FortiGate Administration Guide - FirewallShop.com

Custom signatures
Intrusion Protection
Name
Enable
Logging
Action
Severity
Delete icon
Edit icon
The custom signature name.
The status of each custom signature. A check mark in the box indicates
the signature is enabled.
The logging status of each custom signature. A check mark in the box
indicates logging is enabled for the custom signature.
The action set for each custom signature. Action can be Pass, Drop,
Reset, Reset Client, Reset Server, Drop Session, Clear Session, or
Pass Session. If logging is enabled, the action appears in the status field
of the log message generated by the signature. See Table 36 for
descriptions of the actions.
The severity level set for each custom signature. Severity level can be
Information, Low, Medium, High, or Critical. Severity level is set for
individual signatures.
Select to delete the custom signature.
Select to edit the following information: Name, Signature, Action, Packet
Log, and Severity.
Creating custom signatures
Use custom signatures to block or allow specific traffic. For example, to block
traffic containing pornography, add custom signatures similar to the following:
F-SBID (--protocol tcp; --flow established; --content "nude cheerleader"; --
no_case)
When adding the signature, set action to Drop Session.
For more information on custom signature syntax, see the FortiGate Intrusion
Protection System (IPS) Guide.
Note: Custom signatures are an advanced feature. This document assumes the user has
previous experience creating intrusion detection signatures.
To create a custom signature, go to Intrusion Protection > Signature > Custom.
Figure 283:Edit Custom Signature
Name
Signature
Action
Packet Log
Severity
Enter a name for the custom signature.
Enter the custom signature. For more information about custom
signature syntax, see “Custom signature syntax” in the FortiGate
Intrusion Protection System (IPS) Guide.
Select an action from the list. Action can be Pass, Drop, Reset, Reset
Client, Reset Server, Drop Session, Pass Session, or Clear Session.
See Table 36 for descriptions of the actions.
Enable packet logging.
Select a severity level from the dropdown list. Severity level can be
Information, Low, Medium, High, or Critical. Severity level is set for
individual signatures.
FortiGate Version 3.0 MR5 Administration Guide
418 01-30005-0203-20070830