FortiGate Administration Guide - FirewallShop.com

Predefined signatures
Intrusion Protection
Figure 281:Configure Predefined IPS Signatures
Action
Packet Log
Severity
Exempt IP
Select an action from the list. Action can be Pass, Drop, Reset, Reset
Client, Reset Server, Drop Session, Clear Session, or Pass Session.
See Table 36 for descriptions of the actions.
Enable packet logging.
Select a severity level from the dropdown list. Severity level can be
Information, Low, Medium, High, or Critical. Severity level is set for
individual signatures.
Specify an exempt policy to exempt the IP address or subnet from IPS
signature checking.
Name: Enter a policy name.
Source: Enter the source IP address or subnet. You must use a subnet
mask when entering a host address. For example, for IP address
172.168.1.1, you must enter 172.168.1.1/32.
Destination: Enter the destination IP address or subnet. Follow the
same rule as the source IP and subnet.
Fine tuning IPS predefined signatures for enhanced system performance
By default, the FortiGate unit will have most of the predefined signatures enabled
and will log all of them. To meet your specific network requirements, you need to
fine tune the signature settings.
By fine tuning the signatures and log settings you can provide the best protection
available but also free up valuable FortiGate resources. Fine tuning allows you to
turn off features that you are not using. By turning off signatures and logs that you
do not use, you allow the FortiGate unit to perform tasks faster thus improving
overall system performance.
Not all systems require you to scan for all signatures of the IPS suite all the time.
For example. If you have a FortiGate unit that is controlling computers that only
have access to an internal database and do not have access to the internet or
email, there is no point having the Fortigate unit scanning for certain types of
signatures such as email, IM, and P2P.
By telling the FortiGate unit not to look for these signatures, you will maintain a
high level of security and increase overall performance.
You should also review exactly how you use the information provided by the
logging feature. If you find that you do not review the information, it is best to turn
off the logging feature. Logging is best used to provide actionable intelligence.
FortiGate Version 3.0 MR5 Administration Guide
416 01-30005-0203-20070830