Predefined IPS signature settings

[marypoppins]

Dear All,

Could you please tell me how can I view the settings (F-SBID) of predefined ips signatures? Also where can I modify the rate/limit setting for example for the SMTP.Login.Brute.Force ? Especially in CLI?

Thank you

fortigate 600e

[gfleming]

Here is the documentation to modify the rate-based settings: https://docs.fortinet.com/document/fortigate/7.2.2/administration-guide/419589/ips-configuration-opt...

Unfortunately I am fairly certain there is no way to view the F-SBID of the predefined IPS signatures. TAC can help you modify them as needed, though, on a case-by-case basis.

[marypoppins]

Sorry forgot to mention, version 6.4
I can not find its equivalent in the 6.4 version docs :(

[pminarik · Accepted solution]

It's the same in 6.4 and 7.0/7.2. If you're not too familiar with it, perhaps GUI will be easier. You need to pick the specific signature(s), and then switch "Rate-based settings" to "specify". Then you will be able to set the threshold and duration.

GUI IPS signature filter rate-based settings

[marypoppins]

Ohh, I could not see the forest for the tree! And it also obvious in cli now.

Thank you