Document Outline

• Contents
• Introduction
  • The FortiGate IPS
  • About this document
    • Document conventions
      • Typographic conventions
  • Fortinet documentation
    • Fortinet Knowledge Center
    • Comments on Fortinet technical documentation
  • Customer service and technical support
• IPS overview and general configuration
  • The FortiGate IPS
    • IPS settings and controls
    • When to use IPS
  • Network performance
    • Default signature and anomaly settings
    • Default fail open setting
    • Controlling sessions
    • Setting the buffer size
  • Monitoring the network and dealing with attacks
    • Configuring logging and alert email
    • Attack log messages
      • Signature
      • Anomaly
    • The FortiGuard Center
  • Using IPS sensors in a protection profile
    • Creating a protection profile that uses IPS sensors
    • Adding protection profiles to firewall policies
    • Adding protection profiles to user groups
• Predefined signatures
  • IPS predefined signatures
  • Viewing the predefined signature list
    • Fine tuning IPS predefined signatures for enhanced system performance
• Custom signatures
  • IPS custom signatures
  • Viewing the custom signature list
  • Custom signature configuration
    • Adding custom signatures using the web-based manager
    • Adding custom signatures using the CLI
      • Command syntax pattern
  • Creating custom signatures
    • Custom signature fields
    • Custom signature syntax
    • Example custom signatures
      • Example 1: signature to block access to example.com
      • Example 2: signature to block the SMTP ‘vrfy’ command
• Protocol decoders
  • Protocol decoders
  • Upgrading the IPS protocol decoder list
  • Viewing the protocol decoder list
• IPS sensors
  • Viewing the IPS sensor list
    • Adding an IPS sensor
  • Configuring IPS sensors
    • Configuring filters
    • Configuring pre-defined and custom overrides
• DoS sensors
  • Viewing the DoS sensor list
  • Configuring DoS sensors
  • Understanding the anomalies
• SYN flood attacks
  • What is a SYN flood attack?
  • How SYN floods work
  • The FortiGate IPS Response to SYN flood attacks
    • What is SYN threshold?
    • What is SYN proxy?
    • How IPS works to prevent SYN floods
  • Configuring SYN flood protection
  • Suggested settings for different network conditions
• ICMP sweep attacks
  • What is an ICMP sweep?
  • How ICMP sweep attacks work
  • The FortiGate IPS response to ICMP sweep attacks
    • Predefined ICMP signatures
    • ICMP sweep anomalies
  • Configuring ICMP sweep protection
  • Suggested settings for different network conditions
• Index