IPS signatures for traffic towards the outside

[DanieleS99]

Hi,

I'm trying to figure out what the best generic ips signatures might be to add for traffic going to the outside. I was thinking maybe of signatures like Generic.DNS.tunnel.detection.variant.A or similar ...

Anyone have any ideas on which ones might be the best?

Thanks

[Anonymous]

Hello @DanieleS99 ,

Thank you for posting to the Fortinet Community.

As per your query you can enable the IPS filter with the severity level as Medium, High or Critical which can be used with default actions.

You can use the link mentioned below for your configuration.

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/48143/intrusion-prevention-system-ips

Let me know if this helps.