Configuring IPS sensors | IPS sensors |
Note: Before an override can affect network traffic, you must add it to a filter, and you must select the filter in a protection profile applied to a policy. An override does not have the ability to affect network traffic until these steps are taken.
To edit a
IPS Sensor and select the Edit icon of the IPS sensor containing the override you want to edit. When the sensor window opens, select the Edit icon of the override you want to change.
Figure 11: Configure IPS override
Signature | Select the browse icon to view the list of available signatures. From this | |
| list, select a signature the override will apply to and then select OK. | |
Enable | Select to enable the signature override. | |
Action | Select one of Pass, Block or Reset. When the override is enabled, the | |
| action determines what the FortiGate will do with traffic containing the | |
| specified signature. | |
Logging | Select to enable creation of a log entry if the signature is discovered in | |
| network traffic. |
|
Packet Log | Select to save packets that trigger the override to the FortiGate hard | |
| drive for later examination. This option is only valid on FortiGate units | |
| with an internal hard drive. | |
Exempt IP: | Enter IP addresses to exclude from the override. The override will then | |
| apply to all IP addresses except those defined as exempt. The exempt | |
| IP addresses are defined in pairs, with a source and destination, and | |
| traffic moving from the source to the destination is exempt from the | |
| override. |
|
| Source | The exempt source IP address. Enter 0.0.0.0/0 to |
|
| include all source IP addresses. |
Destination: The exempt destination IP address. Enter 0.0.0.0/0 to include all destination IP addresses.
FortiGate IPS User Guide Version 3.0 MR7
44 |
