Fortinet Creating Custom Application Signatures for FortiGate IPS: A Comprehensive Guide

Custom signatures Creating custom signatures

Table 9: Other keywords (Continued)

Keyword and Value	Description
--rpc_num<app_int>[,	Check for RPC application, version, and
<ver_int> *][,	procedure numbers in SUNRPC CALL
<proc_int> *>];	requests. The * wildcard can be used for
	version and procedure numbers.
--same_ip;	The source and the destination have the same
	IP addresses.

Example custom signatures

Custom signature fields and syntax are fully described in this chapter, though using them to build a custom signature can be complex. It’s best to start with a simpler signature.

Example 1: signature to block access to example.com

In this first example, we will create a custom signature to block access to the example.com URL.

1Custom signature basic format

All custom signatures have a header, and at least one keyword/value pair. The header is always the same:

F-SBID( )

The keyword/value pairs appear within the parentheses and each pair is followed by a semicolon.

2Choosing a name for the custom signature

Every custom signature requires a name, so it is good practice to assign a name before any other keywords are added.

Use the --namekeyword to assign the custom signature a name. The name value follows the keyword after a space. Enclose the name value in double- quotes:

F-SBID( --name "Block.example.com"; )

The signature, as it appears here, will not do anything if used. It has a name, but doesn’t look for any patterns in network traffic. You must specify a pattern for the FortiGate unit to search for.

3Adding a signature pattern

Use the --patternkeyword to specify what the FortiGate unit will search for:

F-SBID( --name "Block.example.com"; --pattern "example.com"; )

The signature will now detect the example.com URL appearing in network traffic. The custom signature should only detect the URL in HTTP traffic, however. Any other traffic with the URL should be allowed to pass. For example, an Email message to or from example.com should not be stopped.

4Specifying the service

Use the --servicekeyword to limit the effect of the custom signature to only the HTTP protocol.

F-SBID( --name "Block.example.com"; --pattern

"example.com"; --service HTTP; )

FortiGate IPS User Guide Version 3.0 MR7
01-30007-0080-20080916	33