syntax

[RF]

i am using fortigate 1000c i am trying to create a custom signature to block web traffic on windows xp computers. i am getting error invalid index code. please do correct the below syntax. F-SBID( --attack_id 8151; --vuln_id 8151; --name " Windows.NT.5.Web.Surfing" ; --default_action drop_session; --service HTTP; --protocol tcp; --app_cat 25; --flow from_client; --pattern " Windows NT 5." ; --no_case; --context header; )

[emnoc · Accepted solution]

F-SBID( --attack_id 8151; --vuln_id 8151; --name " Windows.NT.5.Web.Surfing" ; --default_action drop_session; --service HTTP; --protocol tcp; --app_cat 25; --flow from_client; --pattern " Windows NT 5." ; --no_case; --context header; )

Periods !@#" and others charactrers are a mother you have to escape them try this ( I got lazy with the periods :) ) show ips custom config ips custom edit " 1" set signature " F-SBID( --attack_id 8151; --name \" WindowsSurfing\" ; --default_action drop_session; --service HTTP; --protocol tcp; --app_cat 25; --flow from_client; --pattern \" Windows\" ; --no_case; --context header; )" next end Also imho I drop the vuln_id field is kinda of redundant imho but YMMV. You can follow my blog at http://socpuppet.blogspot.com/2013/01/writing-ips-rules-fortinet-style.html

[RF]

Thanks alot show ips custom config ips custom edit " 1" set signature " F-SBID( --attack_id 8151; --name \" WindowsSurfing\" ; --default_action drop_session; --service HTTP; --protocol tcp; --app_cat 25; --flow from_client; --pattern \" Windows NT 5.\" ; --no_case; --context header; )" next end I would try this for windows xp computers(Windows NT 5.) tomorrow and let you know

[emnoc]

Curious as to what your trying to drop with that signature ? And why if Fortinet don' t already have one ?

[RF]

i want to decommission windows xp computers from my network as some of the users are not ready to give up their computers

[wengert]

I had the same Problem a few days ago. I get the custom Filter from the Fortigate Cookbook. I solved it by copying the signature to notepad++ and remove all LineFeeds there. (If i did this directly in the Firewall-Editfield i get the error)

 F-SBID( --attack_id 8151;--vuln_id 8151; --name " Windows.NT.5.Web.Surfing" ; --default_action drop_session; --service HTTP; --protocol tcp; --app_cat 25; --flow from_client;--pattern " Windows NT 5." ; --no_case; --context header; )
 

[emnoc]

Wengert, that' s a good point. Becarefull of anything you copy or paste in the cli or WebGUI IPS input block. I do wish they ( fortinet ) would create a IPS custom signature wizzard/tool. There' s one other method is to build it as a snort rule and use the perl snort to fortigate conversion script. It does a half-ass job with converting " most" snort 2.x format rules into fortinet IPS format. I will search for the script and post it here. Op, good hope you catch them. I think you would be better by using end-protection to accomplish this also and with better control and reliability. Also explicit proxy and block bad User-Agent or no User-Agent, would be even better. keep in mind the following; this rule could be circumvented by anybody that uses User-Agent changer or if the client is using HTTPs this rule is practically useless.

[rwpatterson]

Half ass? LOL! What do you want for free? http://camerabob.dyndns.org:5190/Fortigate/snort.cgi