FortiGate Administration Guide - FirewallShop.com

Intrusion Protection
Anomalies
Viewing the traffic anomaly list
To view the anomaly list, go to Intrusion Protection > Anomaly.
Figure 285:A portion of the traffic anomaly list
View traffic
anomalies with
severity
Name
Enable
Logging
Action
Severity
Edit icon
Reset icon
Configuring IPS traffic anomalies
Select filters then select Go to view only those anomalies that match the
filter criteria. Sort criteria can be = to All, Information, Low,
Medium, High, or Critical.
The traffic anomaly name.
The status of the traffic anomaly. A check mark in the box indicates the
anomaly signature is enabled.
The logging status for each traffic anomaly. A check mark in the box
indicates logging is enabled for the anomaly.
The action set for each traffic anomaly. Action can be Pass, Drop, Reset,
Reset Client, Reset Server, Drop Session, Clear Session, or Pass
Session. If logging is enabled, the action appears in the status field of the
log message generated by the Anomaly. See Table 36 for descriptions of
the actions.
The severity level set for each traffic anomaly. Severity level can be
Information, Low, Medium, High, or Critical. Severity level is set for
individual anomalies.
Select to edit the following information: Action, Severity, and Threshold.
The Reset icon is displayed only if an anomaly has been modified. Use
the Reset icon to restore modified settings to the recommended values.
Each IPS traffic anomaly is preset with a recommended configuration. Use the
recommended configurations, or modify the recommended configurations to meet the
needs of your network.
To configure IPS traffic anomalies, go to Intrusion Protection > Anomaly.
Figure 286:Edit IPS Traffic Anomaly: icmp_dst_session
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 421