FortiGate Administration Guide - FirewallShop.com

Configuring a protection profile
Firewall Protection Profile
IPS options
Figure 217:Protection profile IPS options
The following options are available for IPS through the protection profile.
IPS Signature
IPS Anomaly
Select one or more IPS signature severity levels for this profile. Options
are Critical, High, Medium, Low, and Information. Signatures with severity
levels that have not been selected are not triggered.
Select one or more IPS anomaly severity levels for this profile. Options
are Critical, High, Medium, Low, and Information. Anomalies with severity
levels that have not been selected are not triggered.
Content archive options
See “Intrusion Protection” on page 411 for more IPS configuration options.
You can choose to display the content meta-information of the HTTP, HTTPS,
FTP, IMAP, POP3, SMTP, and IM traffic on the system dashboard, or archive the
full content to a FortiAnalyzer device.
You must enable at least one of the content protection functions, such as AV
scanning, web filtering, and spam filtering, for the relevant protocol, before you
can use the full content archiving features for that protocol. In other words, if no
content protection function is enabled for a protocol, the full content of that
protocol will not be archived to the FortiAnalyzer even if you enable Full Content
Archive.
Taking FTP for example, the following lists the three content archiving scenarios
• If you do not enable AV scanning for FTP, but you select Full Content Archive,
the FTP files will not be archived to the FortiAnalyzer device. Only the metainformation
is recorded.
• If you enable AV scanning for FTP, but you select Pass for files larger than
10MB, files larger than 10MB will not be archived to the FortiAnalyzer device.
Only the meta-information is recorded.
• If you enable AV scanning for FTP, but you select Block for files larger than
10MB, files larger than 10MB will not be archived to the FortiAnalyzer device,
and the meta-information will not be recorded either.
To be able to access all content archiving options, a FortiAnalyzer unit must be
configured and logging to the FortiAnalyzer must be enabled. For more
information, see “Logging to a FortiAnalyzer unit” on page 472.
Figure 218:Protection profile content archive options
FortiGate Version 3.0 MR5 Administration Guide
338 01-30005-0203-20070830