Signature - Fortinet FortiGate FortiGate-1000A Administration Manual

Signature

Signature
294
IPS updates and information
FortiProtect services are a valuable customer resource and include automatic updates
of virus and IPS (attack) engines and definitions through the FortiProtect Distribution
Network (FDN). The FortiProtect Center also provides the FortiProtect virus and
attack encyclopedia and the FortiProtect Bulletin.
Visit the FortiProtect Center at http://www.fortinet.com/FortiProtectCenter/.
To set up automatic and push updates see
This chapter describes:
• Signature
• Anomaly
• IPS CLI configuration
The FortiGate IPS matches network traffic against patterns contained in attack
signatures. Attack signatures reliably protect your network from known attacks.
Fortinet's FortiProtect infrastructure ensures the rapid identification of new threats and
the development of new attack signatures.
You can configure the FortiGate unit to automatically check for and download an
updated attack definition file containing the latest signatures, or you can manually
download the updated attack definition file. You can also configure the FortiGate unit
to allow push updates of updated attack definition files as soon as they are available
from the FortiProtect Distribution Network. For details, see
page 132.
When the FortiGate unit installs an updated attack definition file, it checks to see if the
default configuration for any existing signatures has changed. If the default
configuration has changed, the changes are preserved.
In addition to an extensive list of predefined attack signatures, you can also create
your own custom attack signatures for the FortiGate unit. See
signatures" on page 300.
This section describes:
• Predefined signatures
• Predefined signature list
• Configuring predefined signatures
• Configuring parameters for dissector signatures
• Custom signatures
• Custom signature list
• Adding custom signatures
• Backing up and restoring custom signature files
01-28011-0254-20051115
"Update center" on page
"Update center" on
"Adding custom
IPS
132.
Fortinet Inc.