Rogue Security Wiki

Practical procedure and troubleshooting notes for Configuring IPS on a Fortinet Firewall.

  1. Log in to the Fortinet Web Console.

  2. In the left navigation pane, select Security Profiles.
    conipsf_1.png

  3. In the Security Profiles drop-down, select Intrusion Prevention.
    conipsf_2.png

  4. This brings you to the Intrusion Prevention page.
    conipsf_3.png

  5. Double-click the Intrusion Prevention Profile you want to use.
    conipsf_4.png

  6. Enable Block Malicious URLs.
    conipsf_4.5.png

  7. In the IPS Signatures and Filters section, double-click a signature to edit it.

  8. On this page, you can configure the following:

    • Action
      conipsf_5.png
    • Packet Logging
    • Status
    • Additional Filters
      conipsf_5.5.png

  9. Click OK when you are done configuring.

  10. Back on the Edit IPS Sensor page, you can choose to Disable, Block, or Monitor Botnet C&C traffic.
    conipsf_6.png

  11. Make sure to click OK at the bottom of the Edit IPS Sensor page when finished.
    conipsf_7.png

  12. In the left navigation pane, select Policy & Objects.
    conipsf_8.png

  13. In the Policy & Objects drop-down menu, click Firewall Policy.
    conipsf_9.png

  14. This brings you to the Firewall Policy page.
    conipsf_10.png

  15. Click the plus icon (+) on the interface where you want to enable IPS services.
    conipsf_11.png

  16. Hover over the Security Profiles column and click the pencil icon to edit.
    conipsf_12.png

  17. From here, select the IPS Sensor, highlight it, and click Apply to assign it to the interface.
    conipsf_13.png