FortiGate IPS User Guide Version 3.0 MR7
44
01-30007-0080-20080916
Configuring IPS sensors
IPS sensors
To edit a pre-defined or custom override, go to
Intrusion Protection >
IPS Sensor
and select the Edit icon of the IPS sensor containing the override you
want to edit. When the sensor window opens, select the Edit icon of the override
you want to change.
Figure 11: Configure IPS override
Note:
Before an override can affect network traffic, you must add it to a filter, and you must
select the filter in a protection profile applied to a policy. An override does not have the
ability to affect network traffic until these steps are taken.
Signature
Select the browse icon to view the list of available signatures. From this
list, select a signature the override will apply to and then select OK.
Enable
Select to enable the signature override.
Action
Select one of Pass, Block or Reset. When the override is enabled, the
action determines what the FortiGate will do with traffic containing the
specified signature.
Logging
Select to enable creation of a log entry if the signature is discovered in
network traffic.
Packet Log
Select to save packets that trigger the override to the FortiGate hard
drive for later examination. This option is only valid on FortiGate units
with an internal hard drive.
Exempt IP:
Enter IP addresses to exclude from the override. The override will then
apply to all IP addresses except those defined as exempt. The exempt
IP addresses are defined in pairs, with a source and destination, and
traffic moving from the source to the destination is exempt from the
override.
Source
The exempt source IP address. Enter
0.0.0.0/0
to
include all source IP addresses.
Destination:
The exempt destination IP address. Enter
0.0.0.0/0
to
include all destination IP addresses.
