FortiGate Administration Guide - FirewallShop.com

Intrusion Protection
Predefined signatures
Table 36: Actions to select for each predefined signature (Continued)
Reset Client
Reset Server
Drop Session
Pass Session
Clear Session
When a packet triggers a signature, the FortiGate unit generates an
alert and drops the packet. The FortiGate unit sends a reset to the
client and drops the firewall session from the firewall session table.
This is used for TCP connections only. If set for non-TCP connection
based attacks, the action will behave as Clear Session. If the Reset
Client action is triggered before the TCP connection is fully
established, it acts as Clear Session.
When a packet triggers a signature, the FortiGate unit generates an
alert and drops the packet. The FortiGate unit sends a reset to the
server and drops the firewall session from the firewall session table.
This is used for TCP connections only. If set for non-TCP connection
based attacks, the action will behave as Clear Session. If the Reset
Server action is triggered before the TCP connection is fully
established, it acts as Clear Session.
When a packet triggers a signature, the FortiGate unit generates an
alert and drops the packet. For the remainder of this packet’s firewall
session, all follow-up packets are dropped.
When a packet triggers a signature, the FortiGate unit generates an
alert and allows the packet through the firewall. For the remainder of
this packet’s session, the IPS is bypassed by all follow-up packets.
When a packet triggers a signature, the FortiGate unit generates an
alert and the session to which the packet belongs is removed from the
session table immediately. No reset is sent.
For TCP, all follow-up packets could be dropped.
For UDP, all follow-up packets could trigger the firewall to create a
new session.
Using display filters
By default, all the predefined signatures are displayed. You can apply filters to
display only the signatures you want to view. For example, if you want to view the
enabled signatures only, you can use the Enable or Disable status filter. See
“Adding filters to web-based manager lists” on page 43.
To apply filters to the predefined signature list
1 Go to Intrusion Protection > Predefined.
2 Select the filter icon beside the column name in the signature table.
3 In the Edit Filters dialog box, specify the filtering criteria and enable the filter.
If you use severity level filter, you can select one or multiple severity levels.
4 Select OK.
Configuring predefined signatures
For each signature, configure the action the FortiGate IPS takes when it detects
an attack. The FortiGate IPS can pass, drop, reset or clear packets or sessions.
Enable or disable packet logging. Select a severity level to be applied to the
signature.
You can also specify the traffic by source and destination addresses to be
exempted from IPS filtering.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 415