Fortinet Gate 60D, Administration Manual

Page: 457 / 706

Intrusion Protection Signatures
FortiGate Version 4.0 Administration Guide
01-400-89802-20090424
457
http://docs.fortinet.com/ • Feedback
By using only the signatures you require, you can improve system performance and
reduce the number of log messages and alert email messages the IPS sensor generates.
For example, if the FortiGate unit is not protecting a web server, do not include any web
server signatures.
Viewing the predefined signature list
The predefined signature list includes all of predefined signatures currently in the
FortiGuard Center Vulnerability Encyclopedia . Each signature name is a link to the
vulnerability encyclopedia entry for the signature. For each signature the vulnerability
encyclopedia describes the attack detected by the signature and provides recommended
actions and links for more information.
The predefined signature list also includes characteristics such as severity of the attack,
protocol, and applications affected for each signature. These characteristics give you a
quick reference to what the signature is for. You can also use these characteristics to sort
the signature list, grouping signatures by common characteristics. The signature list also
displays the default action, the default logging status, and whether the signature is
enabled by default.
To view the predefined signature list, go to UTM > Intrusion Protection > Predefined . You
can also use filters and column settings to display the signatures you want to view. For
more information, see
“Using display filters” on page 458 .
Figure 291: Predefined signature list
By default, the signatures are sorted by name. To sort the table by another column, select
the header of the column to sort by.
Note: Some default protection profiles include IPS Sensors that use all the available
signatures. By using these default settings, you may be slowing down the overall
performance of the FortiGate unit. By creating IPS sensors with only the signatures your
network requires, you can ensure maximum performance as well as maximum protection.
Note: If virtual domains are enabled on the FortiGate unit, the Intrusion Protection settings
are configured separately in each VDOM. All sensors and custom signatures will appear
only in the VDOM in which they were created.
Current Page The current page number of list items that are displayed. Select the left and
right arrows to display the first, previous, next or last page of signatures.
Column Settings Select to customize the signature information displayed in the table. You can
also readjust the column order. For more information, see
“Using column
settings to control the columns displayed” on page 58 and “Web-based
manager icons” on page 60 .
Current page Filter