Single-arm IDS in FortiOS v4

[#1]

I noticed new single-arm IDS feature in FortiOS v4, but no complete description how to configure it. Simply place " set ips-sniffer-mode enable" to interface configuration seems to be insufficient. Documentation is silent about it too.

[UkWizard]

The v4 admin guide explains quite well i thought?

[#3]

No, I don' t understand how to configure corresponding firewall policy with protection profile. I have to set relation between interface and seleced IDS sensor.

[abelio]

ORIGINAL: gry73 No, I don' t understand how to configure corresponding firewall policy with protection profile. I have to set relation between interface and seleced IDS sensor.

Hi, you just to choose which FTG' s interface will be the one that sniff all the traffic, connect it to one hub or span port switch, and define the new interface-policy associated. Include inside all the IPS sensor you want to monitor. Two steps then: 1)enabling ips-sniffer-mode for the choosen interface 2) configure the relevant interface-policy including inside all the IPS sensor you want to monitor regards

[UkWizard]

I would take a guess and say either; v3 firmware - Int -> Int or v4 firmware- any -> any

[#6]

Thank you, it works now. Necessary configuration: config firewall interface-policy edit 1 set interface ... set ips-sensor-status enable set ips-sensor ... next