'Rate' parameter seems to be ignored? What am I doing wrong?

[x_member]

I'm still feeling my way with FortiOS and have recently successfully implemented a Fortigate 60D running 5.2.3 which replaced an ISA server cluster.

I'm now trying to improve security at the perimeter by implementing a custom IPS signature to detect attempts to break into the mail server and quarantine the offending IP after 2 failed logins within 90 seconds based on Ken Felix's blog post here

config ips custom
    edit "SMTP_AUTH01"
        set signature "F-SBID( --attack_id 1000; --revision 1; --name \"SMTP_AUTH_FAILURE01\"; 
          --service SMTP; --protocol tcp; --tcp_flags PA; 
          --pattern \"535 5.7.8 Authentication credentials invalid\"; 
          --flow from_server,reversed; --track dst_ip; --rate 2,90,limit;)"
  set comment "3 failed SMTP authentication attempts within 2 minutes"
    next
end

This signature works as the offending IP is quarantined successfully and can be viewed in the list using 

diagnose firewall ip_host list

however quarantine occurs for any traffic after the first rejected login, rather than after the second as expected. If I change the rate to 6, 120 then the email server ban kicks in before any quarantine takes effect (the email server bans the IP after a third failed auth attempt).

Can anyone point to what I'm missing or guide me how best to debug this?

[emnoc]

This is ken

Try removing the limit from the  count & see if that works. The below should be 2 failures in 90 seconds.

--track dst_ip; --rate 2,90;

[x_member]

Thanks for responding Ken. I've a feeling I may have tried that today but can't be sure so I'll give it a proper whirl tomorrow morning when my head is clear and the coffee is fresh. I had a feeling you might be on here but wasn't sure so feel free to ignore my pleas for help on the blog post. The blog's been a great help to an old dog trying to learn new tricks :)

[x_member]

emnoc wrote:

This is ken

Try removing the limit from the  count & see if that works. The below should be 2 failures in 90 seconds.

--track dst_ip; --rate 2,90;

Mea culpa Ken.

Having consulted with the mail administrator this morning and looked at the night's logs it's clear that my testing must have been flawed - the rate is indeed working.

Many thanks for responding.