FortiGate Administration Guide - FirewallShop.com

Anomalies
Intrusion Protection
To configure the protocol decorder port settings
1 Go to Intrusion Protection > Signature > Protocol Decorder.
2 Select the Configure icon for the decorder.
3 Modify the port number or port numbers as required.
4 Select OK.
Upgrading IPS protocol decoder list
IPS protocol decoders are included in the IPS upgrade package available through
the FortiGuard Distribution Network (FDN). There is no need to wait for firmware
upgrades. The IPS upgrade package will keep the IPS decoder list up to date with
new threats such as the latest versions of existing IM/P2P as well as new
applications.
Anomalies
The FortiGate IPS uses anomaly detection to identify network traffic that does not
fit known or common traffic patterns and behavior. For example, if one host keep
sending a number of session within a second, the destination will experience
traffic flooding. In this case, the FortiGate IPS uses session thresholds to prevent
flooding.
The FortiGate IPS identifies the four statistical anomaly types for the TCP, UDP,
and ICMP protocols.
Flooding
Scan
Source session
limit
Destination
session limit
If the number of sessions targeting a single destination in one second is
over a specified threshold, the destination is experiencing flooding.
If the number of sessions from a single source in one second is over a
specified threshold, the source is scanning.
If the number of concurrent sessions from a single source is over a
specified threshold, the source session limit is reached.
If the number of concurrent sessions to a single destination is over a
specified threshold, the destination session limit is reached.
Enable or disable logging for each traffic anomaly, and configure the IPS action in
response to detecting an anomaly. In many cases, the thresholds the anomaly
uses to detect traffic patterns that could represent an attack are configurable.
Note: It is important to know normal and expected network traffic before changing the
default anomaly thresholds. Setting the thresholds too low could cause false positives, and
setting the thresholds too high could miss some attacks.
Use the CLI to configure session control based on source and destination network
address.
The traffic anomaly detection list can be updated only when the FortiGate
firmware image is upgraded.
Note: If virtual domains are enabled on the FortiGate unit, the IPS is configured globally. To
access the IPS, select Global Configuration on the main menu.
FortiGate Version 3.0 MR5 Administration Guide
420 01-30005-0203-20070830