• All Files

Home > Online Help

Interface policies

Interface policies are implemented before the “security” policies and are only flow based.

This feature allows you to attach a set of IPS policies with the interface instead of the forwarding path, so packets can be delivered to IPS before entering firewall. This feature is used for following IPS deployments:

• One-Arm: by defining interface policies with IPS and DoS anomaly checks and enabling sniff-mode on the interface, the interface can be used for one-arm IDS;
• IPv6 IPS: IPS inspection can be enabled through interface IPv6 policy. Only IPS signature scan is supported in FortiOS 5.2. IPv6 DoS protection is not supported;
• Scan traffics that destined to FortiGate;
• Scan and log traffics that are silently dropped or flooded by Firewall or Multicast traffic.

IPS sensors can be assigned to an interface policy. Both incoming and outgoing packets are inspected by IPS sensor (signature).

Here is an example of an interface policy,

config firewall interface-policy

edit 1

set status enable

set interface "port14"

set srcaddr "all"

set dstaddr "all"

set service "ALL"

set application-list-status disable

set ips-sensor-status enable

set ips-sensor "default"

set av-profile-status disable

set webfilter-profile-status disable

set spamfilter-profile-status disable

set dlp-sensor-status disable

set label "Port 14 Interface Policy"

next

end