Fortinet FortiGate 1000A, Руководство администратора

Страница: 298 / 412

298
01-28011-0254-20051115 Fortinet Inc.
Signature IPS
Configuring parameters for dissector signatures
The following predefined dissector signatures have configurable parameters.
• http_decoder
• im
• p2p
• rpc_decoder
• tcp_reassembler
Figure 152:Example of dissector signature parameters: tcp_reassembler
Figure 153:Example of dissector signature parameters: p2p
Custom signatures
You can create custom IPS signatures. The custom signatures you create are added
to a single Custom signature group.
idle_timeout If a session is idle for longer than this number of seconds, the session will
not be maintained by tcp_reassembler.
min_ttl A packet with a higher ttl number in its IP header than the number specified
here is not processed by tcp_reassembler.
port_list A comma separated list of ports. The dissector can decode these TCP ports.
bad_flag_list A comma separated list of bad TCP flags.
reassembly_
direction Valid settings are from-server, from-client, or both.
codepoint A number from 0 to 63. Used for differentiated services tagging. When the
action for p2p and im signatures is set to Pass, the FortiGate unit checks the
codepoint. If the codepoint is set to a number from 1 to 63, the codepoint for
the session is changed to the specified value. If the codepoint is set to -1
(the default) no change is made to the codepoint in the IP header.