FortiGate Administration Guide - FirewallShop.com

Intrusion Protection
Protocol Decoders
Protocol Decoders
The FortiGate IPS uses protocol decoders to identify the abnormal traffic patterns
that do not meet the protocol requirements and standards. For example, the
HTTP decoder monitors the HTTP traffic to identify any HTTP packets that do not
meet the HTTP protocol standards.
On the Intrusion Protection > Signature > Protocol Decoder page, you can
view the decoders and configure the port numbers that the protocol decoders
monitor. To configure other decoder settings, such as action and packet logging,
you must go to Intrusion Protection > Signature > Predefined.
Note: If virtual domains are enabled on the FortiGate unit, the IPS is configured globally. To
access the IPS, select Global Configuration on the main menu.
Viewing the protocol decoder list
To view the decoder list, go to Intrusion Protection > Signature > Protocol
Decoder.
Figure 284:Portion of the protocol decoder list
Name
Ports
Configure icon
The protocol decoder name.
The port number or numbers the decoder monitors.
Click to modify the signature port settings. You cannot modify settings of
some decoders used by the system.
Configuring IPS protocol decorders
On the Protocol Decorders page, you can modify the port numbers that the
decorders monitor. You cannot modify port settings of some decoders used by the
system.
On the Intrusion Protection > Signature > Predefined page, you can modify the
decorders’ other settings, such as action and packet logging.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 419