Configure IPS options
There are a number of CLI commands that influence how IPS functions.
Hardware Acceleration
In order to provide control over the hardware’s processing of IPS there are commands to configure and control the hardware accelleration of IPS. There are two settings that can be chosen, one for the network processor and one for the content processor.
Network processor acceleration can be disabled or set to enable basic acceleration.
Content processor acceleration can be disabled or set to either basic or advanced acceleration.
These Settings are only found in the CLI:
config ips global
set np-accel-mode {none | basic}
set cp-accel-mode {none | basic | advanced}
end
Extended IPS Database.
Some models have access to an extended IPS Database. The extended database may affect the performance of the FortiGate unit so depending on the model of the FortiGate unit the extended database package may not be enabled by default. For example, the D-series Desktop model have this option disabled by default.
This feature can only be enbled through the CLI.
config ips global
set database extended
end
Configuring the IPS engine algorithm
The IPS engine is able to search for signature matches in two ways. One method is faster but uses more memory, the other uses less memory but is slower. Use the algorithm CLI command to select one method:
config ips global
set algorithm {super | high | low | engine-pick}
end
Specify high to use the faster more memory intensive method or low for the slower memory efficient method. The setting super improves the performance for FortiGate units with more than 4GB of memory. The default setting is engine-pick, which allows the IPS engine to choose the best method on the fly.
Configuring the IPS engine-count
FortiGate units with multiple processors can run more than one IPS engine concurrently. The engine-count CLI command allows you to specify how many IPS engines are used at the same time:
config ips global
set engine-count <int>
end
The recommended and default setting is 0, which allows the FortiGate unit to determine the optimum number of IPS engines.
Configuring fail-open
If the IPS engine fails for any reason, it will fail open by default. This applies for inspection of all the protocols inspected by FortiOS IPS protocol decoders, including but not limited to HTTP, HTTPS, FTP, SMTP, POP3, IMAP, etc. This means that traffic continues to flow without IPS scanning. If IPS protection is more important to your network than the uninterrupted flow if network traffic, you can disable this behavior using the fail‑open CLI command:
config ips global
set fail-open {enable | disable}
end
The default setting is disable.
Configuring the session count accuracy
The IPS engine can keep track of the number of open session in two ways. An accurate count uses more resources than a less accurate heuristic count.
config ips global
set session-limit-mode {accurate | heuristic}
end
The default is heuristic.
Configuring IPS intelligence
If intelligent-mode is enabled (the default), in most cases the IPS engine will scan the first 200 kilobytes of a session (this value is hard coded).
In some cases, however, the IPS engine will still scan all traffic in a session. If intelligent-mode is disabled, the IPS engine scans all traffic.
config ips global
set intelligent-mode [enable|disable]
end
Configuring the IPS buffer size
Set the size of the IPS buffer.
config ips global
set socket-size <int>
end
The acceptable range is from 1 to 64 megabytes. The default size varies by model. In short, socket-size determines how much data the kernel passes to the IPS engine each time the engine samples packets.
Configuring protocol decoders
The FortiGate Intrusion Protection system uses protocol decoders to identify the abnormal traffic patterns that do not meet the protocol requirements and standards. For example, the HTTP decoder monitors traffic to identify any HTTP packets that do not meet the HTTP protocol standards.
To change the ports a decoder examines, you must use the CLI. In this example, the ports examined by the DNS decoder are changed from the default 53 to 100, 200, and 300.
config ips decoder dns_decoder
set port_list "100,200,300"
end
You cannot assign specific ports to decoders that are set to auto by default. These decoders can detect their traffic on any port. Specifying individual ports is not necessary.
Configuring security processing modules
FortiGate Security Processing Modules, such as the CE4, XE2, and FE8, can increase overall system performance by accelerating some security and networking processing on the interfaces they provide. They also allow the FortiGate unit to offload the processing to the security module, thereby freeing up its own processor for other tasks. The security module performs its own IPS and firewall processing, but you can configure it to favor IPS in hostile high-traffic environments.
If you have a security processing module, use the following CLI commands to configure it to devote more resources to IPS than firewall. This example shows the CLI commands required to configure a security module in slot 1 for increased IPS performance.
config system amc-slot
edit sw1
set optimization-mode fw-ips
set ips-weight balanced
set ips-p2p disable
set ips-fail-open enable
set fp-disable none
set ipsec-inb-optimization enable
set syn-proxy-client-timer 3
set syn-proxy-server-timer 3
end
In addition to offloading IPS processing, security processing modules provide a hardware accelerated SYN proxy to defend against SYN flood denial of service attacks. When using a security module, configure your DoS anomaly check for tcp_syn_flood with the Proxy action. The Proxy action activates the hardware accelerated SYN proxy.
IPS signature rate count threshold
The IPS signature threshold can allow configuring a signature so that it will not be triggered until a rate count threshold is met. This provides a more controlled recording of attack activity. For example, if multiple login attempts produce a failed result over a short period of time then an alert would be sent and perhaps traffic blocked. This would be a more rational response than sending an alert every time a login failed.
The syntax for this configuration is as follows:
config ips sensor
edit default
config entries
edit <Filter ID number>
set rule <*id>
set rate-count <integer between 1 - 65535>
set rate-duration <integer between 1 - 65535>
The value of the rate-duration is an integer for the time in seconds.
set rate-mode <continuous | periodical>
The rate-mode refers to how the count threshold is met.
If the setting is “continuous”, and the action is set to block, as soon as the rate-count is reached the action is engaged. For example, if the count is 10, as soon as the signature is triggered 10 times the traffic would be blocked.
If the setting is “periodical”, the FortiGate allows up to the value of the rate-count incidents where the signature is triggered during the rate-duration. For example, if the rate count is 100 and the duration is 60, the signature would need to be triggered 100 times in 60 seconds for the action to be engaged.
set rate-track <dest-ip | dhcp-client-mac | dns-domain | none | src-ip>
This setting allows the tracking of one of the protocol fields within the packet.
Copyright © 2018 Fortinet, Inc. All Rights Reserved. | Terms of Service | Privacy Policy
