IPS
IPS CLI configuration
FortiGate-1000A/FA2 Administration Guide
01-28011-0254-20051115
303
To configure the settings of an anomaly
1
Go to
IPS > Anomaly
.
2
Select the Edit icon for the signature you want to configure.
3
Select the Enable box to enable the anomaly or clear the Enable box to disable the
anomaly.
4
Select the Logging box to enable logging for this anomaly or clear the Logging box to
disable logging for this anomaly.
5
Select an action for the FortiGate unit to take when traffic triggers this anomaly.
6
Enter a new threshold value if required.
7
Select OK.
To restore the default settings of an anomaly
1
Go to
IPS > Anomaly
.
2
Select the Reset icon for the anomaly you want to restore to defaults.
The Reset icon is displayed only if the settings for the anomaly have been changed
from defaults.
3
Select OK.
IPS CLI configuration
Reset
Server
When a packet triggers a signature, the FortiGate unit generates an
alert and drops the packet. The FortiGate unit sends a reset to the
server and drops the firewall session from the firewall session table.
This is used for TCP connections only. If set for non-TCP connection
based attacks, the action will behave as Clear Session. If the Reset
Server action is triggered before the TCP connection is fully established,
it acts as Clear Session.
Drop
Session
When a packet triggers a signature, the FortiGate unit generates an
alert and drops the packet. For the remainder of this packet’s firewall
session, all follow-up packets are dropped.
Clear
Session
When a packet triggers a signature, the FortiGate unit generates an
alert and the session to which the packet belongs is removed from the
session table immediately. No reset is sent.
For TCP, all follow-up packets could be dropped.
For UDP, all follow-up packets could trigger the firewall to create a new
session.
Pass
Session
When a packet triggers a signature, the FortiGate unit generates an
alert and allows the packet through the firewall. For the remainder of this
packet’s session, the IPS is bypassed by all follow-up packets.
threshold
Traffic over the specified threshold triggers the anomaly.
Note:
This guide only covers Command Line Interface (CLI) commands that are not
represented in the web-based manager. For complete descriptions and examples of how to use
CLI commands see the
FortiGate CLI Reference Guide
.
Summary of Contents for FortiGate 1000A
Page 80: ...80 01 28011 0254 20051115 Fortinet Inc FortiGate IPv6 support System Network ...
Page 88: ...88 01 28011 0254 20051115 Fortinet Inc Dynamic IP System DHCP ...
Page 122: ...122 01 28011 0254 20051115 Fortinet Inc FortiManager System Config ...
Page 248: ...248 01 28011 0254 20051115 Fortinet Inc Protection profile Firewall ...
Page 260: ...260 01 28011 0254 20051115 Fortinet Inc CLI configuration User ...
Page 380: ...380 01 28011 0254 20051115 Fortinet Inc CLI configuration Log Report ...
Page 392: ...392 01 28011 0254 20051115 Fortinet Inc Glossary ...
