Use this optional value to identify the signature. It cannot be the same value as any other custom rules. If an attack ID is not specified, the FortiGate automatically assigns an attack ID to the signature. If you are using VDOMs, custom signatures appear only in the VDOM in which you create them. You can use the same attack ID for signatures in different VDOMs.

An attack ID you assign must be between 1000 and 9999.

Example:

Enter the name of the rule. A rule name must be unique. If you are using VDOMs, custom signatures appear only in the VDOM in which you create them. You can use the same rule name for signatures in different VDOMs.

The name you assign must be a string greater than 0 and less than 64 characters in length.

Example:

Specify the traffic direction and state to be inspected. They can be used for all IP traffic.

Example:

‑‑src_port 41523; ‑‑flow bi_direction;

The signature checks traffic to and from port 41523.

If you enable “quarantine attacker”, the optional reversed keyword allows you to change the side of the connection to be quarantined when the signature is detected.

For example, a custom signature written to detect a brute-force log in attack is triggered when “Login Failed” is detected from_server more than 10 times in 5 seconds. If the attacker is quarantined, it is the server that is quarantined in this instance. Adding reversed corrects this problem and quarantines the actual attacker.

Previous FortiOS versions used to_client and to_server values. These are now deprecated, but still function for backwards compatibility.

Specify the protocol type to be inspected.

This keyword allows you to specify the traffic type by protocol rather than by port. If the decoder has the capability to identify the protocol on any port, the signature can be used to detect the attack no matter what port the service is running on. Currently, HTTP, SIP, SSL, and SSH protocols can be identified on any port based on the content.

Specify the destination port number.

You can specify a single port or port range:

Specify the source port number.

You can specify a single port or port range:

Specify the ICMP code to match.

Check for the specified ICMP ID value.

Check for the specified ICMP sequence value.

Specify the ICMP type to match.

Test the packet payload size. With data_size specified, packet reassembly is turned off automatically. So a signature with data_size and only_stream values set is wrong.

Verify that the payload has data at a specified offset, optionally looking for data relative to the end of the previous content match.

Instead of generating log entries every time the signature is detected, use this keyword to generate a log entry only if the signature is detected a specified number of times within a specified time period.

For example, if a custom signature detects a pattern, a log entry will be created every time the signature is detected. If --rate 100,10; is added to the signature, a log entry will be created if the signature is detected 100 times in the previous 10 seconds.

Use this command with --track to further limit log entries to when the specified number of detections occur within a certain time period involving the same source or destination address rather than all addresses.

Check for RPC application, version, and procedure numbers in SUNRPC CALL requests. The * wildcard can be used for version and procedure numbers.

Check that the source and the destination have the same IP addresses.

When used with --rate, this keyword narrows the custom signature rate totals to individual addresses.

For example, if --rate 100,10 is added to the signature, a log entry will be created if the signature is detected 100 times in the previous 10 seconds. The FortiGate unit maintains a single total, regardless of source and destination address.

If the same custom signature also includes ‑‑track client; matches are totalled separately for each source address. A log entry is added when the signature is detected 100 times in 10 seconds within traffic from the same source address.

The --track keyword can also be used without ‑‑rate. If an integer is specified, the client or server will be blocked for the specified number of seconds every time the signature is detected.