IPS on a specific policy

[NATHANJ]

Hi Guys

We are trying to create a custom IPS signature to block all ports and just allow a specific port to go through.

Can an IPS signature achieve that?

Here's what we got so far using a specific port 23232

F-SBID(--name "TERMINAL"; --protocol tcp; --flow from_client; --dst_port !23232; )

Any help would be useful :)

[ronalds_567]

Hi Nathanj,

You can do that but you should do it easily using a custom service on your policy.

Hope it helps

Ronald

[NATHANJ]

Hi Robert 

Thanks. But i heard now they want the IPS signature more specific with patterns like:

"msgType"

"chain"

"store"

"terminal"

Do you know how we could fit that in, in the signature?

First time writing one :\

[darwin_FTNT]

http://help.fortinet.com/...20IPS%20Signatures.htm