extended database

[Baptiste]

Hello, On release notes of 5.0.6, I found : Extended IPS Database for D-series Desktop Models The extended IPS database has been added for FortiGate D-series Desktop models. The extended database is disabled by default, but can be enabled in the CLI. Any information about this ?

[AndreaSoliva]

Hi what I know is following: Up to FortiOS 5 GA the extended database can be use on following device: FWF-81CM, 110C and higher Up to FortiOS 5.0.6 the extended database is available for following product: For all " D" Desktop Modelle The diff between regulare and extended is: 5700 IPS signature for regular and 7700 IPS signature for extended To be configured under Gui and/or CLI: System > Config > FortiGuard # config ips global # set database [extended / regular] # end Be careful with the extended db because it depends how you use it. Which means if you use full db within a Policy it is a difference to go through 5700 signature or 7700? You can also accelerate the IPS function: For FortiOS 5.0.3 # config ips global # set hardware-accel-mode [ engine-pick | none | CP-only | NP-only | NP+CP ] For FortiOS 5.0.6 # config ips global # set np-accel-mode [none | basic] # set cp-accel-mode [none | basic | advanced] # end The options for 5.0.3 are: • engine-pick --> IPS engine takes the best • none --> no hardware acceleration • CP-Only --> hardware acceleration over CPx (Content) Processor • NP-only --> hardware acceleration over NPx (Network) Processor • NP+CP --> hardware acceleration over CPx (Content) and NPx (Network) Processor For the most modells the option is on " engine-pck" which should cover 99% of the usage. Hope this helps.....and again be careful with IPS it is the main function which will impact the FGT most. If used correct no problem. If used not correct you " can" have most cpu performance used for IPS. have fun Andrea

[Baptiste]

Hi thanks a lot ! Baptiste